Insights

Analytical Assessment

Key judgments, estimative language, competing hypotheses, collection gaps, and forward indicators for Allied Advisors Group, LLC. All confidence assignments follow ODNI ICD 203; ICD estimative language is italicised throughout.

Total Judgments: 7
High Confidence: 3
Moderate Confidence: 4
Low Confidence: 0
Techniques Applied: KAC ACH Premortem Red Hat

§ 01

Estimative Language Spectrum

ODNI ICD 203 · probability of being true

remote <5%

unlikely <20%

possibly 20–55%

roughly even chance ~50%

likely 55–80%

very likely >80%

almost certainly >95%

KJ-01 KJ-02 KJ-03 KJ-04 KJ-05 KJ-06 KJ-07

High Moderate Low Markers are positioned by ICD estimative language, not raw confidence tier

§ 02

Key Judgments

7 judgments · full reasoning + alternatives

KJ-01 High Confidence very likely >80%

Single-tenant WordPress.com footprint; surface is the actual surface

Statement · including alternatives considered

Allied Advisors Group operates a single-domain WordPress.com-hosted web presence with no evidence of shadow infrastructure; the observed attack surface is very likely the actual attack surface rather than a curated public-facing subset.

Analytical reasoning

Four independent subdomain enumeration corpora (Certificate Transparency via certspotter, HackerTarget hostsearch, AnubisDB passive DNS, and Common Crawl) converge on the same answer: the apex alliedadvisorsgroup.com plus www and nothing else. The shared Let's Encrypt certificate 14537423605 bundles the target with 44 unrelated WordPress.com customer domains, which is the expected pattern for Automattic-managed hosting and not an indicator of intentional concealment. Combined with the WordPress.com nameservers and Automattic /24 IP range, the recon evidence is very likely a complete picture of the firm's internet-exposed infrastructure. The competing hypothesis that the firm operates additional private infrastructure (cloud accounts, vendor portals, internal SaaS) is not refuted by recon but produces no exposed surface in passive collection.

KJ-02 High Confidence very likely >80%

Email auth posture is the single highest-impact finding

Statement · including alternatives considered

The combination of dual conflicting SPF records (one with the permissive ?all qualifier) and DMARC p=none makes outbound email impersonation of alliedadvisorsgroup.com very likely operationally exploitable for phishing targeting the firm's insurance-agency clients.

Analytical reasoning

DNS authoritatively returns two SPF records on alliedadvisorsgroup.com: v=spf1 include:servers.mcsv.net ?all and v=spf1 include:spf.protection.outlook.com include:_spf.wpcloud.com -all. RFC 7208 §3.2 requires exactly one; receiving MTAs handle the violation inconsistently — some select the first record (the permissive Mailchimp-include with neutral ?all) and others reject SPF entirely. DMARC is configured at p=none, so even when SPF fails, spoofed mail is delivered rather than quarantined. For a firm whose business is sending policy advice to insurance agencies and financial practices, this is very likely a high-payoff lure: a spoofed message from a trusted Greg/Adrianne/Richard with a renewal-cycle attachment routes around the headline technical control. The vector is operationally available today and requires only commodity infrastructure to exploit.

KJ-03 Moderate Confidence very likely >80%

Domain renewal is unlikely to lapse, but verification is cheap

Statement · including alternatives considered

The domain registration is very likely to renew on schedule based on the four registrar-status locks observed; however, the 62-day-to-expiry window combined with no public secondary contact channel makes a lapse-and-hijack scenario a low-probability high-impact tail risk that warrants operator confirmation before 2026-07-29.

