Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Enjoying ransomware.live? Help us keep tracking ransomware gangs and shipping new features. Support us

Discovered 2026-09-26 08:45 UTC
Est. attack date 2026-09-21
Country US
Sector
Agriculture and Food Production Education Energy & Utilities Financial Services Government & Defense Healthcare Hospitality Manufacturing Other Professional Services Retail & E-Commerce Technology Transportation

Description:

puroclean.com purocleanfranchise.com PuroClean is North America's largest privately owned property damage restoration franchise, known as "The Paramedics of Property Damage®", with 500+ franchise locations across the U.S., Canada, and Puerto Rico, headquartered in Tamarac, Florida. It provides 24/7 emergency services — water damage mitigation, fire and smoke restoration, mold remediation, biohazard cleanup, and reconstruction — responding within two hours, and is a preferred provider for 3 of the top 5 U.S. insurance carriers. The brand was launched in 2001 under the legal entity PuroSystems, LLC; in 2015 it was acquired by Mark W. Davis (former co-founder/CEO of Belfor North America) and Frank Torre, who grew the network from 222 to 500+ locations. The franchisor's audited revenue is $31.8 million (FY2025), while system-wide franchise sales exceed $400 million, with an average franchise unit generating ~$942K per year.

Infostealer activity detected by HudsonRock

Compromised Employees: 0

Compromised Users: 5

Third Party Employee Credentials: 22


External Attack Surface: 4


Exposure Report
by ParanoidLab
2579
Passwords
210 critical
62
Cookies
0 critical
Last queried 2026-09-26 08:45 UTC

DNS Records:

The following DNS records were found for the victim's domain.

WHOIS Emails
  • abusegodaddy.com
MX Records
  • puroclean-com.mail.protection.outlook.com. Microsoft 365
TXT Records
  • sending_domain1028901=413bb4a1b908f1495734ce038f52ff92b664bb786d998670830d7518d48efc22
  • v=spf1 ip4:64.135.38.128/26 ip4:40.88.18.65/32 ip4:207.200.190.208 ip4:152.160.0.0/16 ip4:23.251.253.0/26 ip4:38.153.9.0/24 ip4:38.152.248.0/26 ip4:212.47.85.0/24 a:puromail.com a:puroclean.ca include:spf.protection.outlook.com include:servers.mcsv.net in" "clu" "de:sendgrid.net include:one.zoho.com ~all
  • google-site-verification=1NxrfuTlr1m8kRT10p0LJJNvTNilgZwLwyKdqgViOQE
  • google-site-verification=tzRa0caqBsM8xhtPVuF6boqd6gS6wvbcNwJfnb3hXD0
  • include:u4471691.wl192.sendgrid.net ~all
  • klaviyo-site-verification=ULqBGY
  • openai-domain-verification=dv-UL8nLW87IT7yenhs11R2yS3V
Cloud / SaaS Services Detected
Mailchimp OpenIA SendGrid