Parks due diligence finds two public handles that differ by one character: citytree1 and citytreel. What should the analyst do?

When parks due diligence finds two public handles that differ by one character—citytree1 and citytreel—the analyst should keep them separate until independent pivots such as email, a unique phrase, or a linked site corroborate a single person. Visual similarity and typosquat-style neighbors are common and regularly fool hasty merges. Merging them because visual similarity is identity falsely attributes posts, threats, or affiliations across unrelated accounts. Reporting both as confirmed sock puppets of the same parks staffer without corroboration overclaims and can damage an employee’s reputation inside a municipal process. Force-resetting both accounts through the city’s identity provider is unauthorized operational interference that may not even control third-party platforms. Exam caveat: PORP requires independent corroboration before merging near-match usernames and forbids IdP resets as an OSINT technique. Operational check: maintain two records, compare available public pivots side by side, merge only on strong multi-signal overlap, document near-miss collisions that remain unresolved, and leave account administration to proper platform or IT processes outside OSINT. Parks files should show both handles as unresolved near-matches until an email, phrase, or site link collapses them responsibly.