In plain words
Registration records, hosting details and shared infrastructure can link one attack to others. The answer is often uncertain.
Why it matters to a firm
We do not attribute. We never say who owns a look-alike or what it is for. What a firm needs first is to know the opening exists and to close it.
The check behind the finding
whois yourfirm-ca.comA registration lookup shows when a domain was created and by which registrar, even when the owner is hidden.