what do you suggest as a legit way of verifying a white list?