Back

prom.ua Domain Breach Exposure Report

Risk Score

High Risk

Massive event volume or critical assets compromised.

AI Findings Summary

Critical

The domain `prom.ua` has experienced a significant exposure event with a risk score of 94. The primary concern stems from 41,479 historical data breaches, representing 90.9% of all events, and 4,176 active infostealer logs, accounting for 9.1%. These events collectively impacted 45,489 client accounts and 166 employee accounts over the period from July 2025 to June 2026. Malware families such as Redline, Rhadamanthys, and LummaC2 were prevalent, indicating a strong focus on credential harvesting. The targeted services include login portals for `prom.ua` and its associated services, suggesting a direct attack on user authentication mechanisms.

Total Events

45,655
credential exposure events

Employee Affected Events

166
account email domain = prom.ua

Client Affected Events

45,489
service target = prom.ua

Free Community Account

Stop stolen credentials from logging in

Own this domain? Create a free Lunar account to see full exposure data and evidence.

12-Month Events Timeline

Event volume by breach date, employee VS client

EmployeesClients
12,0008,0004,0000
peak month 10,960
Jul 25Sep 25Nov 25Jan 26Mar 26May 26Jun 26

Infostealers VS Data Breaches

Live stealer logs VS data breaches

Infostealer logs
Events4,176
Share9%
Data breaches
Events41,479
Share91%
Infostealer logs (9%)
4,176events
Data breaches (91%)
41,479events

166 compromised employee accounts pose an infrastructure risk, while 45,489 leaked client credentials create regulatory liability.

Antivirus Distribution

Security Tools on Infected Endpoints

Windows Defender188
Kaspersky7
None3
Windows Defender.2
360 Total Security1

Malware Families Distribution

Distribution of Active Stealer Strains

Redline885
Rhadamanthys472
LummaC2454
Vidar375
Acreed239
RisePro54
DarkCrystal25
Remus24
StealC20

Top Login URLs

Top exposed services found in the event results

  1. 1https://my.prom.ua/cabinet/sign-in5,208
  2. 2my.prom.ua/cabinet/sign-in4,117
  3. 3https://my.prom.ua3,825
  4. 4my.prom.ua3,519
  5. 5prom.ua2,220
  6. 6https://prom.ua2,197
  7. 7android://hq1Hd3m2lmIRjdFUbaa9aoOHI7F8mYFJGI6IoBV7MDp2DGNQUlE8IM5NiuS520-bhk75c_py4mGNjR3hynhCrg==@ua.prom.b2c/1,550
  8. 8prom.ua/join-now953
  9. 9https://prom.ua/join-now886
  10. 10https://zakupki.prom.ua/signin742

Infostealer By Geography

Shows the distribution of Infostealer-related credential exposure events across different geographic regions. The location is determined by analyzing the metadata of the infected machines associated with each event.

Ukraine
Events1,322
United Kingdom
Events320
Germany
Events193
Poland
Events164
Estonia
Events95
Czechia
Events84
United States
Events62

Country Breakdown

  1. 1Ukraine1,322
  2. 2United Kingdom320
  3. 3Germany193
  4. 4Poland164
  5. 5Estonia95
  6. 6Czechia84
  7. 7United States62
  8. 8Moldova56

Services Classification Distribution

Blast radius - closer to core = more critical infrastructure, size = credential volume

-
Total

Operating System Distribution

Distribution of compromised endpoint builds

Windows 10 Enterprise x64413
Windows 11235
Windows 10 22H2 build 19045 (64 Bit)177
Windows 11 23H2 build 22631 (64 Bit)155
Windows 11 24H2 build 26100 (64 Bit)154

Leak Repository Classification

Where the exposed records currently reside

0
Named breaches
41,454
Combolist pools
25
Unattributed dumps

Disclaimer: This report includes AI-generated content. AI can make mistakes, so verify important findings independently before taking action.