Protective intelligence
ObscureIQ / Intelligence deskIndependent analysis. Protective judgment.
← Back to the libraryRecord / CB-053
Command Brief / CB-053

Domain Attribution Has Structurally Broken

Why a Shared Registrar Proves Nothing

The intelligence

Domain investigators have long treated a shared registrar as a sign that two domains are related, and different registrars as a sign they are not. This brief tests that habit against the registrar market's public structure, including multi-brand owners, reseller platforms and a September 2026 report of mass shell accreditations, and asks what should anchor attribution instead. Built from company disclosures, trade reporting and the firm's ownership review. For principals and security teams reading reports that link domains to people.

Open access

Read the complete brief.

This publication is freely available.

Read the brief

How it happens

Primary · Mechanism · Identify and link

False match

A person or household is wrongly identified because records agree with each other rather than with reality, and action follows.

More on identify and link →
  • Defender failureAttribution error. Activity is attributed to an organization, network or actor on weak structural signals.
  • Mechanism · Acquire and collectCustody transfer. Data and the systems holding it pass to a new controller through acquisition, merger, consolidation or bankruptcy, without the product or interface changing.

Topics

Domain & DNSOSINTMisidentification
Follow the thread

Cross-referenced intelligence.

CB-053-Asubscription
Annex

The Domain Intelligence Ownership Map

An unfamiliar registrar, privacy proxy or name-server string in a WHOIS record raises a quick question: who stands behind it? This annex to CB-053 is the lookup map, grouping brands from across the registration and lookup chain by ultimate parent, with each brand's role and ownership form, drawn from the firm's early 2026 landscape review. For analysts and investigators who need to know the corporate group behind a brand before drawing any inference from it.

Beneficial OwnershipPublic RecordsNetwork Anonymity

How it happensFalse match

View record
CB-052public
Command Brief

The Vendor Map Is Not the Control Map

Your Domain Vendors Have New Owners

Between late 2024 and the end of 2025, Mastercard's purchase of Recorded Future, Permira's take-private of Squarespace, CVC's agreed Namecheap stake and the Markmonitor sale moved key domain-security services to new owners. This brief asks what a change of ownership alters for the organizations that rely on those services, even when the product itself looks unchanged. Built from deal announcements, vendor policies, researcher disclosures and trade reporting. For family offices and security teams reviewing registrar, brand-protection and threat-intelligence vendors.

Domain & DNSHosting & InfrastructureThreat Modeling

How it happensCustody transfer

View record
CB-054public
Command Brief

The Warning Arrives Before the Proof

A Warning Is Not a Verdict

Vendors now sell warnings about domains, hosting and certificates not yet used against anyone, a category Gartner forecast in September 2025 to claim a far larger share of security budgets. This brief asks how much weight such a warning can bear, and what it can justify a protective program doing. Built from MITRE ATT&CK, academic measurement of phishing domains and predictive scoring, registry data and NSA and CISA guidance. For security leads deciding what a pre-attack alert should trigger.

Domain & DNSMonitoring & AlertingMisidentification

How it happensAttribution error

View record
CB-246subscription
Command Brief

The validation gate: stopping a wrong identification

The File Agrees With Itself

Screening reports that name people now reach principals with model help in their assembly, and a 2026 police audit of plate-reader alerts renewed scrutiny of wrong identifications. This brief asks what must happen before an identification in such a report is acted on, and who should own that step. Built from the firm's corpus of documented misidentification cases, human-factors research and review of commercial deliverables. For family offices commissioning vetting or monitoring work.

MisidentificationOSINTThreat Doctrine

How it happensFalse match

View record