[Breaches](/breaches) I Used Enterprise Threat Intelligence Tools to Prove a Website Isn’t Owned by Taylor Swift [Blog](/blog)[Breaches](/breaches)[Resources](/resources)[News](/news) # I Used Enterprise Threat Intelligence Tools to Prove a Website Isn’t Owned by Taylor Swift ##### [Greg Pollock](/team/greg-pollock) Published Oct 23, 2026 ##### Join 27,000+ cybersecurity newsletter subscribers Few achievements in the career of an OSINT cyber researcher would beat discovering one of Taylor Swift’s secret websites before it was announced. Yes, these techniques can be used to trace international crime rings and state-sponsored disinformation campaigns, but they could also be used to figure out the name of Taylor’s next album. When one of my colleagues tipped me off a month ago that a domain redirecting to taylorswift.com might be an Easter egg hinting at an upcoming release, I had to investigate. The domain in question was doublecrossed.net. You don’t need to be a cybersecurity expert to know that would be a pretty cool name for just about anything.  The most obvious explanation for the redirect was benign: some random person owned the domain and thought it would be fun to point it at Taylor Swift’s site. Given that there are more people who like Taylor Swift than there are websites secretly owned by her–I would guess millions more–this seemed like the most likely case.  But what if it wasn’t? This was what we train for. **Web Archive** My first move was to understand the history of the domain. Had there ever been a live site at the address, and did it provide any clues about its owner? The Wayback Machine from[ Archive.org](http://archive.org) is an invaluable resource for making this kind of historical data free and accessible, and through it I could learn a great deal about the domain’s past. For starters, the web archive provided a rough date for when the redirect was added. By March 2024, the domain redirected to taylorswift.com. Before that, from [2021 until early 2024](https://web.archive.org/web/20230113185757/https://doublecrossed.net/), doublecrossed.net did not redirect. It hosted the shop for a streetwear brand.  I would describe the aesthetic as somewhere between nihilistic and Satanic. In their own words, it was “clothing from hell.” My confidence was high that this was not run by Taylor Swift. With the archive’s record of the page content and the timing of the redirect, I now had a clearer theory of what happened: before Taylor Swift’s team acquired the domain, it had a different owner. I’d need to find evidence of a change in ownership to back up that narrative. The archived site provided one more nugget of information that supported this theory. When the shop shut down, its owners advertised that they could be found at a new domain, doublecrossed.co. This suggested that the business wasn’t closing, but for some reason they wanted to move to a new address–where “some reason” was probably a fat check from the world’s biggest pop star. **DNS changes around the time of the redirect** To track technical signs of a change in who managed the domain, I turned to historical DNS data to see what the IP addresses were in the past, when they changed, and who owned those ranges. Most IPs are not owned by hosting providers, not the organizations using them, so I didn’t expect to find a smoking gun placing this domain under Taylor Swift’s ownership. Perhaps when she starts a university or a telecommunications company. I looked for changes in IP addresses and hosting providers around the time of the redirect that would suggest it had moved to a new owner. The A record history, which shows the IP addresses the domain pointed to, told a clean story: * **June 23, 2021 – February 1, 2024:** 23.227.38.32, a Shopify address. This was the clothing shop. * **February 1 – April 23, 2024:** 216.239.32.21, .34.21, .36.21 and .38.21, the IP addresses Google Domains uses for its built-in URL forwarding. This is the redirect to taylorswift.com, switched on three days before Taylor announced *The Tortured Poets Department* at the Grammys on February 4. * **April 23, 2024 – today:** 198.185.159.144, Squarespace’s forwarding service. Same redirect, new host. Taylor Swift’s team had covered their tracks well: there was no evidence that the domain had changed ownership. While there were superficial changes, the nameservers haven’t changed at all. The same four Google Cloud DNS servers (ns-cloud-e1 through e4.googledomains.com) have been in place since October 10, 2020, three days after the domain was registered and continuing through the redirect.  The data did show changes around this time, but the April switch, along with a reformatted WHOIS record on the same day, is explained by Squarespace’s acquisition of Google Domains and the migration of its customers.  **Comparison to other domains** What didn’t change was more important. Big brands like Taylor Swift often use specialist brand-protection registrars such as MarkMonitor and CSC. Indeed, the domains I checked that are currently owned by Taylor (I feel like we’re on a first-name basis at this point) use MarkMonitor: taylorswift.com, 13management.com, and even taylorswift.porn and taylorswift.sucks. The domain doublecrossed.net did not move to MarkMonitor. It has sat with the same consumer registrar since 2020, first Google Domains and now Squarespace. One domain registered specifically for a song reveal,[ forafortnight.com](http://forafortnight.com), used in the build-up to *The Tortured Poets Department*, doesn’t use MarkMonitor either. But it shares other features with the rest of the Swift portfolio, and not with doublecrossed.net.  