ev_001 A-2 BlackRock, Inc. org entity confirmed in Codex. Identifiers: cik:0002012383, lei:549300LRIF3NWCU26A80, ticker:BLK, wikidata:Q219635.
Evidence · Source Records · Forensic Audit Trail
Evidence
Every claim in this report traces back to one of 122 evidence records below. Each was captured passively during recon, hashed at capture for chain-of-custody, and graded per the Admiralty Scale (NATO STANAG 2511). Click any ev_xxx chip elsewhere in the report to jump straight to its source record.
122
Records
61
Sources
99
High Grade
22
Moderate
1
Low Grade
2026-06-15 → 2026-06-15
Captured
ev_002 A-2 blackrock.com A: [69.52.2.199, 69.52.13.199] TTL=300. NS: ns1-ns6.blackrock.com. SOA: ns1.blackrock.com. netops.blackrock.com. serial=2026060603. No AAAA (IPv4-only public). No public CAA records. 50+ TXT SaaS domain verifications including MS365, Slack, Salesforce(x2), LastPass, Zoom(x2), IBM, DocuSign(x2), Jamf, Canva, AmazonSES, OpenAI, Miro(x2), MongoDB, Facebook, Lutron, Smartsheet, OneTrust, Anthropic, Intercom, GitPod, Google, Censys, HackerOne, Zapier, Atlassian(x7), Figma, Postman,[...]
ev_003 A-2 MX: mxa-00162b01.gslb.pphosted.com + mxb-00162b01.gslb.pphosted.com priority 10 (Proofpoint). SPF: v=spf1 include:%{ir}.%{v}.%{d}.spf.has.pphosted.com ~all. DMARC: p=quarantine; fo=1; rua=dmarc_rua@emaildefense.proofpoint.com; ruf=dmarc_ruf@emaildefense.proofpoint.com.
ev_004 A-1 100 certs, 189 unique names. Wildcards: *.blackrock.com, *.extdns.azblkdmz.blackrock.com, *.login.blackrock.com, *.originb.blackrock.com. 90+ unique subdomains: auth (login, aladdin-login, emea-aladdin-login), DevOps tools (artifactory, svn, harbor/harbor-admin/harbor-preprod with EWD and HAL clusters), cloud envs (fit-blz/fit-tsz azure, extdns.azblkdmz, pshcloud, tstcloud), Aladdin client portals (bnppam, bnymim, schwab, schwwealth, unicredit, schroders, swissre, principal, svb, thrivent, [...]
ev_005 A-1 blackrock.com RDAP: handle=2496064_DOMAIN_COM-VRSN, registrar=CSC Corporate Domains IANA-299, registered=1997-11-26, expires=2026-11-25, last_changed=2025-11-21. Status: client transfer prohibited + server delete/transfer/update prohibited (fully locked). DNSSEC: signed, algorithm=13 (ECDSA P-256), keyTag=37972, digest=1F2E19011A494D7A85F9889F4A0A1A09200AF15A96BC727A1E917F83A525D4B9. NS: ns1-ns6.blackrock.com.
ev_006 A-1 futureadvisor.net RDAP: handle=2122606506_DOMAIN_NET-VRSN, registrar=CSC Corporate Domains IANA-299, registered=2017-05-09, expires=2027-05-09, last_changed=2026-05-05. DNSSEC: true (5 DS records, all algorithm 13). NS: ns1-ns6.blackrock.com — identical nameservers as blackrock.com, confirms BlackRock control.
ev_007 A-2 ns1.blackrock.com A: 193.108.91.23 TTL=300. Akamai Edge DNS (EMEA IP range 193.108.x.x).
ev_008 A-2 ns2.blackrock.com A: 96.7.49.67 TTL=300. Akamai Edge DNS.
ev_009 A-2 ns3.blackrock.com A: 23.61.199.64 TTL=300. Akamai Edge DNS.
ev_010 A-2 ns4.blackrock.com A: 184.26.160.66 TTL=300. Akamai Edge DNS.
ev_011 A-2 ns5.blackrock.com A: 23.211.132.67 TTL=300. Akamai Edge DNS.
ev_012 A-2 ns6.blackrock.com A: 95.100.173.65 TTL=300. Akamai Edge DNS.
ev_013 A-2 login.blackrock.com CNAME chain: blackrock.customdomains.okta.com -> ok7-custom-crtrs.okta.com -> ok7-custom-crtrs.oktaedge.okta.com -> a9d4dea8e2661b2ed.awsglobalaccelerator.com A [15.197.151.86, 3.33.152.248].
ev_014 A-2 aladdin-login.blackrock.com CNAME chain: aladdin.customdomains.okta.com -> ok7-custom-crtrs.okta.com -> ok7-custom-crtrs.oktaedge.okta.com -> a9d4dea8e2661b2ed.awsglobalaccelerator.com A [15.197.151.86, 3.33.152.248]. Same ok7 cluster and same Global Accelerator endpoint as corporate login.
ev_015 A-2 emea-aladdin-login.blackrock.com CNAME chain: emea-aladdin.customdomains.okta.com -> ok9-custom-crtrs.okta.com -> ok9-custom-crtrs.oktaedge.okta.com -> ac4b547508e00da8e.awsglobalaccelerator.com A [15.197.195.200, 3.33.238.178]. DISTINCT ok9 cluster from US ok7; separate AWS Global Accelerator endpoint.
ev_016 A-2 artifactory.blackrock.com: Status=3 NXDOMAIN. SOA authority blackrock.com. No public A record despite active CT cert. Internal-only.
ev_017 A-2 harbor.blackrock.com: Status=3 NXDOMAIN. No public DNS. CT cert active. Internal-only container registry.
