Back

pmi.com Domain Breach Exposure Report

Risk Score

High Risk

Massive event volume or critical assets compromised.

AI Findings Summary

Critical

The domain pmi.com has experienced a significant number of security events over the past year, with a total of 56,487 events recorded. A substantial portion of these events, 50,874 (90.1%), are classified as historical data breaches, indicating a large volume of past data compromise. Additionally, 5,613 (9.9%) events are identified as active infostealer logs, suggesting ongoing attempts to exfiltrate sensitive information. The timeline shows a notable surge in employee and client-related events during September 2025 and January 2026, with peaks of 10,933 and 10,624 employee events respectively. Malware analysis reveals Redline as the most prevalent family (39.4%), followed by Rhadamanthys (11.3%) and LummaC2 (10.7%), all of which are known for credential and information theft. The high volume of historical data breaches and active infostealer logs, coupled with the prevalence of information-stealing malware, presents a critical risk to pmi.com. The focus for remediation should be on comprehensive data breach response and recovery, alongside robust defenses against infostealers and malware. This includes strengthening access controls, enhancing endpoint security to detect and block malware like Redline, and implementing continuous monitoring for suspicious activity, particularly around the identified peak periods. Given the nature of the data breaches and infostealer activity, a thorough investigation into the root causes and the scope of compromised data is paramount.

Total Events

56,487
credential exposure events

Employee Affected Events

49,115
account email domain = pmi.com

Client Affected Events

7,372
service target = pmi.com

Free Community Account

Stop stolen credentials from logging in

Own this domain? Create a free Lunar account to see full exposure data and evidence.

12-Month Events Timeline

Event volume by breach date, employee VS client

EmployeesClients
12,0008,0004,0000
peak month 10,933
Jul 25Sep 25Nov 25Jan 26Mar 26May 26Jun 26

Infostealers VS Data Breaches

Live stealer logs VS data breaches

Infostealer logs
Events5,613
Share10%
Data breaches
Events50,874
Share90%
Infostealer logs (10%)
5,613events
Data breaches (90%)
50,874events

49,115 compromised employee accounts pose an infrastructure risk, while 7,372 leaked client credentials create regulatory liability.

Antivirus Distribution

Security Tools on Infected Endpoints

Windows Defender39
Bitdefender4
Windows Defender [ON]1
Windows Defender.1
Windows Defender ESET Security1
Kaspersky1

Malware Families Distribution

Distribution of Active Stealer Strains

Redline2,212
Rhadamanthys636
LummaC2599
Acreed309
Vidar204
StealC57
RisePro50
Remus48
Millenium43

Top Login URLs

Top exposed services found in the event results

  1. 1android://DYxvwSB7HhSNyNwbg_7EFit69hw7I8Gjo2s33O3hZNg6QaeAA8KaegDaWaN7Q8akjX7IGZiR3_-WkF7828Hhyg==@com.pmi.store.PMIAPPM06356/892
  2. 2pmi.com808
  3. 3android://DYxvwSB7HhSNyNwbg_7EFit69hw7I8Gjo2s33O3hZNg6QaeAA8KaegDaWaN7Q8akjX7IGZiR3_-WkF7828Hhyg==@com.pmi.store.PMIAPPM06545/595
  4. 4android://DYxvwSB7HhSNyNwbg_7EFit69hw7I8Gjo2s33O3hZNg6QaeAA8KaegDaWaN7Q8akjX7IGZiR3_-WkF7828Hhyg==@com.pmi.store.PMIAPPM05578/538
  5. 5android://DYxvwSB7HhSNyNwbg_7EFit69hw7I8Gjo2s33O3hZNg6QaeAA8KaegDaWaN7Q8akjX7IGZiR3_-WkF7828Hhyg==@com.pmi.store.PMIAPPM06326/515
  6. 6android://DYxvwSB7HhSNyNwbg_7EFit69hw7I8Gjo2s33O3hZNg6QaeAA8KaegDaWaN7Q8akjX7IGZiR3_-WkF7828Hhyg==@com.pmi.store.PMIAPPM06470/457
  7. 7android://mupcvDmtBj9em3FWaMGmY3ZYNQiNKnw9ri3INdBwFWSIUGrwmWP-V_vvdmjPO5wlShe6uJEqOlFfDVkE6s_r8w==@com.pmi.tangerang/406
  8. 8android://DYxvwSB7HhSNyNwbg_7EFit69hw7I8Gjo2s33O3hZNg6QaeAA8KaegDaWaN7Q8akjX7IGZiR3_-WkF7828Hhyg==@com.pmi.store.PMIAPPM06713/350
  9. 9android://DYxvwSB7HhSNyNwbg_7EFit69hw7I8Gjo2s33O3hZNg6QaeAA8KaegDaWaN7Q8akjX7IGZiR3_-WkF7828Hhyg==@com.pmi.store.PMIAPPM06358/266
  10. 10android://DYxvwSB7HhSNyNwbg_7EFit69hw7I8Gjo2s33O3hZNg6QaeAA8KaegDaWaN7Q8akjX7IGZiR3_-WkF7828Hhyg==@com.pmi.store.PMIAPPM06352/184

Infostealer By Geography

Shows the distribution of Infostealer-related credential exposure events across different geographic regions. The location is determined by analyzing the metadata of the infected machines associated with each event.

United States
Events433
Italy
Events421
Netherlands
Events387
Germany
Events358
Hungary
Events253
Romania
Events239
Poland
Events217
Czechia
Events189

Country Breakdown

  1. 1United States433
  2. 2Italy421
  3. 3Netherlands387
  4. 4Germany358
  5. 5Hungary253
  6. 6Romania239
  7. 7Poland217
  8. 8Czechia189

Services Classification Distribution

Blast radius - closer to core = more critical infrastructure, size = credential volume

Citrix31
Git28
FortiNet VPN26
Cisco (AnyConnect)12
Pulse Secure11
Microsoft7
F57

Operating System Distribution

Distribution of compromised endpoint builds

Windows 11343
Windows 11 24H2 build 26100 (64 Bit)264
Windows 10 22H2 build 19045 (64 Bit)227
Windows 10 Enterprise x64181
Windows 7 x32138

Leak Repository Classification

Where the exposed records currently reside

0
Named breaches
41,082
Combolist pools
9,792
Unattributed dumps

Disclaimer: This report includes AI-generated content. AI can make mistakes, so verify important findings independently before taking action.