Operation Cloudburst: Complete End to End Investigation Walkthrough

Overview

Operation Cloudburst unfolded across eight distinct operational phases. The investigation began with a simple physical venue identification, escalated into an extensive human intelligence tracking workflow across multiple social platforms, decoded digital account structures, uncovered scheduled defense conferences, and reconstructed an entire intercity rail transit timeline leading straight to the destination terminus in Wales.

Part 1: Geolocation at The Hawks Nest

The operation commenced with an indoor social venue photograph provided by the task system. The objective was to determine the exact establishment where the scene took place.

A reverse image search immediately identified distinctive interior features including the exposed brick layout, the overhead timber framework, and ambient decorative greenery. The matching public imagery verified the establishment as The Hawks Nest, located in Shepherd’s Bush, London.

• Verified Location: The Hawks Nest, London

Part 2: Across the Board

The second phase supplied a high resolution portrait photograph capturing a man seated across a chessboard inside the venue. The objective was to establish his complete legal identity.

A preliminary visual review of the chess table revealed a small QR code sticker adjacent to the rank numbers. Because image scanning attempts on the code yielded unreadable results, the search pivoted toward open source human intelligence.

Navigating to the official Instagram profile of The Hawks Nest exposed community interactions with a grassroots organization known as @sayitwithyourchessss. Reviewing the event catalog of this organization uncovered additional photography from their recurring sessions, confirming the same individual playing chess at the venue.

A close inspection of the subject’s clothing in secondary event media identified custom branded streetwear bearing the logo “@rose.n.chrome”.

osintuk{benjamin_ohen}

Part 3: Social Footprinting and Full Name Resolution

Investigating the tag @rose.n.chrome on Instagram exposed a dedicated business account showcasing custom dental grillz and bespoke jewelry craftsmanship.

The handle rose.n.chrome was subsequently queried through the OSINT profiling utility fingerprint.to. The query surfaced an active TikTok profile operating under the identical moniker. The creator had posted a chronological video titled “Here’s a lil look at my journey becoming a grillz artist”, providing clear facial verification matching the chess player.

Profile cross references within the account pointed to the owner’s personal TikTok handle, @bigzxvi, which carried the bio note “@Rose n Chrome Tap in”.

Examining the media timeline of @bigzxvi revealed a clip tagged #bigsister, capturing the target alongside his sister. The comment interactions led directly to her private Instagram handle, @judithohen.x. This critical familial link established the shared surname as Ohen.

To resolve the given name, the username bigzxvi was analyzed through fingerprint.to. The platform indexed multiple personal services:

1. An active Depop store belonging to bigzxvi listed the display name Benjamin.
2. A Revolut profile registered under revolut.me/bigzxvi confirmed the name Benjamin O.
3. Connected accounts on Chess.com and Lichess under bigzxvi substantiated the target’s authentic chess background.

Part 4: Who Runs the Night?

The next assignment shifted attention to the organizer behind the chess community events. The prompt tasked us with identifying the individual operating the venture and obtaining their unique numeric Instagram profile ID.

Examining the bio and post credits on the @sayitwithyourchessss profile identified the founder and primary organizer, known on Instagram as @donaleeee (Dona Lee / Donalee).

To retrieve the permanent numeric identifier rather than the display handle, the profile page was accessed directly via web browser. By viewing the page source source code, a simple query for profile_id and user_id located the backend account metadata:

osintuk{329371303}

Part 5: On the Move

The narrative advanced to Tuesday, 29 September at 11:25 with the arrival of a video file recorded inside an expansive exhibition hall. The objective was to determine the official name of the trade event.

Video frame analysis highlighted two major intelligence anchors:

1. The distinctive arched iron roof ribs and glass barrel vault architecture, fully characteristic of the Grand Hall at Olympia London.
2. An elevated corporate exhibition sign at second four displaying D-FEND, representing the airspace protection firm D-Fend Solutions.

Cross referencing the calendar schedules for Olympia London during late September revealed the flagship gathering occupying the Grand Hall on those exact dates: International Security Expo.

osintuk{international_security_expo}

Part 6: Secondary Lead at Northumberland Avenue

Physical surveillance evidence surfaced a handwritten memo recording the address: 8 Northumberland Ave, London, 5th Oct.

Researching scheduled conferences for the Victorian venue at 8 Northumberland Avenue on 5 October confirmed the scheduled session: The Global OSINT Conference, organized under osint.uk.

Part 7: Leaving London

On Wednesday, 30 September, a new photograph taken from inside a train compartment documented a train station platform through the passenger window. The objective was to identify the exact railway station.

The image captured a live Customer Information Screen displaying the following technical payload:

1. Platform designation: Platform 2
2. Approaching service: 13:58 London Paddington
3. Next calling point: Calling at: Reading
4. Digital clock: On time 13:52:08
5. Architecture: Traditional Great Western Railway green and cream valance woodwork

Because the train displayed on the screen was destined eastward for London Paddington and called immediately at Reading, the subject’s train was sitting at a major junction station located west of Reading along the Great Western Main Line. Checking Great Western Railway branch timetables for a 13:58 Paddington departure on Platform 2 verified the station beyond doubt as Didcot Parkway.

Flag: osintuk{didcot_parkway}

Part 8: Which Train?

The investigation required identifying the precise scheduled departure time from London Paddington in 24 hour HH:MM format for the specific train occupied by the subject.

The onboard photograph established that the train was positioned at Didcot Parkway at 13:52:08. Querying the Realtime Trains historical database for services originating at London Paddington on 30 September 2026 isolated service 1B16 operated by a Great Western Railway Class 800 Intercity Express Train.

The operational record revealed the schedule:

• Service Headcode: 1B16
• Route: London Paddington to Cardiff Central
• Working Timetable departure from London Paddington: 13:15
• Actual logged departure: 13:14 and a half
• Scheduled passage through Didcot Parkway: 13:52

The official scheduled departure time was confirmed as 13:15.

• Flag: osintuk{13:15}

Part 9: End of the Line

The final chapter tracked the target to the end of the line following an afternoon arrival photograph. The task was to place a geographic pinpoint at the exact spot where the photo was captured.

Because train service 1B16 is a direct westbound Great Western Railway trunk service terminating at Cardiff Central in South Wales, the terminal search focused on Cardiff.

Visual clues in the disembarkation photo corroborated the Welsh destination:

1. Bilingual transit barrier posters showing the Welsh phrase “Gyda thocynnau trên” above “With rail tickets”.
2. The modern glass facade of the BBC Cymru Wales building in the immediate background.
3. The historic domed clock tower of the Cardiff Central railway station entrance.

The perspective aligns directly in the pedestrian plaza of Central Square situated immediately outside the principal entrance of Cardiff Central Train Station.

• Coordinates: 51.4764, -3.1790
• Location: Central Square, Cardiff Central Train Station,

Connect & Follow

Thank you for reading this investigative case study. For more OSINT write-ups, digital forensics workflows, and geolocation breakdowns, feel free to connect across my channels:

• LinkedIn: https://www.linkedin.com/in/alp-akci%C4%9Fer-738467162/