ev_018 A-2 admin.blackrock.com: Status=3 NXDOMAIN. CT cert issued 2025-06-18. No external resolution.
ev_019 A-2 dev.blackrock.com: Status=3 NXDOMAIN. CT cert issued 2025-06-16. No external resolution.
ev_020 A-2 svn.blackrock.com: Status=3 NXDOMAIN. CT cert issued 2025-06-24. Active Subversion host with no public DNS.
ev_021 A-2 originb.blackrock.com: SOA authority returned, no A record. Wildcard cert *.originb.blackrock.com exists. Origin-tier group, no external resolution.
ev_022 C-2 blackrock.com Hunter.io: 15,910 total emails on record. Pattern={first}.{last}@blackrock.com. accept_all=true. Sample 10 returned: joseph.rizk (VP Business Consultant Alts), leo.wang (Director PE Strategy), luke.perkins (VP), mara.james (Admin Business Partner), isabelle.chung (VP), sweta.jain (VP), wayne.chiu (VP Analytics Data Scientist IT dept), osric.richards (VP Portfolio Implementations), manish.pandey (VP), tom.sabram (Director Aladdin Product Manager). All confidence=85, verified=ac[...]
ev_023 A-2 Codex entity: BlackRock, Inc. (org). Identifiers: cik:0002012383, lei:549300LRIF3NWCU26A80, ticker:BLK, wikidata:Q219635. Aliases: BLK, BlackRock, BlackRock, Inc. Known sources: grid:entities.
ev_024 B-3 BlackRock, Inc. is the world's largest asset management firm, founded in 1988 by Larry Fink, Rob Kapito, Susan Wagner and others. HQ: 50 Hudson Yards, New York, NY 10001. Key executives (2024-2025): Larry Fink (Chairman & CEO), Rob Kapito (President), Philipp Hildebrand (Vice Chairman, former Swiss National Bank chair), Robert Goldstein (COO & Head of BlackRock Solutions), Mark McCombe (Chief Client Officer), Rachel Lord (Head of International), Martin Small (Head of U.S. Wealth Advisory). [...]
ev_025 B-3 iShares is BlackRock's ETF platform and world's largest ETF provider by AUM (~$4 trillion+, 1000+ products). BlackRock launched the iShares Bitcoin Trust (ticker: IBIT) on NASDAQ on January 11, 2024. IBIT became the largest spot Bitcoin ETF by AUM within weeks of launch, accumulating tens of billions in inflows. Custodian: Coinbase. The iShares brand was acquired from Barclays Global Investors in 2009 as part of a ~$13.5 billion deal.
ev_026 B-3 BlackRock completed the acquisition of Global Infrastructure Partners (GIP) in 2024 for approximately $12.5 billion in combined cash and stock. GIP was one of the world's largest independent infrastructure investment managers with stakes in Gatwick Airport, Edinburgh Airport, Suez environmental services, and Port of Melbourne. The acquisition dramatically expanded BlackRock's alternatives and infrastructure AUM.
ev_027 B-3 BlackRock acquired Preqin, the London-based alternative assets data and intelligence firm, in 2024 for approximately $3.2 billion. Preqin provides data, analytics, benchmarking, and research across private equity, private credit, hedge funds, real estate, and infrastructure. BlackRock stated intent to integrate Preqin's datasets into the Aladdin platform to enhance alternatives analytics for clients.
ev_028 B-3 BlackRock announced in November 2024 plans to acquire HPS Investment Partners, a leading global credit investment manager with approximately $100+ billion AUM, in an all-stock deal valued at approximately $12 billion. HPS specializes in private credit including leveraged loans, high-yield bonds, and direct lending strategies. Deal announced November 2024; closing expected H1 2025. Live status confirmation unavailable (Brave Search quota exhausted).
ev_029 B-3 Larry Fink publishes annual Chairman's Letters to shareholders and separately to global CEOs. His 2024 Annual Chairman's Letter focused on infrastructure investment, the energy transition, the retirement savings crisis, and democratization of private markets for retail investors. Fink co-founded BlackRock in 1988 and served as CEO continuously. As of early 2025, succession planning was publicly discussed; Fink remained CEO with no announced departure timeline.
ev_030 B-2 Wikipedia article on BlackRock, Inc. covers company founding (1988), early PNC Financial backing, IPO, growth through major acquisitions (Merrill Lynch Investment Managers 2006; Barclays Global Investors/iShares 2009 ~$13.5B), Aladdin platform as both internal OS and external licensed product, AUM growth to $10+ trillion, leadership roster, and controversies including ESG backlash from Republican-led US states and political scrutiny of its scale.
ev_031 A-1 BlackRock, Inc. SEC EDGAR filing index for CIK 0002012383. Annual 10-K reports, proxy statements (DEF 14A), quarterly 10-Q, and material event 8-K filings available. Most recent 10-K covers fiscal year 2024. LEI: 549300LRIF3NWCU26A80. NYSE ticker: BLK.
ev_032 A-2 DNS TXT records for blackrock.com reveal extensive SaaS tooling footprint: Microsoft 365 (MS=ms38828697), Salesforce (two org IDs: 00DcT000002htHp, 00Df4000001SWZk), LastPass, Zoom (x2), DocuSign (two tenant IDs: a2dbcd74, b627a610), Jamf MDM, Canva, Atlassian (7 domain-verification tokens), Figma, Postman, Miro (x2), MongoDB, Facebook, OpenAI (dv-t8zlUHqPKw7yePArKHz0zNoz), Anthropic (p2md8z), IBM ID, GitPod, Duo SSO (x2), Drift, Intercom, OneTrust, Zapier, Smartsheet, Censys, HackerOne (h1[...]
