CTF Write-ups
Step-by-step solutions of 42 OSINT challenges from Bellingcat, OSINT Industries, UK OSINT Community, Gralhix and more: which clue led where, which tools were used and how the flag was reached.
GEOINT Write-Up: Krakow Shooter (OSINT Industries CTF)
Step-by-step solution of the Krakow Shooter GEOINT challenge from the OSINT Industries CTF: reading an address plaque, confirming the building on Google Maps and finding the nearby military gear shop.
Can You Find a Building Today from a Sketch Drawn Centuries Ago?
How a colorized drawing, a reverse image search, and Google Street View led me to a 500-year-old tower in northern Germany.
How to Identify and Verify Unexploded Ordnance Remotely: Technical Analysis of a Buried 40mm Projectile
Moving beyond generic media labels and leveraging open-source munition databases to distinguish subtle Soviet-era 40mm grenade variants.
The Digital Altar of Deceit: Unmasking an AI Priest Scam via Meta Ad Transparency
Online crowdfunding has unlocked unprecedented avenues for genuine charitable causes, yet it simultaneously empowers sophisticated threat actors to…
The Chinese Spy: Tracking a California Realtor from Real Estate Listings to the French Alps
In passive open-source intelligence (OSINT), an investigation rarely follows a straight line. Verifying identity consistency across personal profiles, news…
Hunting Ghosts at Sea: How Visual Feature Correlation and AIS Telemetry Solved a Maritime Tracking Case
Most writeups make OSINT look like a straight line from question to answer. In reality, it is a demanding process full of dead ends, deceptive sister hulls…
OSINT & GEOINT Challenge Write-Up: Florida Snow
The DEA briefing outlined that a cartel network (”Los Aztecas”) was smuggling cocaine shipments by sea from Florida into Spain or France. The informant…
Operation KillSwitch OSINT Challenge Walkthrough
In late September 2026, international law enforcement agencies executed Operation KillSwitch, dismantling the infrastructure and data leak operations of the…
Fairford Suspects: Geolocation Walkthrough
A challenge created by OSINT Newsletter tasked investigators with identifying the precise location where three suspicious vehicles were photographed.
Archival OSINT: Solving Bellingcat's "114. Birthday Bulletin"
In this investigation, we tackle Bellingcat’s Open Source Intelligence challenge titled 114. Birthday Bulletin. The prompt draws a parallel between modern…
Hunting the Narco Boss: Deconstructing Christy Kinahan’s Digital Footprint
In this investigation, we take on Bellingcat’s Open Source Intelligence challenge centered around Christopher Vincent Kinahan, the notorious head of an…
Tracking Internal Edits: Deconstructing Bellingcat’s "113. Anonymous Edits"
In this write-up, we tackle Bellingcat’s Open Source Intelligence challenge titled 113. Anonymous Edits. The challenge asks us to uncover the title of a…
Bellingcat Data Digging: Solving the 111. Country Collapse Challenge
The prompt for challenge 111, titled Country Collapse from the Bellingcat Data Digging series, presented an intriguing historical investigation:
Operation Cloudburst: Complete End to End Investigation Walkthrough
Operation Cloudburst unfolded across eight distinct operational phases. The investigation began with a simple physical venue identification, escalated into…
Phone Call OSINT: Deconstructing a Transcript to Solve Sofia Santos Exercise 19
TL;DR: By analyzing a fictional one-sided phone transcript from Sofia Santos Exercise 19, we narrow down the search area from national language policies to…
OSINT CTF: The Escape Tracking Down the Fugitive Architect
“The Escape” challenges analysts to track the open-source digital footprint of federal fugitive Tag Gilkeson (alias: Thomas Allen Gilkeson). Gilkeson cut…
Operation Illuminate: From Mediterranean Cliffs to Digital Footprints An OSINT CTF Write-Up
Combining geospatial intelligence (GEOINT), open-source investigation (OSINT), and digital archival forensics, the Operation Illuminate challenge series is…
OSINT CTF: Tracking the Syrian Arms Transport Vessel — "The Vessel"
In maritime tracking and intelligence analysis, vessels frequently undergo identity shifts—changing flags, ownership, and names—to obscure operational…
OSINT Case Study: Knife Attack in Times Square
Open-Source Intelligence (OSINT) often bridges the gap between breaking real-world news and meticulous product identification. In this walkthrough, I…
OSINT Industries CTF: Digital Footprints, Tattoos, and the Case of Alex Harkály
In this challenge, we investigated public OSINT data regarding HARKÁLY Alex, an individual featured on the Europol Most Wanted list for attempted murder in…
