Passive DNS records previously observed DNS answers and associated times, enabling retrospective infrastructure correlation without active interaction with the domain; the question specifically requires a documented query strategy and filtered findings connected to approved impersonation indicators, which this alternative does not produce.

Certificate-transparency logs expose issued certificate metadata, supporting hostname discovery without visiting the sites; useful in a different context, it does not directly produce a documented query strategy and filtered findings connected to approved impersonation indicators for this consumer.

Approved automation can standardize retrieval, time stamping, errors, and enrichment while respecting API agreements and throttling limits; that workflow does not establish a documented query strategy and filtered findings connected to approved impersonation indicators, which is needed for the stated decision.

MX queries reveal declared mail-routing destinations, which help assess whether a domain is configured for email operations; its primary evidence would be current MX answers with retrieval time and resolver provenance, not a documented query strategy and filtered findings connected to approved impersonation indicators as required here.

The time dimension links hostnames to infrastructure at relevant periods even if live DNS has changed; an auditor would need a documented query strategy and filtered findings connected to approved impersonation indicators instead to validate the actual method described.

The metadata enables reproducibility and reveals missing records caused by rate limits or service errors; this artifact has a different purpose and leaves the need for a documented query strategy and filtered findings connected to approved impersonation indicators unaddressed.

The DNS configuration can inform delivery-risk analysis while remaining distinct from proof of actual mail traffic; that evidence is sound for query authorized public DNS MX records, but the question asks for substantiation of a documented query strategy and filtered findings connected to approved impersonation indicators.

Dynamic addressing and shared hosting can create associations without common adversary ownership; this refers to a separate evidence problem, but the specific method in the question is weakened by the assumption "Treat every indexed profile about employees as necessary campaign evidence."

API access commonly has contractual, technical, and privacy constraints even for public information; the team should instead scrutinize the claim "Treat every indexed profile about employees as necessary campaign evidence," which directly undermines the current method.

Advertised mail infrastructure is capability evidence, not an observed sending event; although it is a legitimate concern elsewhere, the issue specifically exposed by this CTI task is "Treat every indexed profile about employees as necessary campaign evidence."

Passive DNS records previously observed DNS answers and associated times, enabling retrospective infrastructure correlation without active interaction with the domain; however, its validation depends on timestamped historical name-to-address resolutions with observation source, whereas this case turns on a retrieval log with query parameters, response dates, source identifiers, and failures.

Registration history can provide dates, registrar details, and exposed registrant fields, but privacy redaction and inaccuracies limit attribution; its primary evidence would be dated registrar and registration-change observations from an authorized source, not a retrieval log with query parameters, response dates, source identifiers, and failures as required here.

Targeted OSINT search supports a defined intelligence requirement, with filtering and lawful handling that avoid unnecessary personal-data collection; that workflow does not establish a retrieval log with query parameters, response dates, source identifiers, and failures, which is needed for the stated decision.

Traceable scoping makes the collection repeatable and demonstrates that unrelated data was excluded; this artifact has a different purpose and leaves the need for a retrieval log with query parameters, response dates, source identifiers, and failures unaddressed.

The timeline can support pivoting while explaining which fields were unavailable or unverifiable; that evidence is sound for review historical domain-registration records where lawfully accessible, but the question asks for substantiation of a retrieval log with query parameters, response dates, source identifiers, and failures.

The time dimension links hostnames to infrastructure at relevant periods even if live DNS has changed; the associated activity is to search a passive DNS history repository, so it does not establish a retrieval log with query parameters, response dates, source identifiers, and failures for the question at hand.

Advertised mail infrastructure is capability evidence, not an observed sending event; this refers to a separate evidence problem, but the specific method in the question is weakened by the assumption "Ignore provider rate limits because public APIs are unrestricted intelligence sources."

WHOIS or RDAP records can be redacted, fabricated, or registered through intermediaries; although it is a legitimate concern elsewhere, the issue specifically exposed by this CTI task is "Ignore provider rate limits because public APIs are unrestricted intelligence sources."