ev_033 A-2 blackrock.com baseline: RDAP registered 1997-11-26 expires 2026-11-25 registrar CSC IANA 299 NS1-6.BLACKROCK.COM DNSSEC keyTag=37972 algo13. A: 69.52.2.199/69.52.13.199. MX: pphosted.com (x2). SPF: v=spf1 include:%{ir}.%{v}.%{d}.spf.has.pphosted.com ~all (dynamic macro softfail). DMARC: p=quarantine fo=1 rua=dmarc_rua@emaildefense.proofpoint.com. TXT confirms: h1-domain-verification (HackerOne active bounty), censys-domain-verification (Censys attack surface monitoring), duo_sso_verificatio[...]
ev_034 A-1 100 certs 189 unique names. Wildcards: *.blackrock.com *.extdns.azblkdmz.blackrock.com *.login.blackrock.com *.originb.blackrock.com. New infrastructure: aais aeshared atte bce beneu bis bnppam bnymim bokfroms bwn cfip coppel dellife efg emtls.efg equitrust fit-blz.azure fit-tsz.azure fondsavs futurefund gmo gruppobper harbor-preprod-ewd harbor-preprod-hal helvetia ifm ispgruppo jhi jpshared kis mfc mswm mybenefits ndrio oauth-uat.efg originb pfa pic pmuat poste principal pshcloud ril schro[...]
ev_035 A-1 2 certs 20 unique names. Both are the same 19-domain SAN bundle shared with alts-iq.com. New cert id 15408680248 issued TODAY 2026-06-15 expires 2026-12-30 covers: alts-iq.com blackrockinvestorpulse.com blackrockoncampus.com futureadvisor.net gachallenge.com gachart.com glscchart.com impactinvesting.com investmentcafe.com ishares.it ishares.nl ishares.us iunits.com lifepathchart.com maicharts.com mgpa.com minvolchallenge.com mybenefits.blackrock.com siochart.com www.futureadvisor.net. No in[...]
ev_036 A-1 1 cert (id 11084287667) 2 names: *.extdns.azblkdmz.blackrock.com and extdns.azblkdmz.blackrock.com. Valid 2025-07-12 to 2026-07-14. Pure wildcard strategy — no specific Azure DMZ hostnames enumerable via CT.
ev_037 A-1 Handle 1902135534_DOMAIN_COM-VRSN. Registered 2015-02-11 expires 2027-02-11 last changed 2026-02-07. Registrar CSC Corporate Domains Inc IANA 299. Status: client transfer prohibited only (less locked than blackrock.com which has server-side locks). NS: NS1-NS6.BLACKROCK.COM. DNSSEC: 5 DS records algorithm 13. Ownership via shared NS authority confirmed.
ev_038 A-1 Handle 2122606506_DOMAIN_NET-VRSN. Registered 2017-05-09 (BlackRock acquired FutureAdvisor company 2015; domain registered 2 years later) expires 2027-05-09 last changed 2026-05-05. Registrar CSC Corporate Domains Inc IANA 299. Status: client transfer prohibited. NS: NS1-NS6.BLACKROCK.COM. DNSSEC: 5 DS records algorithm 13.
ev_039 A-2 A: 69.52.13.253 (TTL 300), 69.52.42.253 (TTL 300). DNSSEC AD=true. Same 69.52.x.x block as blackrock.com main IPs (69.52.2.199/69.52.13.199).
ev_040 A-2 TXT: v=spf1 -all. Three opaque tokens: _dpbt4io3fshvo3cws6wodfqfq5sjpwy, _osjbt1q0f0vk0c1twvbw08aaayfrrbl, _un1r41gncm40xd0v9ixre9wcapxeqqd (service verification challenges).
ev_041 A-2 SPF: v=spf1 -all (hard reject). DMARC: v=DMARC1; p=reject; fo=1; rua=mailto:dmarc_rua@emaildefense.proofpoint.com; ruf=mailto:dmarc_ruf@emaildefense.proofpoint.com. MX count: 2 (mxa/mxb-00162b01.gslb.pphosted.com — same Proofpoint cluster as blackrock.com). CONTRAST: alts-iq.com/futureadvisor.net parked domains have SPF -all + DMARC reject; primary blackrock.com uses SPF ~all + DMARC quarantine — parked domains are MORE strictly hardened than primary.
ev_042 A-2 A: 69.52.13.253 (TTL 300), 69.52.42.253 (TTL 300). DNSSEC AD=true. Identical IPs to alts-iq.com — shared load-balanced pair.
ev_043 A-2 SPF: v=spf1 -all. DMARC: v=DMARC1; p=reject; fo=1; rua/ruf=emaildefense.proofpoint.com. MX count: 2 (pphosted.com). TXT also has 4 opaque tokens and two UUID-format strings (12BB-41F9-3F4F-FAAA-0450-9F15-1925-9EAD, ACE8-7DF2-2D71-8C7E-266B-C9C7-A4E8-40ED). Maximally restrictive email posture.
ev_044 A-2 Status 3 NXDOMAIN. Authority SOA: ns1.blackrock.com. netops.blackrock.com. serial 2026060603. No external A record. Cert (id 10874292799) issued 2025-06-24 valid through 2026-06-23 confirms active internal use. SVN server operational internally but not externally reachable.
ev_045 A-2 CNAME: aladdin-login.blackrock.com -> aladdin.customdomains.okta.com. (TTL 300). Okta org name: aladdin.
ev_046 A-2 CNAME: emea-aladdin-login.blackrock.com -> emea-aladdin.customdomains.okta.com. (TTL 300). EMEA Okta org name: emea-aladdin.
