Est. nowhere, 2026
Gear for the trail. Lessons for the test.
Wrexby Outfitters is a fictional 180-person outdoor equipment retailer. It exists so that readers of the Atarus Offensive Security books have one company to assess, chapter after chapter, without touching anyone real.
This is not a real business. Nothing is for sale here, no one works here, and no email from this domain is genuine.
What Wrexby is
The company on paper
A web shop, a warehouse, an AWS account, a Microsoft Entra tenant with a legacy Active Directory domain, a CI pipeline and a support assistant built on a language model. Every lab in the series builds one more piece of it on the reader's own machine.
The company on the wire
This domain is the only part of Wrexby that is public. It is here so that the reconnaissance chapters have a real registration, real DNS and a real certificate to look up, with the owner's permission written into the book.
Who owns it
Atarus Offensive Security LLC registered wrexby.com on 31 October 2026 and runs it for the book series. Questions about the domain go through atarussecurity.com.
The books
Wrexby is the running example in every volume of the series, from the foundations volume that takes a reader from zero to a working lab, through the phase volumes on cloud, network, web and identity testing. Each chapter opens with a situation at Wrexby and ends with a lab that works first time or fails with the fix on screen.
Ground rules for readers
- Passive only, out here. Look up the registration, the DNS records, the certificate and this page as the chapters direct. Do not scan, probe or attack this host. It is a static page on a shared platform, and the platform is not in scope.
- Everything active runs in your lab. Hostnames such as
wrexby-ws01orshop.wrexby.labin the books resolve inside your own lab network, never on the public internet. - No mail, ever. This domain publishes a null MX record, a reject-all SPF policy and a reject DMARC policy. Any message claiming to come from an address at wrexby.com is forged.
- Found something real? Report it through the contact in security.txt.