A domain registered last week mimics the city's hostname and advertises a "city grants portal" the PIO never launched. What is the appropriate OSINT action?
Select an answer to reveal the explanation.
Short Explanation
A brand-new look-alike hostname is like a cardboard kiosk with the city seal taped on — worth reporting, not kicking over. Capture registration age and public registration clues, then hand it to PIO and IT. Taking the site down is not OSINT.
Full Explanation
If a domain registered last week mimics the city’s hostname and advertises a “city grants portal” the PIO never launched, the appropriate OSINT action is to document the look-alike hostname, registration age, and public WHOIS-class clues, then hand the finding to PIO and IT. Brand-new look-alikes are high-priority civic impersonation artifacts. Defacing the look-alike site so residents cannot enter grant data fails as unauthorized offensive action. Sinkholing the city’s real DNS so both official and look-alike names fail together fails by harming legitimate services. Ignoring domain age because any page using the city seal is automatically an official host fails; seals are easily copied onto impostor domains. Exam caveat: documentation supports takedown and public warnings; researchers do not unilaterally attack or sinkhole domains. Operational check: capture homepage, registration date, and public registration clues; compare to official grants URLs; deliver an impersonation package to PIO and IT with recommended resident warnings. In municipal practice, record the rationale in the case file so future staff know which control was chosen and which failure modes the rejected options would create for city services.