It was registered at GoDaddy on March 26, 2024, with Amazon’s Route 53 handling its DNS. It spent its first 22 days on GoDaddy’s basic forwarding service (15.197.148.33 and 3.33.130.190). Then, on April 19, 2024, the day the album dropped, it moved behind Imperva, a security service that shields websites from attacks and can be identified by the IP ranges a domain resolves to. forafortnight.com now resolves to 45.60.103.79 and 45.60.31.79. taylorswift.com resolves to 45.60.107.223 and 45.60.62.223– the same Imperva range. Doublecrossed.net, by contrast, has never once pointed at Imperva. Yet again, DNS data provides a way to find common features across a set of domains that help attribute ownership, and none of it supports the idea that this is a TS joint. **Lingering TXT records** IP information is stored in DNS A records; another DNS data point, TXT records, can also be used to attribute domains. Third-party services like Shopify and Facebook use TXT records to verify ownership of a domain. When Google Search Console, for example, wants to confirm that you own a domain before showing you its search performance, Google gives you a special code to put in a TXT record. The clothing site used TXT records for those reasons, and I would expect that a new owner would remove them to stop validating that sign of ownership.  In this case, the same Google site verification record (google-site-verification=nUfvlMce…) has stayed in place since December 28, 2021, through the closure of the DoubleCrossed shop and the redirect to taylorswift.com, all the way to today. Only the shop’s Facebook verification was removed on February 1, 2024. Leaving the previous owner’s Google verification record in place would be highly unusual for a technically savvy, reputation-conscious buyer. The changes we do see in the TXT records don’t line up with the timing of a sale and are more easily explained as housekeeping for marketing operations. The Facebook verification code changed on January 16, 2022, a few weeks after the Google record first appeared. Around the same time, the customer ID that Google Domains’ privacy service shows in the WHOIS record changed too, from 1248386066 to 7151571251. All of this happened between late 2021 and mid-2022, while the shop carried on as normal. Most likely these were backend changes moving from one account to another. Even Satanic streetwear designers need to do tech migrations. **Doubt, or hope, for those who want it** And yet none of this is absolutely conclusive. “Double Crossed” remains a very cool title for a song or album, assuming the inspiration strikes. While she seems to have found happiness as the wife of Mr. Travis Swift and to be surrounded by loyal friends, it still seems possible that doublecrossed.net could one day be a useful addition to her web domain portfolio. In fact, while I was writing this in October 2026, doublecrossed.net underwent another transformation: in the middle of October its ownership expired, taking the redirect chain offline. Before this domain becomes available for purchase, the owner has a few months to renew. After that, a new era begins for the site, perhaps now– or again?– as part of TaylorNet. ## Protect your organization Get in touch or book a free demo. [Contact sales](/demo) [Free demo](/demo) ## Related breaches Learn more about the latest issues in cybersecurity. [](/breaches/cyber-risks-of-the-2026-world-cup) #### [Own Goal: Inside the Cyber Risks of the 2026 World Cup](/breaches/cyber-risks-of-the-2026-world-cup) Free World Cup streams and black-market betting sites are leaking fan data. UpGuard research reveals the hidden cyber risks of the 2026 tournament. [](/team/greg-pollock) [Greg Pollock](/team/greg-pollock) June 30, 2026 [](/breaches/social-insecurity-billions-of-social-security-number-and-passwords) #### [Social Insecurity: Billions of Social Security Number and Passwords](/breaches/social-insecurity-billions-of-social-security-number-and-passwords) UpGuard research found a trove of sensitive information in an exposed Elastic database. Getting to the bottom of what it meant led us down an interesting path. [](/team/greg-pollock) [Greg Pollock](/team/greg-pollock) February 18, 2026 [](/breaches/angelsense-data-leak) #### [Sixth Sense: GPS and AI Data Exposed for Assistive Devices](/breaches/angelsense-data-leak) UpGuard can now report that it has secured an Elasticsearch database for AngelSense, a GPS tracker for children and adults with special needs. [](/team/upguard) [UpGuard Team](/team/upguard) January 30, 2025 [](/breaches/pta-database) #### [Stolen Data: National PTA Database Available on Dark Web](/breaches/pta-database) On May 13th, UpGuard discovered a new set of data recently posted on a prominent dark web forum, this time allegedly belonging to the National Parent Teacher Association. [](/team/upguard) [UpGuard Team](/team/upguard) May 14, 2024 [](/breaches/smarterselect) #### [Student Applications: How an Education Software Company Exposed Millions of Files](/breaches/smarterselect) UpGuard can now report that a public Google Cloud Storage bucket containing approximately 1.5 terabytes of data used to administer funding programs for college students has been secured. The bucket belonged to SmarterSelect, a company that provides software for managing the application process for scholarships, grants, and awards. The more than 2.8 million files included documents like transcripts, resumes, personal essays, tax returns, and invoices for approximately 1.2 million applications to funding programs. [](/team/upguard) [UpGuard Team](/team/upguard) November 22, 2021 [](/breaches/power-apps) #### [By Design: How Default Permissions on Microsoft Power Apps Exposed Millions](/breaches/power-apps) 38 million records were exposed in multiple data leaks resulting from misconfigured Microsoft Power Apps portals. Data included sensitive information such as COVID-19 contact tracing data, COVID-19 vaccination appointments, social security numbers for job applicants, employee IDs, and millions of names and email addresses. [](/team/upguard) [UpGuard Team](/team/upguard) August 23, 2021 [View all breaches](/breaches) ### Sign up for our newsletter UpGuard's monthly newsletter cuts through the noise and brings you what matters most: our breaking research, in-depth analysis of emerging threats, and actionable strategic insights. ##### Free instant security score ## How secure is your organization? Request a free cybersecurity report to discover key risks on your website, email, network, and brand. * Instant insights you can act on immediately * Hundreds of risk factors including email security, SSL, DNS health, open ports and common vulnerabilities [Free score](/instant-security-score)