Back

wbd.com Domain Breach Exposure Report

Risk Score

High Risk

Massive event volume or critical assets compromised.

AI Findings Summary

Critical

The domain wbd.com exhibits a high-risk score of 98, primarily driven by a significant volume of historical data breaches (3560 events) and active infostealer logs (1785 events) over the past year. The data indicates a substantial exposure of both employee and client information, with a notable increase in these events observed in March and April 2026. Malware families such as Rhadamanthys, LummaC2, and Acreed are frequently detected, suggesting ongoing compromise attempts. The targeted services include various login portals and an Android application, indicating a broad attack surface. The leak repository classification points to combolist sources and database dumps as primary origins of exposed data, with Brazil, the United States, and Mexico showing the highest incidence of affected users. Given the critical risk score and the prevalence of data breaches and infostealer activity, immediate attention is required to investigate the root causes of these exposures. Prioritization should focus on securing authentication mechanisms for login portals and the associated Android application, enhancing endpoint security to detect and mitigate infostealer malware, and reviewing data handling practices to prevent future data dumps. The timeline shows a sharp increase in employee and client-related events in early 2026, necessitating an urgent review of security controls implemented around that period.

Total Events

5,345
credential exposure events

Employee Affected Events

1,572
account email domain = wbd.com

Client Affected Events

3,773
service target = wbd.com

Free Community Account

Stop stolen credentials from logging in

Own this domain? Create a free Lunar account to see full exposure data and evidence.

12-Month Events Timeline

Event volume by breach date, employee VS client

EmployeesClients
1,0006673330
peak month 897
Jul 25Sep 25Nov 25Jan 26Mar 26May 26Jun 26

Infostealers VS Data Breaches

Live stealer logs VS data breaches

Infostealer logs
Events1,785
Share33%
Data breaches
Events3,560
Share67%
Infostealer logs (33%)
1,785events
Data breaches (67%)
3,560events

1,572 compromised employee accounts pose an infrastructure risk, while 3,773 leaked client credentials create regulatory liability.

Antivirus Distribution

Security Tools on Infected Endpoints

Windows Defender38
Bitdefender4
Windows Defender.3

Malware Families Distribution

Distribution of Active Stealer Strains

Rhadamanthys320
LummaC2271
Acreed179
Vidar146
Redline81
Remus53
Millenium22
StealC13
Blank Grabber7

Top Login URLs

Top exposed services found in the event results

  1. 1android://Ex5R3Ln5inTEQdP1XFXQJIMsrPnNi-JD22boV5LdVRowZ-8e49jZENgAuSHdKZ9Ko6YC68DrdPEUn04zn1REaA==@com.wbd.stream/1,515
  2. 2https://login.wbd.com/default.aspx287
  3. 3login.wbd.com/default.aspx206
  4. 4https://login.wbd.com150
  5. 5login.wbd.com140
  6. 6android://Ex5R3Ln5inTEQdP1XFXQJIMsrPnNi-JD22boV5LdVRowZ-8e49jZENgAuSHdKZ9Ko6C68DrdPEUn04zn1REaA==@com.wbd.stream/132
  7. 7android://ex5r3ln5inteqdp1xfxqjimsrpnni-jd22bov5ldvrowz-8e49jzengaushdkz9ko6yc68drdpeun04zn1reaa==@com.wbd.stream/ :73
  8. 8https://sso.wbd.com/login/login.htm70
  9. 9android://ex5r3ln5inteqdp1xfxqjimsrpnni-jd22bov5ldvrowz-8e49jzengaushdkz9ko6yc68drdpeun04zn1reaa==@com.wbd.stream/68
  10. 10android://zQxb6hXv1MJiC1Yyotdhi8HP-y7fwPcOLwPOWTwWKpP2VXcbsuIiI4iJ1KV0Dz3LzVsUuKJmACRSUAxnsPB3FA==@com.wbd.stream/67

Infostealer By Geography

Shows the distribution of Infostealer-related credential exposure events across different geographic regions. The location is determined by analyzing the metadata of the infected machines associated with each event.

Brazil
Events208
United States
Events104
Mexico
Events103
Argentina
Events72
Colombia
Events56
Spain
Events52
Chile
Events44
Peru
Events40

Country Breakdown

  1. 1Brazil208
  2. 2United States104
  3. 3Mexico103
  4. 4Argentina72
  5. 5Colombia56
  6. 6Spain52
  7. 7Chile44
  8. 8Peru40

Services Classification Distribution

Blast radius - closer to core = more critical infrastructure, size = credential volume

Okta58
Microsoft13

Operating System Distribution

Distribution of compromised endpoint builds

Windows 11178
Windows 11 24H2 build 26100 (64 Bit)147
Windows 10 22H2 build 19045 (64 Bit)61
Windows 1057
Windows 11 Pro54

Leak Repository Classification

Where the exposed records currently reside

0
Named breaches
2,748
Combolist pools
812
Unattributed dumps

Disclaimer: This report includes AI-generated content. AI can make mistakes, so verify important findings independently before taking action.