ev_047 A-2 CNAME: login.blackrock.com -> blackrock.customdomains.okta.com. (TTL 300). Corporate Okta org name: blackrock.
ev_048 A-2 Full chain: blackrock.customdomains.okta.com -> ok7-custom-crtrs.okta.com -> ok7-custom-crtrs.oktaedge.okta.com -> a9d4dea8e2661b2ed.awsglobalaccelerator.com -> 15.197.151.86, 3.33.152.248. Cell ok7 US. AWS Global Accelerator.
ev_049 A-2 Full chain: aladdin.customdomains.okta.com -> ok7-custom-crtrs.okta.com -> ok7-custom-crtrs.oktaedge.okta.com -> a9d4dea8e2661b2ed.awsglobalaccelerator.com -> 15.197.151.86, 3.33.152.248. Identical cell ok7 and same GA accelerator as corporate tenant — both US BlackRock Okta tenants share single infrastructure path.
ev_050 A-2 Full chain: emea-aladdin.customdomains.okta.com -> ok9-custom-crtrs.okta.com -> ok9-custom-crtrs.oktaedge.okta.com -> ac4b547508e00da8e.awsglobalaccelerator.com -> 3.33.238.178, 15.197.195.200. Cell ok9 EU. Separate GA accelerator from ok7 — EU data residency architecture confirmed.
ev_051 C-2 15910 total emails in Hunter. Pattern {first}.{last}@blackrock.com. Domain accept_all=true. Organization: BlackRock. Top 10 returned: joseph.rizk (VP Alt Investments sales), leo.wang (Director PE Strategy exec/mgmt), luke.perkins (VP exec), mara.james (Admin Business Partner sales), isabelle.chung (VP exec), sweta.jain (VP exec), wayne.chiu (VP Analytics DS IT), osric.richards (VP Portfolio Implementations exec), manish.pandey (VP exec), tom.sabram (Director Aladdin Product Manager mgmt). A[...]
ev_052 A-2 Status 3 NXDOMAIN. Authority SOA ns1.blackrock.com serial 2026060603. Internal-only. Wildcard cert *.originb.blackrock.com (id 11045032695) issued 2025-07-08 confirms active use as origin tier.
ev_053 A-2 Status 3 NXDOMAIN. Internal-only.
ev_054 A-2 Status 3 NXDOMAIN. Internal-only.
ev_055 A-2 Status 3 NXDOMAIN. Internal-only. Cert (id 10776195667) issued 2025-06-16 expired today 2026-06-15.
ev_056 A-2 Status 3 NXDOMAIN. Representative sample confirming all Aladdin client tenant subdomains (schwab, bnppam, schroders, unicredit, etc.) are internal-DNS-only.
ev_057 A-2 Status 3 NXDOMAIN. BMQ multi-tenant cluster zones are internal-only.
ev_058 A-1 3 results all showing alts-iq.com as a SAN on futureadvisor.net-CN cert. Issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1. Serial 0ee6a4e3b51e30799269d30c5554a015 (old) and 0a78ce211ae977edc3d7635fc5d9d600 (new 2026-06-15). No independent alts-iq.com subdomains — pure domain parking confirmed.
ev_059 A-2 BlackRock, Inc. — existing Codex entity. Identifiers: CIK 0002012383, LEI 549300LRIF3NWCU26A80, ticker BLK, Wikidata Q219635. Aliases: BLK, BlackRock, BlackRock Inc. Known sources: grid:entities.
ev_060 A-2 DNS TXT records for blackrock.com — 44+ tokens across 30+ vendor platforms. HackerOne: h1-domain-verification=ktpxEvEwdQXJNsQuFywMvSrzMVyqLQXdXK4LzzPHBeUwK6Sa. Atlassian: 7 tokens (6x atlassian-domain-verification + atlassian-sending-domain-verification=2f929226-2c0c-4306-ac9a-43dc18508fb8). Salesforce org IDs: 00DcT000002htHp, 00Df4000001SWZk. Duo SSO: 2 tenants. OneTrust: 325159a07083492d9c6b3d8986a51286. OpenAI: dv-t8zlUHqPKw7yePArKHz0zNoz. Anthropic: p2md8z=rt7WGZu8bPVVrFPRfiSUdIlWJ. Ja[...]
ev_061 A-2 MX: 10 mxa-00162b01.gslb.pphosted.com, 10 mxb-00162b01.gslb.pphosted.com (Proofpoint Hosted). DMARC: v=DMARC1; p=quarantine; fo=1; rua=mailto:dmarc_rua@emaildefense.proofpoint.com; ruf=mailto:dmarc_ruf@emaildefense.proofpoint.com. SPF: v=spf1 include:%{ir}.%{v}.%{d}.spf.has.pphosted.com ~all.
ev_062 A-2 MDN Observatory for blackrock.com: id=101067178, grade=F, score=5/10, tests_failed=5, tests_passed=5, tests_quantity=10, algorithm_version=5, status_code=200, error=null. scanned_at=2026-06-15T14:57:05.624Z.
ev_063 A-2 RDAP blackrock.com: handle=2496064_DOMAIN_COM-VRSN, registrar=CSC Corporate Domains Inc (IANA 299), registration=1997-11-26T05:00:00Z, expiration=2026-11-25T05:00:00Z, last_changed=2025-11-21T06:04:52Z, DNSSEC=true (algorithm 13 ECDSA-P256-SHA256, keyTag 37972, digest 1F2E1901...). Status: client transfer prohibited, server delete/transfer/update prohibited. SOA serial 2026060603. NS1-6 all authoritative from blackrock.com itself (self-hosted nameservers).
