Protective intelligence
ObscureIQ / Intelligence deskIndependent analysis. Protective judgment.
← Back to the libraryRecord / CB-052
Command Brief / CB-052

The Vendor Map Is Not the Control Map

Your Domain Vendors Have New Owners

The intelligence

Between late 2024 and the end of 2025, Mastercard's purchase of Recorded Future, Permira's take-private of Squarespace, CVC's agreed Namecheap stake and the Markmonitor sale moved key domain-security services to new owners. This brief asks what a change of ownership alters for the organizations that rely on those services, even when the product itself looks unchanged. Built from deal announcements, vendor policies, researcher disclosures and trade reporting. For family offices and security teams reviewing registrar, brand-protection and threat-intelligence vendors.

Open access

Read the complete brief.

This publication is freely available.

Read the brief

How it happens

Primary · Mechanism · Acquire and collect

Custody transfer

Data and the systems holding it pass to a new controller through acquisition, merger, consolidation or bankruptcy, without the product or interface changing.

More on acquire and collect →
  • Mechanism · Breach and custodyVendor-chain breach. Data escapes through a vendor, fulfillment provider or institution the person relies on but does not control.

Topics

Domain & DNSHosting & InfrastructureThreat Modeling

Entities

Recorded FutureMastercard
Follow the thread

Cross-referenced intelligence.

CB-052-Apublic
Annex

The Wider Ownership Map

Public deal reporting from 2024 to 2026, including Visa's August 2026 agreement to acquire BioCatch, moved many familiar security, DNS and fraud-intelligence products under new owners. This annex to CB-052 gathers those ownership changes beyond the domain layer where the parent keeps its argument, so a family office or operating business can check its own vendor list against who holds each product now. For anyone preparing a vendor review or contract renewal.

Beneficial OwnershipHousehold & StaffPhone Numbers & SIM

How it happensCustody transfer

View record
CB-053public
Command Brief

Domain Attribution Has Structurally Broken

Why a Shared Registrar Proves Nothing

Domain investigators have long treated a shared registrar as a sign that two domains are related, and different registrars as a sign they are not. This brief tests that habit against the registrar market's public structure, including multi-brand owners, reseller platforms and a September 2026 report of mass shell accreditations, and asks what should anchor attribution instead. Built from company disclosures, trade reporting and the firm's ownership review. For principals and security teams reading reports that link domains to people.

Domain & DNSOSINTMisidentification

How it happensFalse match

View record
CB-054public
Command Brief

The Warning Arrives Before the Proof

A Warning Is Not a Verdict

Vendors now sell warnings about domains, hosting and certificates not yet used against anyone, a category Gartner forecast in September 2025 to claim a far larger share of security budgets. This brief asks how much weight such a warning can bear, and what it can justify a protective program doing. Built from MITRE ATT&CK, academic measurement of phishing domains and predictive scoring, registry data and NSA and CISA guidance. For security leads deciding what a pre-attack alert should trigger.

Domain & DNSMonitoring & AlertingMisidentification

How it happensAttribution error

View record