Plain writing on the work.

Threat Intel Isn't Forensic Proof: Investigating Lookalike-Domain Payment Fraud

Threat-intelligence lookups can point an investigation in a direction. Without logs and mailbox evidence from every party, they cannot attribute fault.