Search availability does not establish relevance or justify unlimited retention of personal information; the team should instead scrutinize the claim "Ignore provider rate limits because public APIs are unrestricted intelligence sources," which directly undermines the current method.

Dynamic addressing and shared hosting can create associations without common adversary ownership; here the concrete mistake is the unsupported assertion "Ignore provider rate limits because public APIs are unrestricted intelligence sources," rather than the alternative assumption.

Human reporting may be valuable but should be assessed for access, motivation, past reliability, and consistency with other evidence; its scope is distinct, since the required decision must be supported by dated interview notes distinguishing direct observations from speculation or hearsay.

Controlled virtualized analysis with restricted egress, snapshots, and safe transfer practices helps collect observations without propagating the sample; however, its validation depends on isolation configuration, snapshots, and controlled behavioral telemetry from the testbed, whereas this case turns on dated interview notes distinguishing direct observations from speculation or hearsay.

Honeypots deliberately expose a controlled decoy and can capture attacker interactions, but must not endanger production systems; that workflow does not establish dated interview notes distinguishing direct observations from speculation or hearsay, which is needed for the stated decision.

Controlled observations support behavioral analysis while showing the collection environment was contained; this artifact has a different purpose and leaves the need for dated interview notes distinguishing direct observations from speculation or hearsay unaddressed.

Independent corroboration raises confidence without making a single unidentified informant dispositive; it would validate another activity, while dated interview notes distinguishing direct observations from speculation or hearsay provides the relevant verification here.

Documenting the testbed reduces ambiguity about which observations came from the specimen versus the lab; the associated activity is to prepare an isolated malware-analysis test environment, so it does not establish dated interview notes distinguishing direct observations from speculation or hearsay for the question at hand.

Identity protection does not by itself determine accuracy; evidence and source history matter; this would be a problem when analysts corroborate the human-source claim with independent indicators, but the error linked to the requested step is "Ask leading questions that presuppose a specific threat actor was responsible."

A compromised decoy could otherwise become a pivot into live systems; the team should instead scrutinize the claim "Ask leading questions that presuppose a specific threat actor was responsible," which directly undermines the current method.

Unisolated execution may endanger production credentials and systems; here the concrete mistake is the unsupported assertion "Ask leading questions that presuppose a specific threat actor was responsible," rather than the alternative assumption.

HUMINT collection quality improves when questions are neutral, accounts are separated, and source limitations are recorded; its scope is distinct, since the required decision must be supported by a source assessment and independently collected observations matching key claim details.

A sinkhole can reveal infected clients attempting to contact malicious infrastructure, without needing to serve the attacker's commands; however, its validation depends on inbound connection observations with time, destination, and source-handling safeguards, whereas this case turns on a source assessment and independently collected observations matching key claim details.

Honeypots deliberately expose a controlled decoy and can capture attacker interactions, but must not endanger production systems; the associated observable result, decoy interaction logs with timestamps, source observations, and isolation controls, answers a different question from a source assessment and independently collected observations matching key claim details.

Controlled observations support behavioral analysis while showing the collection environment was contained; those observations support the separate task to use an isolated, authorized honeypot with containment and monitoring, rather than the needed record: a source assessment and independently collected observations matching key claim details.

The telemetry can help measure infection attempts while avoiding false claims that every source is controlled by one actor; the associated activity is to analyze sinkhole telemetry under approved handling and privacy rules, so it does not establish a source assessment and independently collected observations matching key claim details for the question at hand.

Recording how a witness knows a fact helps analysts corroborate details without overstating reliability; it would validate another activity, while a source assessment and independently collected observations matching key claim details provides the relevant verification here.

Documenting the testbed reduces ambiguity about which observations came from the specimen versus the lab; this artifact has a different purpose and leaves the need for a source assessment and independently collected observations matching key claim details unaddressed.