OSINT CTF Walkthrough: Uncovering a Natural Phenomenon via Digital Footprints (Rayon Vert)

In this OSINT challenge, our goal was to identify a specific natural phenomenon photographed and published by an individual named Kevin Rocher on his blog on July 14, 2010. Below is the step-by-step investigation path taken to pivot through the target’s digital footprint and extract the final flag.

Challenge Overview

• [OSINT4Fun — Natural Phenomena https://en.osint4fun.eu/challenge/natural-phenomena
• Un phénomène naturel
• Les phénomènes naturels peuvent être bluffants et nécessitent parfois des recherches scientifiques avancées pour les expliquer. Mais ils peuvent être observés par n’importe qui.
• Kevin Rocher a été témoin de l’un de ces phénomènes naturels lors de ses vacances. Il a posté une photo le 14 juillet 2010 sur son blog.
• Quel était ce phénomène ?
• Format de la réponse : Aurore boréale
• Target Name: Kevin Rocher
• Target Date: July 14, 2010
• Target Asset: Personal blog post containing a photograph of a natural phenomenon

Step 1: Initial Identity Search & Portfolio Discovery

Starting with the real name Kevin Rocher, an open web search quickly led to his primary personal portfolio:

[https://www.kevin-rocher.fr/](https://www.kevin-rocher.fr/)

The homepage identified him as a freelance Front-End Developer based in Paris.

Step 2: Contact Page & Social Media Footprint

Navigating down to the “ME CONTACTER” section revealed several external social icons (GitHub, LinkedIn, Twitter, Instagram, Mastodon, and Keyboard/dotfiles).

The icon positioned right next to Instagram immediately stood out: the distinctive elephant logo of the decentralized social network Mastodon (Fediverse).

Step 3: Pivoting via Mastodon Profile

Following the Mastodon link redirected to his Fediverse instance profile:

[https://piaille.fr/@darklg](https://piaille.fr/@darklg)

Analyzing this profile provided two crucial pieces of intelligence:

1. Primary Online Alias/Handle: Darklg
2. Dedicated Personal Blog URL: darklg.me (explicitly listed under his bio metadata next to his portfolio link)

Step 4: Accessing the Target Blog (darklg.me)

With the alias and active blog URL confirmed, navigating directly to [https://darklg.me/](https://darklg.me/) brought up the Darklg Blog homepage, hosting technical and personal write-ups.

Step 5: Chronological Archive Navigation

The challenge specified a publication date of July 14, 2010.

Browsing the blog’s historical pagination / archives back to the 2010 entries revealed a post published on the exact target date:

• Date: 14 juillet 2010
• Title: Rayon vert
• Snippet: “J’ai ramené de mes dernières vacances ( Décembre dernier, oh yeah ) une photo d’un…”

Step 6: Post Verification & Flag Extraction

Opening the full article ([https://darklg.me/rayon-vert/](https://darklg.me/rayon-vert/)) revealed the complete write-up and the attached photograph of a green optical flash at sunset over the sea horizon.

The post explicitly describes the phenomenon:

“J’ai ramené de mes dernières vacances… une photo d’un phénomène optique assez rare : Le Rayon vert. Il peut être observé durant les dernières secondes du coucher de soleil…”