Analytical reasoning

RDAP records four GoDaddy-applied EPP status codes — clientDeleteProhibited, clientRenewProhibited, clientTransferProhibited, clientUpdateProhibited — which indicate the registrant is actively managing the registration and has applied registrar-level locks. Renewal is very likely to proceed routinely. The reason this still appears as a key judgment despite that: the alternative outcome is catastrophic for a firm whose entire identity is the domain (email continuity, NAHU/BAN identity, archived content). If renewal does lapse, a typosquatter or BEC operator would almost certainly register the domain inside the standard 30-day redemption-grace closeout. The mitigation (multi-year renewal, registrar lock confirmation) costs minutes; the downside cost is total.

KJ-04 Moderate Confidence likely 55–80%

Identifiable staff roster from Wayback URL slugs

Statement · including alternatives considered

The first-name URL slugs surfaced in Wayback (greg, adrianne, richard, josh1, sandy, cari2, plus the named NAHU Ascend Award page for Greg) likely represent a current staff roster of fewer than 10 people, with Greg likely a principal or senior advisor; however, Wayback content currency cannot be confirmed without active fetch, so individual identifications are moderate-confidence rather than high.

Analytical reasoning

Wayback CDX returns 200 archived URLs for the domain matchtype query, including personal-profile slugs /greg/, /greg-working-1/, /ascend-award-greg/, /adrianne/, /final-richard/, /josh1/, /sandy/, and /cari2/. Greg's slug pattern (multiple revisions, a named industry award) is consistent with a principal or founder-level role. The roster is likely current — the WordPress.com site shows no signs of major rebrand or staff turnover in archived URLs — but Wayback captures URL existence at point-in-time, not present occupancy. The premortem failure mode here is acquiring last names from external sources (NAHU directories, state insurance department licensing rosters, BAN membership lists) to assemble a full spear-phishing roster, which is very likely achievable for an attacker with public-records access.

KJ-05 Moderate Confidence likely 55–80%

WordPress.com mitigates server-side CMS risk; Divi remains exposed

Statement · including alternatives considered

WordPress.com managed hosting limits the attack surface from CMS vulnerabilities (no operator-side patching exposure) but the Divi theme dependency very likely retains client-side attack surface through theme-level XSS and builder-plugin issues that Automattic does not patch on the customer's behalf.

Analytical reasoning

WordPress.com is a managed hosting product where Automattic owns core WordPress patching and infrastructure security — eliminating the historical wp-admin-credential-stuffing and wp-login.php brute-force vectors that plague self-hosted WordPress. The Divi theme path /wp-content/themes/Divi/includes/builder/feature/dynamic-assets/ visible in Wayback confirms the active theme has a documented CVE history (Elegant Themes Divi has shipped multiple authenticated XSS, stored XSS, and authorization-bypass issues over the last 5 years). The exposure is likely latent rather than active because the marketing website carries no authenticated user surface beyond standard contact forms, so the practical exploitability ceiling is defaced-content or stored-XSS staged against the firm's own visitors.

KJ-06 Moderate Confidence roughly even chance ~50%

Security headers grade reflects platform defaults, not operator action

Statement · including alternatives considered

The Mozilla Observatory C- grade (45/100, 4 of 10 tests failed) is unlikely to represent a directly exploitable weakness in isolation; it likely reflects WordPress.com platform defaults rather than operator misconfiguration and roughly even chance is correctable by the operator without platform-level changes.

Analytical reasoning

Mozilla Observatory scans for HTTP security headers — typically CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy. A C-/45 with 4 failures on a WordPress.com-hosted marketing site is likely the result of platform defaults (WordPress.com applies a baseline header set but does not enforce strict CSP or HSTS preload by default for shared-cert customer domains). The presence of an HSTS preload or strict CSP would harden against the email-spoofing-routed-to-WP-content drive-by chain, but the headline-impact reduction is small compared to the SPF/DMARC fix. There is a roughly even chance the operator can configure these from the WordPress.com admin panel; some headers require a paid plan tier.

