Fake Doctor: Tracing a Europol Fugitive Through Reverse Image Analysis
Bu çözümün Türkçesi de var: sağ üstten dili TR yapın.
A huge thanks to OSINT Industries for creating this real-world, highly engaging challenge. The scenario centers on Andrea Sánchez Antelo, an individual featured on Europol’s Most Wanted list for practicing medicine without a license and forging public records across Spain.
The objective was straightforward yet tricky: using an old blurred photograph provided by investigators (suspect.jpg), determine the exact name of the hospital where she completed her medical residency—submitted strictly in the local language.
The Text-Search Rabbit Hole
The investigation began by querying the suspect’s full name directly: sanchez antelo, andrea.
The search immediately populated Europol’s official fugitive file, alongside numerous Spanish news outlets detailing her criminal career across A Coruña, Lugo, and Madrid.
Regional outlets like Faro de Vigo and La Voz de Galicia painted a chaotic picture: the suspect had stolen lab coats from university facilities, issued fake prescriptions via Sergas blanks, worked illegally at eldercare centers like DomusVi in Lugo, and posed as a practitioner at Complexo Hospitalario Universitario A Coruña (CHUAC).
Because she had operated under aliases and falsely associated herself with multiple hospitals and clinics throughout northwestern Spain, relying solely on text-based investigative reports created a massive dead end. Every article named a different medical center.
Pivoting to Reverse Image Search
To cut through the noise, the focus shifted entirely to the primary source artifact: suspect.jpg.
Despite the blurred faces of the other individuals in the frame, the background stonework and lanyards offered clear context. Running the image through Google Reverse Image Search produced an immediate, unblurred hit from Asomega (Asociación de Médicos Gallegos).
Extracting the Flag from the Source
Navigating directly to the host article revealed the original photograph, accompanied by an explicit editorial caption that solved the case.
The caption underneath read:
“José María Eiros, primero por la izquierda, al lado de Miguel Cabanela y un grupo de residentes del Hospital de La Princesa de Madrid junto a su jefe de Servicio y presidente de Asomega, Julio Ancochea, en una imagen tomada en el I Encontro Mundial de Médicos Galegos celebrado en 2019.”
Translation:
“José María Eiros, first on the left, next to Miguel Cabanela and a group of residents from the Hospital de La Princesa de Madrid together with their Head of Service and president of Asomega, Julio Ancochea, in an image taken at the 1st World Meeting of Galician Doctors held in 2019.”
While her public court cases emphasized offenses in Galicia, the photographic evidence tied her residency directly to Madrid. Applying the required local-language format confirmed the final flag:
OSINT{Hospital_de_La_Princesa}Key Takeaway
When dealing with serial fraudsters whose public records span multiple locations, news coverage often introduces excessive noise and false leads. Rather than chasing every mentioned institution in print, anchoring the investigation directly to the original visual artifact through reverse image search bypasses journalistic ambiguity and points straight to ground truth.
Connect & Follow
If you enjoyed this breakdown and want to explore more OSINT investigations, CTF walkthroughs, and research notes, feel free to connect:
- LinkedIn: linkedin.com/in/alp-akciğer
- Substack: substack.com/@alpakciger
- GitHub: github.com/alpakciger
Originally published on Substack