An intern launches a highly parallelized lookup tool against a city vendor's public site. The vendor's web application firewall fires, and the vendor calls the mayor's office about an apparent attack. What should the analyst have done?
Select an answer to reveal the explanation.
Short Explanation
A burst of lookups can look like someone pounding on the vendor's front door at 3 a.m.—even when the pages are public. Civic OSINT is supposed to be quiet, polite, and easy to own up to. Slow the tool down and make the city lab identifiable instead of looking like an anonymous flood.
Full Explanation
High-concurrency automation against a public site can trigger defensive controls and political incidents even without any exploit. When an intern's highly parallelized lookup tool trips a city vendor's WAF and the vendor calls the mayor's office about an apparent attack, the analyst should have throttled the lookups and identified the civic lab so automation stays gentle and the city can explain the traffic if asked.
Keeping maximizing parallel threads because a firewall alert proves hidden non-public content misreads a defensive signal as treasure. Switching to intrusion tooling so the next run is not stopped by the firewall escalates into attack methods. Denying the city's involvement and continuing the same volume from an unmarked residential connection hides attribution and worsens the optics.
Exam caveat: public pages remain public, but volume and anonymity can still look like hostile scanning; professionalism includes rate and identity management for municipal collectors.
Operational check: stop the flood, throttle to human-comparable pace, use identifiable research infrastructure, notify leadership if a vendor already complained, and resume only within bounded polite limits.