A "pay your ticket" site uses the city's logo, but public registration data places the registrar in a country the city never uses for official domains. What should the researcher document for the city attorney?
Select an answer to reveal the explanation.
Short Explanation
A logo is cheap paint; the registrar country is the shipping label on the box. When official civic domains never use that geography, the mismatch is a public flag for the city attorney — document it, and do not hack the clone or guess registrar passwords.
Full Explanation
If a “pay your ticket” site uses the city’s logo but public registration data places the registrar in a country the city never uses for official domains, the researcher should document the registrar and WHOIS-class geography mismatch as a public flag on a civic-brand look-alike for the city attorney. Logos are cheap; registration geography is a stronger authenticity signal when it diverges from known civic practice. Documenting nothing because a city logo makes the domain official fails; logos are trivially copied. Producing a packet capture from exploiting the clone so the attorney has a technical exhibit fails as unauthorized exploitation. Performing a takedown by guessing the registrar account password fails as account takeover. Exam caveat: unusual registrar geography is a flag, not courtroom proof by itself—combine with other look-alike indicators. Operational check: capture logo use, registration geography, and domain age; compare to official payment domains; deliver the flag package to the city attorney and IT for resident warnings and platform/registrar abuse reports. In municipal practice, record the rationale in the case file so future staff know which control was chosen and which failure modes the rejected options would create for city services.