A city procurement analyst is performing OSINT on a vendor whose public website has no contact page. How should the analyst discover email addresses for the due-diligence file?
Select an answer to reveal the explanation.
Short Explanation
Missing a contact page is not a license to start guessing mailboxes. The emails that count are the ones already printed on staff pages, leftover PDFs, and public WHOIS contacts. Inbox blasting is a different sport—not OSINT collection.
Full Explanation
Email OSINT for civic due diligence is collection of addresses that are already publicly listed. Staff directories, document footers, and WHOIS-public contact fields are legitimate sources when a vendor omits a dedicated contact page. Generating permutations and probing mailboxes, scanning SMTP, or pretexting a help desk are not PORP collection methods. Record each harvested address with its source URL and date so the procurement file can show how the contact was found.