Back

rt.com Domain Breach Exposure Report

Risk Score

High Risk

Massive event volume or critical assets compromised.

AI Findings Summary

Critical

The telemetry indicates a significant exposure event impacting rt.com, with a risk score of 100. The primary concern stems from 33,255 historical data breaches, representing 96.7% of the total events, and 1,123 active infostealer logs, accounting for 3.3%. These events are spread across the period from July 2025 to June 2026, with notable spikes in client-related events in August 2025 and March-April 2026, and employee-related events in September 2025 and February 2026. The data suggests a broad impact, with a high volume of client-related breaches and a substantial number of employee-related events, indicating potential compromise of both customer and internal data. The presence of infostealer malware families like Redline, LummaC2, and Acreed further heightens the risk of credential harvesting and sensitive data exfiltration.

Total Events

34,378
credential exposure events

Employee Affected Events

1,955
account email domain = rt.com

Client Affected Events

32,423
service target = rt.com

Free Community Account

Stop stolen credentials from logging in

Own this domain? Create a free Lunar account to see full exposure data and evidence.

12-Month Events Timeline

Event volume by breach date, employee VS client

EmployeesClients
10,0006,6673,3330
peak month 8,595
Jul 25Sep 25Nov 25Jan 26Mar 26May 26Jun 26

Infostealers VS Data Breaches

Live stealer logs VS data breaches

Infostealer logs
Events1,123
Share3%
Data breaches
Events33,255
Share97%
Infostealer logs (3%)
1,123events
Data breaches (97%)
33,255events

1,955 compromised employee accounts pose an infrastructure risk, while 32,423 leaked client credentials create regulatory liability.

Antivirus Distribution

Security Tools on Infected Endpoints

Windows Defender2

Malware Families Distribution

Distribution of Active Stealer Strains

Redline190
LummaC2177
Acreed104
Rhadamanthys96
Vidar80
RisePro17
StealC16
Millenium16
Remus10

Top Login URLs

Top exposed services found in the event results

  1. 1rt.com7,419
  2. 2https://rt.com3,397
  3. 3rt.com/payment/multipay/go/login1,383
  4. 4rt.com/login981
  5. 5learnrussian.rt.com812
  6. 6https://learnrussian.rt.com802
  7. 7rt.com/765
  8. 8https://learnrussian.rt.com/760
  9. 9rt.com/join631
  10. 10learnrussian.rt.com/601

Infostealer By Geography

Shows the distribution of Infostealer-related credential exposure events across different geographic regions. The location is determined by analyzing the metadata of the infected machines associated with each event.

India
Events137
Malaysia
Events94
United States
Events43
Egypt
Events38
Venezuela
Events38
Brazil
Events24
Colombia
Events23
Germany
Events23

Country Breakdown

  1. 1India137
  2. 2Malaysia94
  3. 3United States43
  4. 4Egypt38
  5. 5Venezuela38
  6. 6Brazil24
  7. 7Colombia23
  8. 8Germany23

Services Classification Distribution

Blast radius - closer to core = more critical infrastructure, size = credential volume

WordPress240
Microsoft3

Operating System Distribution

Distribution of compromised endpoint builds

Windows 11122
Windows 10 Enterprise x6480
Windows 11 Home Single Language 25H2 (Build 26200)53
Windows 10 Pro53
Windows 11 (Build 26200) (64 Bit)53

Leak Repository Classification

Where the exposed records currently reside

0
Named breaches
32,491
Combolist pools
764
Unattributed dumps

Disclaimer: This report includes AI-generated content. AI can make mistakes, so verify important findings independently before taking action.