ShadowMap

Dark Web Exposure for login.php

Credentials, devices and data found in dark web stealer logs & breaches
86
Exposure level: Critical
login.php scores 86/100 based on leaked credentials, compromised devices, and stolen financial & session data found on the dark web.
Most recent exposure 2 days ago Last 90 days -68% 6% reuse a top-10 password
Employee exposure
corporate accounts — @login.php
470,380
leaked credentials · 1,197 compromised devices
Top exposed employee accounts
wp-login.php1,910
(www.facebook.com/login.php)605
2679/login.php216
login.php182
25500/login.php149
Where staff accounts were caught
https227,045
http47,797
c22,820
www.facebook.com6,718
facebook.com2,909
Customer exposure
stolen logins for login.php
33,522
leaked credentials · 685 compromised devices
Top exposed customer accounts
admin373
freebox250
andreas.clints***@gmail.com37
jsengineering37
barry.thompson5***@my.riohondo.edu36
Most targeted services
facebook.com.login.php915
siambi.login.php234
m.facebook.com.login.php125
evybuy.com.login.php94
extremeshare.org.tracker.login.php93
503,902
Exposed Credentials
1,244
Compromised Devices
0
Credit Cards
22
Crypto Wallets
134
Auth Tokens
181,999
Stolen Cookies

Exposure over time (credentials leaked per month)

2024-012026-07

Corporate SaaS & shadow-IT exposed (employee logins to third-party services)

Google821
Google Workspace305

Most common passwords 6% reuse a top-10 password

(h***ps12,279
ad***in5,072
(h***tp3,576
12***562,497
12***45724
12***78636
N1***Im572
UU***0R572
****497
LO***AD493

Stolen sessions (active cookies that can bypass MFA)

youtube.com7,503
google.com4,054
pubmatic.com2,785
tiktok.com2,458
adnxs.com1,781
go.sonobi.com1,508

Financial, crypto & app tokens

Crypto wallets
metamask22
App / session tokens
Google132
Telegram2

Browsers & apps affected

Chrome [Profile 19]11
Browser/Logins/Chrome_Profile 10[e78c8dcb].txt7
Browser/Logins/Chrome_Default[6b08e69e].txt5
Facebook5
android:authenticator.azure4
android:ticket.ps3

Stealer malware families seen

RedLine

Related companies

Explore

Check your own exposure →

Free dark web & attack-surface check by ShadowMap

Figures are aggregate counts derived from dark web stealer logs and public breach data. Data is indicative and updated periodically.