Open-source intelligence and attribution

• You have acquired another business or taken on responsibility for unfamiliar brands and domains.
• Someone has reported a lookalike domain or an account using your identity.
• You need an intelligence baseline before commissioning a red-team exercise.

Agree the organisation, brands, domains, business units and relevant suppliers to examine. Define whether authorised business roles or public-facing contacts belong in scope. Focus on public evidence and the business decision the client needs to make.

• Identify public-facing assets, exposed material and relationships that can be linked to the agreed organisation.
• Review signs of domain or brand misuse and supply-chain exposure.
• Corroborate associations using independent source records where available. Separate confirmed observations, inferred links and unverified leads.

Illustrative finding

Example scenario: a domain resembles your brand and points to a provider used by a supplier. Those facts warrant investigation, but do not identify the operator. The report records the evidence and confidence, asks the brand owner to check its inventory, and sets out the next verification step.

• Known domains, brand variants, subsidiaries and a named owner for each confirmed asset.
• The question to resolve, relevant time period and any lawful exclusions concerning people or third parties.
• An escalation contact for suspected impersonation or material exposure.

Agreed boundaries

Attribution describes a supported association, not a guarantee of ownership or proof of who carried out an attack. Public visibility can change, and absence from the reviewed sources does not prove absence of exposure. No login attempts, personal pretext contact or active exploitation are included without separate authority.

Receive a dated evidence register with source, observation, likely owner, confidence and reasons for uncertainty. The debrief prioritises ownership checks, takedown decisions or separately authorised testing and assigns each to the appropriate team.

Follow-up

Agree a later review of named indicators or new public evidence when ownership or exposure changes.