Back

vine.co Domain Breach Exposure Report

Risk Score

High Risk

Massive event volume or critical assets compromised.

AI Findings Summary

Critical

The domain vine.co is associated with a high-risk score of 92, primarily driven by a significant volume of historical data breaches (20,483 events) and active infostealer logs (2,447 events) over the observed period. The data breaches are predominantly sourced from "Combolist sources," suggesting compromised credentials. Infostealer activity is linked to prevalent malware families such as Redline, LummaC2, and Rhadamanthys, targeting Windows operating systems. The timeline indicates a notable increase in client-related events from January 2026 onwards, with a smaller but present number of employee-related events also appearing during this period. Given the high volume of data breaches and active infostealer campaigns, the primary risk is the potential compromise of user accounts and sensitive information, impacting both clients and employees. Remediation efforts should focus on credential hygiene, including mandatory password resets for all users, implementing multi-factor authentication, and enhancing monitoring for suspicious login activity and data exfiltration attempts. Investigating the root cause of the "Combolist sources" for data breaches is critical to prevent future credential stuffing attacks.

Total Events

22,930
credential exposure events

Employee Affected Events

386
account email domain = vine.co

Client Affected Events

22,544
service target = vine.co

Free Community Account

Stop stolen credentials from logging in

Own this domain? Create a free Lunar account to see full exposure data and evidence.

12-Month Events Timeline

Event volume by breach date, employee VS client

EmployeesClients
6,0004,0002,0000
peak month 5,113
Jul 25Sep 25Nov 25Jan 26Mar 26May 26Jun 26

Infostealers VS Data Breaches

Live stealer logs VS data breaches

Infostealer logs
Events2,447
Share11%
Data breaches
Events20,483
Share89%
Infostealer logs (11%)
2,447events
Data breaches (89%)
20,483events

386 compromised employee accounts pose an infrastructure risk, while 22,544 leaked client credentials create regulatory liability.

Antivirus Distribution

Security Tools on Infected Endpoints

Windows Defender16
Windows Defender ESET Security1

Malware Families Distribution

Distribution of Active Stealer Strains

Redline421
LummaC2373
Rhadamanthys317
Acreed250
Vidar108
Millenium47
RisePro41
StealC29
Raccoon15

Top Login URLs

Top exposed services found in the event results

  1. 1https://vine.co/4,526
  2. 2https://vine.co4,233
  3. 3vine.co4,172
  4. 4vine.co/3,859
  5. 5https://vine.co/login732
  6. 6vine.co/login606
  7. 7android://D0eneewQFvzVnCUdBsMb3xjqgrRP-alpemyyOlqXwO2CcB43jyoqdvSH7naE1sH9bBjQgz34eUvmXMMMbfDSIA==@co.vine.android/181
  8. 8http://vine.co/79
  9. 9http://vine.co76
  10. 10https://vine.co/playlists/year449

Infostealer By Geography

Shows the distribution of Infostealer-related credential exposure events across different geographic regions. The location is determined by analyzing the metadata of the infected machines associated with each event.

United States
Events474
Türkiye
Events126
Mexico
Events81
Spain
Events77
Canada
Events69
Egypt
Events46
France
Events44
Brazil
Events41

Country Breakdown

  1. 1United States474
  2. 2Türkiye126
  3. 3Mexico81
  4. 4Spain77
  5. 5Canada69
  6. 6Egypt46
  7. 7France44
  8. 8Brazil41

Services Classification Distribution

Blast radius - closer to core = more critical infrastructure, size = credential volume

-
Total

Operating System Distribution

Distribution of compromised endpoint builds

Windows 11309
Windows 10 Enterprise x64179
Windows 10 22H2 build 19045 (64 Bit)132
Windows 11 24H2 build 26100 (64 Bit)130
Windows 10 Home x64101

Leak Repository Classification

Where the exposed records currently reside

0
Named breaches
20,429
Combolist pools
54
Unattributed dumps

Disclaimer: This report includes AI-generated content. AI can make mistakes, so verify important findings independently before taking action.