Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Enjoying ransomware.live? Help us keep tracking ransomware gangs and shipping new features. Support us
Logo

ar500armor.com

ar500armor.com
Group Settra
Discovered 2026-11-06 16:48 UTC
Est. attack date 2026-09-29
Country US
Sector
Agriculture and Food Production Education Energy & Utilities Financial Services Government & Defense Healthcare Hospitality Manufacturing Other Professional Services Retail & E-Commerce Technology Transportation
Data exfiltrated 174GB

Description:

Phoenix, Arizona. The company sells body armor to police officers, firefighters, military personnel, and ordinary civilians — under the trade name AR500 Armor, the legal entity Armored Republic LLC, and the holding company Armored Republic Holdings. Its website carries a lofty slogan about "protecting lives"; its catalog features Level IV plates sold to federal agencies; its client list includes the Drug Enforcement Administration (DEA), the Department of Homeland Security, the United States Secret Service, and the United Nations.
Infostealer activity detected by HudsonRock

Compromised Employees: 0

Compromised Users: 251

Third Party Employee Credentials: 0

External Attack Surface: 38

Infostealer Distribution
Exposure Report
by ParanoidLab
945
Passwords
6 critical
784
Cookies
0 critical
Last queried 2026-11-06 16:48 UTC

DNS Records:

The following DNS records were found for the victim's domain.

WHOIS Emails
  • abusegodaddy.com
MX Records
  • ar500armor-com.mail.protection.outlook.com. Microsoft 365
TXT Records
  • google-site-verification=KpPhgrdLvUHOXPQ8hAKZUEEizNOY5UQGZEDiQ_l5_vA
  • google-site-verification=OdyDhmzRmX5VktK2klJT_Dl30MdTuwdhQ_sxr35tRyc
  • google-site-verification=Tji81cMIsMUFbF0Ud2f133bKgco1TsXjdcIV6TRDZGs
  • google-site-verification=V_adBkQ7uB2fV_UwfV_gzSCk8uDFFRieyCSnx9XPWqQ
  • google-site-verification=wWhM5xqLyzWyWYI7LTmmsG2T-P7ON21BNJ88x4a34EI
  • v=spf1 +a +mx +ip4:98.181.88.222 +ip4:192.240.173.186 +ip4:192.240.173.187 +ip4:192.240.172.76 +ip4:192.240.172.254 +ip4:192.240.173.220 +ip4:192.240.173.221 include:_spf.google.com include:spf.protection.outlook.com ~all
  • _globalsign-domain-verification=pLq6Q93EaxEzGAoSnFa5pt4FlZcp5bMc2GPZpEty96
  • atomic-domain-553e508e695b0feac2c53a71faf80bcdd0addae99c8e5c84700c7802f0b2074a
  • facebook-domain-verification=ieewwk08dzfbp0gn1w1q7l0kg9xcff
  • globalsign-domain-verification=RRs_ycFJS13Mpo9TpimxLLEZ-drfq0un0RQwCaRJVK
  • google-site-verification=E0bsgM_OHHUCyHb9eOGhstcHdFAvw4UTEzxGcRQzMfA
Cloud / SaaS Services Detected
Global Sign

Leak Screenshot:

Leak Screenshot

Other recent victims

Same group: Settra
Same sector: Government & Defense
Same country: United States

Legal Disclaimer: Ransomware.live does not engage in the acquisition, exfiltration, downloading, possession, hosting, access, consultation, redistribution, or disclosure of unlawfully obtained data. This platform indexes only publicly visible information posted by ransomware operators and open web sources without accessing or obtaining the underlying stolen content. The service is provided to support public awareness, legitimate research, and cyber-resilience. No stolen personal or confidential data is collected or distributed via this site.