Infrastructure attribution is usually an accumulation problem. A single IP address, registrar, privacy service, or hosting provider rarely proves who controls an asset. More persuasive analysis combines multiple independent relationships and asks whether the observed pattern is better explained by common management than by ordinary Internet infrastructure reuse.
Useful evidence can include historical DNS, domain registration and timing, nameservers, hosting, MX and mail infrastructure, redirects, analytics identifiers, repeated templates or source code, registrant-email reuse, address and phone artifacts, and public corporate or regulatory records. Analysts should distinguish evidence that links infrastructure from evidence that identifies a human actor; those are different attribution claims with different confidence requirements.
A domain can also function as an email-based assertion of authority on a separate platform, even when it has no active website. In a 2026 WIPO matter concerning an Electrolux lookalike domain, MX records supported email activity associated with unauthorized Brand Owner accounts on the Shopee Brand IP Portal. The panel found that domain-based email addresses had been used to establish such accounts and, at minimum, approve appeals involving listings the complainant had reported as infringing. Although the respondent disputed ownership or operation of separate seller storefronts, the panel distinguished the domain's abusive use from proof identifying an individual seller-account operator: “The question for the Panel is not the identity of the natural person who operated the Shopee retail accounts”, but whether registration and use of the domain itself were in bad faith. WIPO Case No. D2026-3482 (Oct. 2026). The transfer ruling did not resolve who personally controlled those retail storefronts or establish that every alleged counterfeit sale or forged document was attributable to the respondent.
For an investigation, the distinction matters. Domain registration, configured mail routing and messages may support a domain-use or account-impersonation conclusion; a finding that a particular person controlled independent marketplace accounts may require separate evidence. Subject to lawful access, useful follow-on records may include original message headers, actual platform role assignments, brand-authorization history, approved appeals, changes to linked email addresses, login and audit records, contemporaneous communications, and verified registrant information. Preserve the exact boundary between what each record establishes and what remains unresolved.
For common-control analysis, Jonathan's published work provides a separate illustration. In a 2016 dispute involving F. Hoffmann-La Roche AG, common contact details, pharmacy-site patterns, and continuity with earlier proceedings supported a finding of common control across 11 adjudicated domains, resulting in nine transfers and two cancellations. F. Hoffmann-La Roche AG, WIPO D2016-0517 (2016). This illustrates domain-network linkage; it should not be conflated with evidence proving who operated a third-party platform account.
Sources: MITRE ATT&CK — Resource Development
AI can make mistakes.
