ShadowMap

Dark Web Exposure for wp-login.php

Credentials, devices and data found in dark web stealer logs & breaches
82
Exposure level: Critical
wp-login.php scores 82/100 based on leaked credentials, compromised devices, and stolen financial & session data found on the dark web.
Most recent exposure 3 days ago Last 90 days -53% 7% reuse a top-10 password
Employee exposure
corporate accounts — @wp-login.php
115,601
leaked credentials · 1,013 compromised devices
Top exposed employee accounts
wp-login.php4,975
theresusroom.co.uk/wp-login.php12
/wp-login.php10
e.feednews.gr/wp-login.php1
wp-login.***@simplenews.gr1
Where staff accounts were caught
https55,789
http19,613
c905
needrom.com198
sammobile.com164
Customer exposure
stolen logins for wp-login.php
9,223
leaked credentials · 603 compromised devices
Top exposed customer accounts
admin830
happy96
116288297979
r_meinhart74
vrilya54
Most targeted services
arbolinternational.org.wp-login.php94
laliane.ro.wp-login.php44
symposiaskull.com.wp-login.php42
atoubipaper.cf.wp-login.php28
ing.com.wp-login.php22
124,822
Exposed Credentials
1,030
Compromised Devices
0
Credit Cards
22
Crypto Wallets
134
Auth Tokens
177,242
Stolen Cookies

Exposure over time (credentials leaked per month)

2024-012026-07

Corporate SaaS & shadow-IT exposed (employee logins to third-party services)

Google Workspace160

Most common passwords 7% reuse a top-10 password

ad***in3,494
(h***ps1,579
(h***tp992
N1***Im572
LO***AD368
12***56278
Ma***3-266
****234
go***om226
****189

Stolen sessions (active cookies that can bypass MFA)

youtube.com6,036
google.com3,739
pubmatic.com2,785
adnxs.com1,781
go.sonobi.com1,508
criteo.com1,478

Financial, crypto & app tokens

Crypto wallets
metamask22
App / session tokens
Google132
Telegram2

Browsers & apps affected

Chrome [Profile 19]11
Browser/Logins/Chrome_Profile 10[e78c8dcb].txt7
Browser/Logins/Chrome_Default[6b08e69e].txt5
Facebook5
android:authenticator.azure3
Edge [Default]2

Stealer malware families seen

RedLine

Related companies

Explore

Check your own exposure →

Free dark web & attack-surface check by ShadowMap

Figures are aggregate counts derived from dark web stealer logs and public breach data. Data is indicative and updated periodically.