KJ-07 High Confidence very likely >80%

Deception check: clean evidence is consistent with small-firm scale

Statement · including alternatives considered

Pre-stage RDAP, DNS, and Certificate Transparency observations are mutually corroborative with no evidence of intentional shaping; the deception check returns negative — the sparse footprint is very likely an honest reflection of a small-firm digital posture rather than a deceptive presentation.

Analytical reasoning

The evidence pattern would warrant deception flagging only if it were suspiciously clean for an entity of this stated scope. Allied Advisors Group's combination of (a) WordPress.com managed hosting consistent with sub-25-employee firms, (b) M365 / Mailchimp email stack consistent with small-business norms, (c) NAHU industry-association membership consistent with the advertised advisory role, and (d) seven partner-firm logos suggesting a small advisory cooperative is internally consistent and matches the surface that a real small firm produces. The premortem failure mode where Allied Advisors Group is a shell for a larger operating entity is not supported by any evidence and would require positive evidence (M&A filings, parent-org references in regulatory data) to elevate above its current very unlikely baseline.

§ 03

ACH — Competing Hypotheses

Analysis of Competing Hypotheses · leading hypothesis retained

ACH Analysis Note

Three hypotheses tested: H1 small-firm-with-incidentally-weak-posture (leading), H2 sophisticated-front-with-hidden-infrastructure (eliminated — four independent enumeration corpora corroborate the apex-only surface, A1-grade), H3 mid-transition-entity-with-unstable-footprint (eliminated — no M&A or rebrand signal in registry data, 9-year stable registration). H1 is supported by every load-bearing high-Admiralty evidence row with no surviving inconsistencies.

Full hypothesis register and diagnostic evidence matrix will be surfaced here in schema v1.1 when analysis.hypotheses[] is promoted to a first-class structured field. Currently embedded in key judgment statements above.

§ 04

Key Assumptions Check

Assumptions whose failure would invalidate judgments

KAC Analysis Note

Surfaced four assumptions worth stress-testing: identity (Allied Advisors Group LLC is the actual operating entity — supported by NAHU affiliation + registrar locks); currency (Wayback staff slugs reflect current staff — moderate-sensitivity, low-confidence); completeness (passive enumeration captured the actual surface — high-sensitivity, but corroborated across four independent corpora returning the same answer); intentionality (the sparse surface is incidental, not deceptive — supported by deception check). The currency assumption is the load-bearing limit on personnel-attribution confidence.

§ 05

Premortem — Failure Modes

Scenarios in which the leading assessment is wrong

Premortem Analysis Note

Identified two plausible failure modes for the leading hypothesis. (1) Staff currency: Wayback could include former staff; mitigated by emphasizing moderate confidence on individual personnel and the operator's ability to cross-check NAHU directories. (2) Hidden parallel infrastructure (e.g., cloud SaaS, vendor portals, internal apps not reachable from the apex domain): this would not appear in passive collection and cannot be ruled out from the current evidence base. Both failure modes are flagged in the relevant key_judgments rather than blocking the report.

§ 06

Collection Gaps & Priorities

Full tool coverage — structural gaps only

Collection gaps are structural limitations that create confidence ceilings on specific key judgments. See key judgment bodies above for gap callouts. Structural gaps — those requiring active engagement, legal process, or privileged access rather than additional tooling — will persist regardless of tool expansion.

Future schema versions (analysis.collection_priorities[]) will surface a ranked collection priority list directly from the analyze skill, enabling operators to queue follow-on tasking from this view.

§ 07

Indicators to Watch

Forward-looking · hypothesis confirmation / falsification

Forward indicators pending schema promotion

Indicators to watch — the specific observable events or data points that would confirm or falsify each key judgment's leading hypothesis — are currently embedded as prose within judgment statements and premortem failure modes above. In schema v1.1, the analyze skill will emit a structured analysis.indicators_to_watch[] array that this section will render as a proper watchlist, linkable to specific judgments and refreshable per-investigation.

Operators should review key judgment statements (§ 02) and the premortem note (§ 05) directly for current forward indicators.