An intern launches a highly parallelized lookup tool against a city vendor's public site. The vendor's web application firewall fires, and the vendor calls the mayor's office about an apparent attack. What should the analyst have done?
Select an answer to reveal the explanation.
Short Explanation
A burst of lookups can look like someone pounding on the vendor's front door at 3 a.m.—even when the pages are public. Civic OSINT is supposed to be quiet, polite, and easy to own up to. Slow the tool down and make the city lab identifiable instead of looking like an anonymous flood.
Full Explanation
High-concurrency automation against a public site can trigger defensive controls and political incidents even without any exploit. PORP methods stay observational: low rate, bounded scope, and attributable research infrastructure when the city may have to explain the traffic. Firewall alerts are not proof of hidden content, and hiding the source or changing tool classes toward intrusion is out of scope. Throttle first, identify the lab, and resume only at a human-comparable pace.