In plain words
Registration records, hosting details and shared infrastructure can link an attack to others, and sometimes to a real operator.
Why it matters to a firm
Attribution is often uncertain and rarely needed to stop an attack. What a firm needs first is to know the attack exists and to shut the opening it uses.
How anyone can check it
whois lookalike-domain.comA registration lookup shows when a domain was created and by which registrar, even when the owner’s name is hidden.