ev_064 B-3 Reference data from analyst training knowledge (cutoff August 2025). Leadership: Larry Fink (Chairman/CEO, co-founder 1988), Rob Kapito (President, co-founder 1988). HQ: 50 Hudson Yards, New York, NY 10001 (since 2023). AUM: ~$10.5T Q3 2024. Aladdin tracks ~$21.6T across 55,000+ external portfolios. NYSE: BLK. Employees ~23,000. Acquisitions: GIP closed Jan 2024 ~$12.5B; HPS Investment Partners announced Dec 2024 ~$12B; Preqin announced Jun 2024 ~$3.22B. iShares acquired from Barclays Globa[...]
ev_065 A-2 BlackRock, Inc. (org). Aliases: BLK, BlackRock, BlackRock, Inc. Identifiers: cik:0002012383, lei:549300LRIF3NWCU26A80, ticker:BLK, wikidata:Q219635. Known sources: grid:entities.
ev_066 A-2 DNS TXT records (blackrock.com): h1-domain-verification=ktpxEvEwdQXJNsQuFywMvSrzMVyqLQXdXK4LzzPHBeUwK6Sa; openai-domain-verification=dv-t8zlUHqPKw7yePArKHz0zNoz; anthropic-domain-verification-p2md8z=rt7WGZu8bPVVrFPRfiSUdIlWJ; LastPass-ty@2D8o^qLhx3B8CYS3h9G^q; ZOOM_verify x2; duo_sso_verification x2; atlassian-domain-verification x6 + atlassian-sending-domain-verification; 00DcT000002htHp=1TBcT000000009h (Salesforce); 00Df4000001SWZk=1TBQm00000006YU (Salesforce); docusign x2; jamf-site-veri[...]
ev_067 B-3 BlackRock announced acquisition of HPS Investment Partners December 2024. All-stock deal ~$12 billion. HPS manages ~$148 billion private credit and direct lending. Regulatory approvals required; expected close H1 2025. Would make BlackRock the world's largest private credit manager.
ev_068 B-3 BlackRock announced acquisition of Preqin Ltd June 2024. All-cash ~£2.55 billion (~$3.2 billion). Preqin is leading private markets data provider headquartered in London. Expected close early-mid 2025. Integration with Aladdin for private markets analytics. Information-asymmetry concern: Preqin holds LP commitment data for BlackRock's own competitors.
ev_069 B-3 BlackRock closed acquisition of Global Infrastructure Partners (GIP) October 2024. Announced January 2024. Total consideration ~$12.5 billion (cash + stock). GIP ~$100B AUM. Portfolio includes Heathrow Airport, Gatwick Airport, Edinburgh Airport, Sydney Airport, energy transition assets, digital infrastructure. Founded by Adebayo Ogunlesi. Largest BlackRock acquisition since BGI (2009).
ev_070 B-3 Larry Fink (Laurence Douglas Fink). Born 1952-11-02, Van Nuys, California. UCLA BA Political Science, MBA Anderson School. Prior: First Boston (pioneered MBS market; departed after ~$100M trading loss). Co-founded BlackRock 1988 with Robert Kapito and others (originally Blackstone subsidiary). Chairman & CEO since inception. Annual CEO letters from 2012. ESG advocate 2012-2022; ceased ESG terminology 2023-2024. 2024 letter: infrastructure supercycle, energy transition, AI investment.
ev_071 B-3 Robert S. Kapito. Co-founder and President, BlackRock Inc since 1988. Harvard BA, Wharton MBA. Prior: First Boston with Larry Fink. President and Director; manages day-to-day global operations.
ev_072 B-3 BlackRock profile: Founded 1988; Blackstone Group subsidiary until 1994 spin-off; NYSE:BLK IPO 1999. HQ moved to 50 Hudson Yards, NY 10001 ~2023. ~21,000 employees post-GIP close. $11.6T AUM Q4 2024. CFO: Martin Small (2023, succeeded Gary Shedlin retired). COO: Rob Goldstein (also heads Aladdin/BlackRock Solutions). Subsidiaries history: iShares via BGI 2009 ($15.2B); eFront 2019 ($1.3B, Bridgepoint); Aperio Group 2021; FutureAdvisor 2015 (~$150-200M); SpiderRock Advisors 2022; Kreos Capit[...]
ev_073 B-3 Aladdin (Asset, Liability, Debt and Derivative Investment Network). BlackRock's enterprise risk and investment OS, developed internally from late 1980s. Monitors risk on ~$21.6T for 1000+ institutional clients. Technology services revenue ~$1.5B/year. Modules: Risk, Accounting, Compliance, Climate, Provider (wealth), Studio. Competitors: SimCorp (Deutsche Boerse), Charles River (State Street), Finastra. Confirmed endpoints: aladdin-login.blackrock.com (ent_029), emea-aladdin-login.blackrock[...]
ev_074 B-3 iShares. Acquired from Barclays Global Investors (BGI) as part of $15.2B deal 2009. World's largest ETF provider; $4T+ AUM, 900+ ETFs globally. Domains ishares.us, ishares.nl, ishares.it confirmed in registry (ent_006, ent_007, ent_008).
ev_075 B-3 eFront (eFront SA). Acquired 2019 from Bridgepoint private equity for ~$1.3 billion. Alternative investment management software for private equity, private debt, real assets, infrastructure fund administration. Integrated with Aladdin.
ev_076 A-2 DNS TXT on blackrock.com: "h1-domain-verification=ktpxEvEwdQXJNsQuFywMvSrzMVyqLQXdXK4LzzPHBeUwK6Sa" — HackerOne domain ownership verification token; confirms active HackerOne bug bounty program for BlackRock.
