A city procurement analyst is performing OSINT on a vendor whose public website has no contact page. How should the analyst discover email addresses for the due-diligence file?
Select an answer to reveal the explanation.
Short Explanation
Missing a contact page is not a license to start guessing mailboxes. The emails that count are the ones already printed on staff pages, leftover PDFs, and public WHOIS contacts. Inbox blasting is a different sport—not OSINT collection.
Full Explanation
OSINT email discovery for civic vendor due diligence collects addresses already published on staff pages, proposal PDFs, press releases, procurement attachments, and WHOIS-public contact fields when those fields remain public. Guess-and-send firstname.lastname permutation testing against a vendor domain is not open-source collection; it is mailbox probing that can annoy targets, trigger security alerts, and leave the city outside PORP’s public-source lane. Port-scanning a mail gateway and enumerating SMTP users is active infrastructure reconnaissance, not OSINT, and may require separate authorization even inside IT security. Spear-phishing a vendor help desk until someone returns an internal directory is social engineering incompatible with authorized civic OSINT purpose. Harvesting published addresses keeps the procurement file defensible under public-records and ethics review. Exam caveat: PORP separates passive collection of published contacts from active probing, deception, or mail-bombing in municipal due diligence. Operational check: scrape and cite public pages and documents with capture dates, record WHOIS-public fields only if still exposed, log source URLs in the due-diligence notebook, and refuse guess-and-send or SMTP enumeration requests from stakeholders who conflate OSINT with intrusion.