A transit authority wants to know whether a critic's X handle is a brand-new sock puppet or a long-running account. Which public artifacts should the researcher use first?
Select an answer to reveal the explanation.
Short Explanation
New socks and old regulars leave different footprints in the shop window. Creation date plus how long and how often the public timeline talks is enough to start that call. Backend IPs and legal names are not OSINT's first tools.
Full Explanation
When a transit authority needs to distinguish a brand-new sock puppet from a long-running critic handle, the first public artifacts are account-creation age plus the volume and chronological span of the visible post history—shop-window signals that remain within civic OSINT. Those fields support a provisional judgment about account maturity without demanding private platform data. Private login-IP logs fail as a first source because they are closed backend material outside open-source collection and usually require legal process the researcher does not start with. Subpoenaing the critic’s legal name before reviewing public posts fails by prioritizing identity compulsion over public timeline analysis and steps outside PORP-style open-source scope. Scraping mutual-follower graphs from locked accounts the critic never made public fails because locked graphs are not public artifacts and collecting them crosses privacy boundaries the civic brief does not authorize. Exam caveat: creation age and history volume are indicators, not proof of identity or intent; socks can be aged and genuine critics can be new. Operational check: record join/create date if shown, sample earliest and latest public posts, note posting cadence and media volume, and cite those public observations in the transit due-diligence note before any legal ask.