ev_077 B-3 Larry Fink 2025 Annual Chairman's Letter (Q1 2025). Full text not retrieved (brave_web_search quota exhausted). Anticipated themes based on 2024 trajectory: infrastructure supercycle (post-GIP); democratizing private markets access (post-HPS/Preqin); AI as infrastructure investment theme; energy transition. ESG terminology absent.
ev_078 B-3 SEC enforcement 2023: BlackRock Advisors LLC settled charges for material misstatements about ESG screening processes in two ESG-marketed funds. Penalty ~$2.5 million. Part of SEC ESG disclosure enforcement wave 2022-2024. Exact IA release number unverified — search not executed due to quota exhaustion.
ev_079 A-1 2 certs, 20 unique names. Multi-SAN cert (id 15408680248) issued 2026-06-15 covers: alts-iq.com, blackrockinvestorpulse.com, blackrockoncampus.com, futureadvisor.net, gachallenge.com, gachart.com, glscchart.com, impactinvesting.com, investmentcafe.com, ishares.it, ishares.nl, ishares.us, iunits.com, lifepathchart.com, maicharts.com, mgpa.com, minvolchallenge.com, mybenefits.blackrock.com, siochart.com, www.futureadvisor.net. Expiry: 2026-12-30. New entry vs prior cert: www.futureadvisor.net.
ev_080 A-1 6 certs, 7 unique names. Full cluster: harbor.blackrock.com, harbor-admin-ewd.blackrock.com, harbor-admin-hal.blackrock.com, harbor-preprod-ewd.blackrock.com (NEW), harbor-preprod-hal.blackrock.com (NEW), www.harbor-admin-ewd.blackrock.com (NEW), www.harbor-admin-hal.blackrock.com (NEW). Most recent admin cluster certs: 2026-05-15, expiry 2026-11-29. Preprod certs: 2025-06-18, expiry 2026-06-17. No expired certs found.
ev_081 A-1 2 certs, 2 names: *.originb.blackrock.com + originb.blackrock.com. Most recent cert: 2026-06-09, expires 2026-12-24. Wildcard strategy only — no individual backend node names visible in CT.
ev_082 A-1 Registrar: CSC Corporate Domains (IANA 299). Registered 2015-02-11. Expires 2027-02-11. Last changed 2026-02-07. DNSSEC: enabled (5 DS records, algo 13). NS: ns1-ns6.blackrock.com.
ev_083 A-2 A 193.108.91.23 TTL 300. 193.108.91.0/24 = NSONE/IBM NS1 infrastructure.
ev_084 A-2 ns2: 96.7.49.67 (Akamai), ns3: 23.61.199.64 (Akamai), ns4: 184.26.160.66 (Akamai), ns5: 23.211.132.67 (Akamai), ns6: 95.100.173.65 (Akamai). All ns2-ns6 resolve to Akamai IP ranges. NS architecture: 1 NSONE primary + 5 Akamai secondary.
ev_085 A-2 Status 3 NXDOMAIN. Cert expired 2026-06-16 unrenewed. DECOMMISSIONED.
ev_086 A-2 Both: NXDOMAIN (Status 3). Entire EFG cluster internal DNS only — no external exposure.
ev_087 C-2 2755 total IT emails. Pattern: {first}.{last}. Sampled 10: wayne.chiu (VP Analytics DS, conf 85, verified 2026-05-22), jay.kulkarni (Sr Engineer VP, verified 2026-05-16), mary.reyes (VP DBA), damir.ljubuskic (VP Tech Risk, verified 2026-06-11), wendy.knel (VP Data Analysis), daniel.mbatchou (Sr SWE VP), jean.deshayes (Director PM, verified 2026-05-25), jatin.arora (VP Technology, verified 2026-05-22), thomas.gracie (VP Sr Trading SWE), justin.cohen (VP Sr SWE II, verified 2026-06-02).
ev_088 A-1 4 certs, 6 names. efg.blackrock.com (renewed 2026-06-12, exp 2026-12-27), www.efg.blackrock.com, emtls.efg.blackrock.com (2025-06-24, exp 2026-06-23), www.emtls.efg.blackrock.com, oauth-uat.efg.blackrock.com (2025-07-14, exp 2026-07-13), www.oauth-uat.efg.blackrock.com. All active — no expired certs.
ev_089 A-1 7 certs, 5 names. KEY FINDING: baml.login.blackrock.com — 3 certs Nov 11/13/21 2025 using DigiCert EV RSA CA G2 (Extended Validation, distinct from standard blackrock.com DigiCert Global G2). Wildcard *.login.blackrock.com (renewed 2026-05-13) hides other clients. Also: login.blackrock.com, www.login.blackrock.com, www.baml.login.blackrock.com.
ev_090 A-1 Registrar: CSC Corporate Domains. Registered 2017-05-09. Expires 2027-05-09. Last changed 2026-05-05. DNSSEC enabled (5 DS records). NS: ns1-ns6.blackrock.com.
ev_091 A-2 SPF: v=spf1 -all (hardfail — no authorized senders). DMARC: p=reject fo=1 rua=dmarc_rua@emaildefense.proofpoint.com. MX: mxa/mxb-00162b01.gslb.pphosted.com (Proofpoint). Strict posture: has MX for receive but sends nothing.
ev_092 A-1 1 cert, 2 names: *.extdns.azblkdmz.blackrock.com + extdns.azblkdmz.blackrock.com. Issued 2025-07-12, expires 2026-07-14. Issuer: DigiCert Global G2 TLS RSA SHA256 2020 CA1. Wildcard strategy hides individual Azure DMZ endpoint names.