Fake Doctor: Tracing a Europol Fugitive Through Reverse Image Analysis
The objective was straightforward yet tricky: using an old blurred photograph provided by investigators (suspect.jpg), determine the exact name of the…
Geolocation Write-up: OSINT Exercise #030 by Sofia Santos (Gralhix)
The objective of OSINT Exercise #030 is to identify the precise geographic location of the large white emergency tent seen at the 1:16 mark of an October…
Operation Lutetia OSINT CTF Write-up
A complete investigative walkthrough covering the full geolocation (GEOINT), corporate footprint analysis, public records retrieval, and maritime tracking…
UK OSINT Community: Operation Levant – Stage 2: Elsewhere Write-up
After pinning down the initial coordinates along Passeig Esplanada d’Espanya in Alicante, the investigation shifted chronologically backward to trace Freya…
UK OSINT Community: Operation Levant – Point of Origin Write-up
In the September cycle of the UK OSINT Community Monthly Challenge, the investigative scenario opened with Case 26-0901: Operation Levant. The objective was…
Bellingcat CTF #106: Shifting Sands — Walkthrough
The challenge presents an aerial satellite capture of barren desert terrain marked with faint perimeter markings:
OSINT Walkthrough: "Never Deleted" (OSINT Industries) – Tracking a Threat Actor via Malware Sandboxes
In this OSINT Industries challenge titled “Never Deleted”, the objective was to trace the digital footprint of a known threat actor operating under the…
Tracking the Origins of Atmeh Camp: Bellingcat Challenge #107 Walkthrough
Solving Bellingcat’s GEOINT challenge #107, Internal Displacement, proved to be an exercise in spatial awareness, regional land-use analysis, and rigorous…
Challenge 47: Hidden Message Part 3 (Hard) — Walkthrough
The challenge description highlighted leaving traces behind through sound, signals, and hidden messages within an audio waveform
OSINT Exercise #015 Walkthrough: Declassified CIA Records & Historical Geolocation
Sofia Santos’s OSINT Exercise #015 presents a screenshot of a declassified CIA Caption Report documenting an undisclosed photograph taken by an intelligence…
CTF Walkthrough: READONLY — The Mind Behind The READONLY Archive
In this walkthrough, we will break down the complete end-to-end solution for the READONLY CTF challenge. The challenge involves multi-layered QR…
OSINT CTF Walkthrough: Tracking a Most Wanted Fugitive Using Passive Intelligence
In this walkthough, I will break down the passive Open Source Intelligence (OSINT) methodology used to locate two critical missing data points regarding a…
OSINT Challenge Walkthrough: 14 December – The Santa Flight
The task presents an image inside a passenger cabin filled with people dressed as Santa Claus. The prompt asks to identify the airline, make, and model of…
Bellingcat OSINT Challenge: The Frozen North — Step-by-Step Walkthrough
Pinpointing a vessel in the Arctic via solar chronolocation (SunCalc), filename metadata extraction, and Sentinel satellite imagery.
OSINT CTF Walkthrough: Uncovering a Natural Phenomenon via Digital Footprints (Rayon Vert)
In this OSINT challenge, our goal was to identify a specific natural phenomenon photographed and published by an individual named Kevin Rocher on his blog…
Bellingcat OSINT Challenge Walkthrough: Touching Tarmac
In this writeup, I break down the solution for Challenge #86, “Touching Tarmac,” from Bellingcat’s Above and Beyond series (created by Logan).
CRIMINAL PARTNERS (OSINT Industries CTF)
In this challenge from the OSINT Industries CTF, we investigate a scenario involving high-profile Swedish fugitives Tania Gomez and Armin Moini. The…
Financial Intelligence: Tracking Ransomware Payouts from Network PCAP to Blockchain Attribution
In financial intelligence (FININT) and cyber investigations, tracing the flow of illicit funds frequently requires bridging the gap between network-level…
Attack Surface Mapping & Brand Integrity Analysis: A Passive OSINT Framework
In modern digital ecosystems, maintaining visibility over an organization’s external attack surface and protecting brand reputation from typosquatting are…
95. Remnant Recovered
Physical remnants recovered from conflict zones provide data as concrete and objective as digital footprints. In this article, we examine step-by-step how a…
Uncovering the Batter Behind the Foul Ball: An OSINT & GEOINT Walkthrough
In Open Source Intelligence (OSINT) and Geospatial Intelligence (GEOINT), video and image verification often relies on picking up subtle clues in the…
Secretlocation OSINT CTF Write-Up
Hi friends! Today I’m sharing how I solved “secretlocation”, a fun OSINT/CTF challenge on the ctf.osint.industries platform. At first…