Very few companies use HPKP, for fear of bricking their site / business. Even fewer people view the cert details of a site when they are being phished. The tr

Very few companies use HPKP, for fear of bricking their site / business. Even fewer people view the cert details of a site when they are being phished. The transparency logs will show the host the attacker used to make the cert, though attribution is rare, as they often use stolen CC's to pay for the VM's.