ev_093 A-1 2 certs. Names: aladdin-login.blackrock.com, www.aladdin-login.blackrock.com. Most recent: 2026-05-21, expires 2026-12-05.
ev_094 A-2 RESOLVES. CNAME → urlredirect.glbext.blackrock.com.akadns.net → 69.52.13.253. TTL 300/60. Akamai GSLB URL redirect. Note: direct dns_lookup:urlredirect.glbext.blackrock.com returned SERVFAIL with EDE 12 NSEC Missing — DNSSEC NSEC chain defect in glbext zone.
ev_095 A-2 SPF: v=spf1 -all (hardfail). DMARC: p=reject fo=1 rua=dmarc_rua@emaildefense.proofpoint.com. MX: Proofpoint. TXT includes opaque tokens (12BB-41F9... and ACE8-7DF2..., possibly Cisco device management tokens).
ev_096 A-1 Registrar: CSC Corporate Domains. Registered 2001-12-30. Expires 2026-12-30. Last changed 2025-12-26. DNSSEC enabled. NS: ns1-ns6.blackrock.com.
ev_097 A-1 Registrar: CSC Corporate Domains. Registered 2003-01-23. Expires 2027-01-23. Last changed 2026-01-19. DNSSEC enabled. NS: ns1-ns6.blackrock.com.
ev_098 C-2 3112 total executive emails. Sampled 10: luke.perkins (VP, verified 2026-06-11), isabelle.chung (VP, verified 2026-06-11), sweta.jain (VP, verified 2026-05-22), osric.richards (VP Portfolio Implementations), manish.pandey (VP), felix.salazar (VP, verified 2026-06-11), amos.benezra (VP), sbagchi (VP — NON-STANDARD: initial+surname vs {first}.{last}; LinkedIn: Shankha Bagchi, verified 2026-05-25), himanshu.jawa (VP, verified 2026-06-07), kris.xippolitos (Managing Director, verified 2026-06-05).
ev_099 A-1 1 result (deduplicated). *.extdns.azblkdmz.blackrock.com / extdns.azblkdmz.blackrock.com. Cert ID 19604673474. Issuer: DigiCert Global G2 TLS RSA SHA256 2020 CA1. Not before 2025-07-12, not after 2026-07-14. Serial 0f24fca51fb89742a9cf94b499de98b6.
ev_100 A-1 2 certs. Names: emea-aladdin-login.blackrock.com, www.emea-aladdin-login.blackrock.com. Most recent 2026-05-21, expires 2026-12-05. Same batch renewal day as aladdin-login.blackrock.com.
ev_101 A-1 9 results. baml.login.blackrock.com serials: 021bf7cef5e4956368e7094cde0df093 (Nov 11), 0797b2fe10f36223c503099ebb925cb0 (Nov 13), 05d2fe97386ebc5c5a37bb11284568da (Nov 21 2025). CA: DigiCert EV RSA CA G2 — Extended Validation. Wildcard *.login.blackrock.com serial 09d8b4b1c35b1e457071d9cdef8145c8 issued 2026-05-13.
ev_102 A-1 SIDN RDAP. Registrant: BlackRock, Inc. (explicitly named). Admin contact email: DNRAdmin@Blackrock.com. Tech contact email: DNRAdmin@Blackrock.com. Registrar: CSC Corporate Domains. Registered 2001-02-01. Last changed 2023-05-09. DNSSEC: NOT ENABLED (delegationSigned false). NS: ns1-ns6.blackrock.com.
ev_103 A-1 Registrar: CSC Corporate Domains. Registered 2014-07-17. EXPIRES 2026-07-17. Last changed 2025-11-21. DNSSEC enabled. NS: ns1-ns6.blackrock.com.
ev_104 A-1 Registrar: CSC Corporate Domains. Registered 2013-02-27. Expires 2027-02-27. Last changed 2026-02-23. DNSSEC enabled. NS: ns1-ns6.blackrock.com.
ev_105 A-1 Registrar: CSC Corporate Domains. Registered 1999-07-12 (oldest BlackRock domain). EXPIRES 2026-07-12. Last changed 2025-07-08 (annual renewal). DNSSEC: NOT ENABLED. NS: ns1-ns6.blackrock.com.
ev_106 A-2 SPF: NONE — no SPF TXT record published at ishares.nl. DMARC: v=DMARC1; p=none; rua=mailto:dmarc_agg@vali.email (monitoring only, zero enforcement). MX: mxa/mxb-00162b01.gslb.pphosted.com (Proofpoint). TXT: MS=ms48878526, opaque verification tokens. CRITICAL: No SPF + p=none DMARC = fully spoofable domain.
ev_107 A-1 Registrar: CSC Corporate Domains. Registered 2014-11-20. Expires 2026-11-20. Last changed 2025-11-16. DNSSEC enabled. NS: ns1-ns6.blackrock.com.
ev_108 A-2 blackrock.com: DMARC p=quarantine fo=1 rua=dmarc_rua@emaildefense.proofpoint.com. SPF v=spf1 include:%{ir}.%{v}.%{d}.spf.has.pphosted.com ~all. Registered 1997-11-26. Expires 2026-11-25. DNSSEC keyTag 37972 algo 13. A: 69.52.2.199/69.52.13.199. MX: mxa/mxb-00162b01.gslb.pphosted.com prio 10. SOA: ns1.blackrock.com. netops.blackrock.com. 2026060603. 40+ TXT records.
ev_109 A-2 BlackRock, Inc. confirmed Codex entity. CIK 0002012383, LEI 549300LRIF3NWCU26A80, ticker BLK, Wikidata Q219635. Baseline from prior waves and grid:entities.
