During a domain abuse investigation involving a suspected phishing website, one of the details that stood out was the presence of a business registration number displayed on the website.

At first glance, the website appeared to represent a legitimate organization and used branding elements intended to build trust with visitors. It also requested sensitive information from users, making it important to assess the credibility of the claims being made on the site.

Initial Observation

While reviewing the website, I noticed a business registration number was prominently displayed. Registration identifiers are often included to make a website appear legitimate, so I treated it as a potential verification point rather than accepting it at face value.

Verification

To validate the information, I cross-referenced the registration number against publicly available business records.

The lookup confirmed that the registration number was valid and belonged to a real company. However, the details associated with the registration did not support the website's claims.

Rather than strengthening the website's legitimacy, the verification raised additional concerns. The registration appeared to belong to a legitimate business that had no apparent connection to the domain under investigation.

Assessment

This finding was significant because the registration number itself was genuine.

In many investigations, the expectation is to find fabricated information. In this case, the issue was different: a legitimate business identifier appeared to be reused in a context that did not align with the actual company.

When considered alongside other indicators, including brand impersonation and requests for sensitive information, the discrepancy provided additional evidence supporting the phishing assessment.

Takeaway

One lesson from this investigation I learnt that verification should not stop once an identifier is confirmed as valid.

A registration number can be genuine while still being misused.

Business registration records can serve as a valuable verification point during investigations, not only for identifying fabricated information but also for detecting instances where legitimate identifiers are being used to create a false sense of trust.

Sometimes the question is not whether an identifier exists, but whether it actually belongs in the context where it is being presented.