t.co Domain Breach Exposure Report

The domain t.co has a high risk score of 86, primarily driven by a significant volume of historical data breaches (4799 events) and active infostealer logs (93 events) observed between July 2025 and June 2026. The data breaches are predominantly linked to "Combolist sources" (97.9%), suggesting compromised credential lists, while infostealer activity shows prevalence of Redline, Rhadamanthys, and LummaC2 malware families. The exposure affects a large number of clients (4570) and employees (322), with notable spikes in client exposure during August 2025 and March-April 2026, and employee exposure in February-April 2026. Targeted services include login and registration endpoints, indicating potential credential stuffing or account takeover attempts. Given the high volume of data breaches and the presence of active infostealer logs, this exposure presents a critical risk. The prevalence of compromised credentials from "Combolist sources" and the targeting of login services suggest a high likelihood of account compromise for both employees and clients. Prioritization should focus on immediate credential rotation for all affected users, enhanced monitoring for suspicious login activity, and a review of access controls for services associated with t.co. The observed malware families are commonly used for credential harvesting, further underscoring the need for endpoint security and user awareness training.