A fleet vendor lists different emails on WHOIS, the company website, and a state contractor registry. What should the analyst do?
Select an answer to reveal the explanation.
Short Explanation
Companies collect mailboxes like departments collect phone extensions. WHOIS, the website, and the registry can all be real and still disagree. List them, source them, and do not crown a winner on day one.
Full Explanation
When a fleet vendor lists different emails on WHOIS, the company website, and a state contractor registry, the analyst should keep all three as a sourced set rather than forcing one true address too early. Organizations commonly maintain role mailboxes, sales contacts, and registry contacts that all function for different audiences. Deleting two of them so the due-diligence file shows a single official email destroys useful coverage and invents false uniqueness that procurement may later rely on incorrectly. Mail-bombing all three until one auto-replies is intrusive probing, not passive OSINT, and can damage the city’s relationship with a needed fleet vendor. Assuming WHOIS is always the only valid contact and ignoring the website and registry overweights one registry class that may be outdated, privacy-redacted, or aimed at abuse complaints rather than sales. Exam caveat: PORP prefers multi-source contact inventories with provenance over premature single-address crowning in vendor files. Operational check: tabulate each address with source URL, capture date, and field context; mark currency confidence separately; use published contacts for authorized outreach only through approved procurement channels; and update the set when a higher-authority public filing clarifies a preferred contact.