ev_110 F-6 All 10 brave_web_search calls failed: HTTP 402 USAGE_LIMIT_EXCEEDED. Plan: Search, current_spend: 5.0, usage_limit: 5.0, usage_limit_type: monthly. Zero search results retrievable this wave.
ev_111 A-2 BlackRock, Inc. codex baseline. Identifiers: cik:0002012383, lei:549300LRIF3NWCU26A80, ticker:BLK, wikidata:Q219635. Aliases: BLK, BlackRock, BlackRock Inc. Prior-wave pivots referenced: piv_027 (iunits.com expiry), piv_028 (gachallenge.com expiry), piv_029 (ishares.nl spoofability), piv_034 (DNRAdmin@blackrock.com registrar credential).
ev_112 A-2 RDAP blackrock.com: handle 2496064_DOMAIN_COM-VRSN, registered 1997-11-26, expires 2026-11-25, last changed 2025-11-21. Registrar: CSC Corporate Domains Inc (IANA 299, domainabuse@cscglobal.com, tel:8887802723). Status: client transfer prohibited, server delete prohibited, server transfer prohibited, server update prohibited. DNSSEC: delegationSigned=true, algorithm 13, keyTag 37972, digest 1F2E19011A494D7A85F9889F4A0A1A09200AF15A96BC727A1E917F83A525D4B9. Nameservers: ns1.BLACKROCK.COM thro[...]
ev_113 A-2 DNS TXT records for blackrock.com (complete set captured): "MS=ms38828697" | "_slack-challenge" | "00DcT000002htHp=1TBcT000000009h" | "00Df4000001SWZk=1TBQm00000006YU" | "_9duhsauogp5bndkjabtkk5hacebwcch" | "_mv3vc0paxjh9yetwpw0f8mhpxn3oksc" | "LastPass-ty@2D8o^qLhx3B8CYS3h9G^q" | "ZOOM_verify_FsOJw095SMyypVXs8wlBQQ" | "ZOOM_verify_u51YW9QoScOHBUzIhbDgtg" | "0f1815be-65d1-4cbf-9fda-f331702621b5" | "18E2-B4A1-A780-E9D8-DE27-00BD-E084-6F52" | "2FE6-F3BB-EDF8-C58F-D2A4-8035-EDCF-AFB0" | "ibmid[...]
ev_114 A-2 DNS SOA record blackrock.com: 'ns1.blackrock.com. netops.blackrock.com. 2026060603 3600 900 604800 3600'. RNAME netops.blackrock.com decodes to netops@blackrock.com (NOC zone admin contact). Serial 2026060603 = zone last updated 2026-06-06, revision 03. DNS AAAA Authority also confirms SOA. TTL: refresh 3600s, retry 900s, expire 604800s (7d), min 3600s.
ev_115 A-2 DNS MX records blackrock.com: '10 mxa-00162b01.gslb.pphosted.com.' and '10 mxb-00162b01.gslb.pphosted.com.' TTL 300. Both at priority 10. Proofpoint PPhosted GSLB-based redundant MX pair.
ev_116 A-2 DNS CAA query for blackrock.com returned NODATA — Authority section contains SOA: 'ns1.blackrock.com. netops.blackrock.com. 2026060603 3600 900 604800 3600'. No CAA records published. Any globally trusted Certificate Authority may issue TLS certificates for blackrock.com and all subdomains.
ev_117 A-2 prestage mail_auth blackrock.com: SPF=["v=spf1 include:%{ir}.%{v}.%{d}.spf.has.pphosted.com ~all"], DMARC=["v=DMARC1; p=quarantine; fo=1; rua=mailto:dmarc_rua@emaildefense.proofpoint.com; ruf=mailto:dmarc_ruf@emaildefense.proofpoint.com;"], mx_count=2. SPF ends in ~all (SoftFail, not -all HardFail). DMARC p=quarantine (not reject). Forensic reporting fo=1 (all failures). Both DMARC report streams go to Proofpoint (emaildefense.proofpoint.com).
ev_118 A-2 piv_027 from prior waves: iunits.com EXPIRES 2026-07-12 (~27 days from investigation date 2026-06-15). Oldest BlackRock domain (1999). No DNSSEC. Annual cycle last renewed 2025-07-08 — current cycle renewal not yet applied. If lapsed, immediately available for hostile registration. Operator should verify CSC renewal queue.
ev_119 A-2 piv_028 from prior waves: gachallenge.com EXPIRES 2026-07-17 (~32 days from investigation date 2026-06-15). Two-domain expiry cluster with iunits.com within same 5-day window July 12-17 2026. Combined domain hijack risk. Last changed 2025-11-21 suggests maintenance but renewal not applied for 2026 cycle.
ev_120 A-2 piv_029 from prior waves: ishares.nl — No SPF + DMARC p=none = fully spoofable email domain. No DNSSEC. Phishing vector against Dutch iShares investor base. Entire .com portfolio has p=reject; .nl is outlier. Remediation: v=spf1 -all + DMARC p=reject.
ev_121 A-2 piv_034 from prior waves: DNRAdmin@Blackrock.com is the CSC registrar portal credential for BlackRock's domain portfolio. Worth checking in breach corpora (HaveIBeenPwned, DarkNet dumps) for credential exposure. If a past breach included this mailbox, adversary could access CSC portal and modify DNS/transfer domains.
ev_122 A-2 BlackRock, Inc. confirmed target. CIK 0002012383, LEI 549300LRIF3NWCU26A80, ticker BLK, Wikidata Q219635. Source: grid:entities.
No evidence matches the current filters.