Operation KillSwitch OSINT Challenge Walkthrough

Introduction

In late September 2026, international law enforcement agencies executed Operation KillSwitch, dismantling the infrastructure and data leak operations of the KillSec ransomware syndicate. Among the individuals taken into custody was Fouad Eltibrizi, an operative known in threat landscapes under the moniker “Archduke”. While the public indictment focused on cybercrime charges, open source tracking revealed his parallel professional footprint as a Co-founder and Technical Lead of a UK-based sales development platform.

The primary objective of this investigation was to identify the official web domain of this commercial venture and determine its exact registration date.

Intelligence Pivoting and Entity Discovery

The challenge statement provided several key pivots: the subject’s legal name, Fouad Eltibrizi, his operational alias Archduke, and his involvement in a UK-based sales platform. Initial queries across UK corporate filing directories indicated past affiliations with dissolved entities, requiring a direct search across web indices to isolate active commercial footprints.

Targeted Google search operators combining the exact identity with the industry sector proved decisive:

"Fouad Eltibrizi" "sales"

The resulting index surfaced both reporting on the KillSec law enforcement actions and a commercial entity operating under the domain thecold.ai. The company’s partnership page explicitly identified the operational team, stating:

“TheCold.Ai is a trading name of Araf Perwaze and Fouad Eltibrizi.”

This established the direct link between the subject and the sales automation startup, confirming the required domain.

Domain Analysis and Registration Verification

With the target domain isolated, the final stage required extracting authoritative WHOIS metadata to determine the exact date of domain creation.

Querying the RDAP and WHOIS endpoints for thecold.ai provided the following registrar parameters:

• Domain Name: thecold.ai
• Registrar: NameCheap, Inc.
• Registered On: 6/27/2026
• Nameservers: glen.ns.cloudflare.com, liz.ns.cloudflare.com

Converting the registration timestamp into the required ISO standard notation yielded 2026-06-27.

Flag Capture

Combining the identified domain and its registration date into the specified format produced the final flag:

OSINT{thecold.ai_2026-06-27}