Operation Costa

May 2026 · OSINT UK CTF · 12 challenges

The Intercept (3pts)

We are beginning our analysis with the device’s communication logs. Forensics pulled this recent WhatsApp exchange between the fugitive and a known local associate. We suspect the fugitive was confirming the placement of a primary emergency stash in Alicante city since feeling that we were getting closer to locating him. However, we cannot understand what the messages say.

Task: Decode the conversation and provide the referenced location of the bag.

Answer Format:

Use the osintuk{answer} format.

Replace any spaces with underscores.

Retain special characters, tilde/accent characters etc.
e.g. osintuk{castillo_de_santa_bárbara}

And we’re off to the races with another CTF challenge. This first one appears to be in some form of corrupted Spanish.

After looking a bit closer, I noticed the addition of multiple ‘f’s throughout messages. Upon closer inspection, these F’s appear to be followed by a duplicate vowel preceding the F.

By removing the surplus ‘f+vowel’ combinations from the messages, we get this (sans accents, due to keyboard restrictions):

Spanish: ‘Ya escondí la bolsa en la estacifión de tren..’/’Perfecto. No la toques!’ English: ‘I already hid the bag at the train station.’/’Perfect. Don’t touch it!’

To get the correct flag, we simply need to remove the preposition ‘la’.

Flag: osintuk{estación_de_tren}

The Footprint (3pts)

Tactical teams successfully intercepted the primary stash at the Alicante train station lockers before it opened. The bag contained emergency cash and a forged passport. His resources are now severely limited. We must pivot back to the device’s camera roll to map his physical footprint over the last few days and identify where he might be hiding.

We are reviewing the device’s camera roll to establish the fugitive’s recent whereabouts. This image of a meal was recovered. To build a profile of his movements and potential companions, we need to interview the staff member who interacted with him during this transaction.

Task: Confirm the name of this restaurant and identify the first name of the employee who served the fugitive.

Answer Format:

Use the osintuk{answer} format.

Replace any spaces with underscores.

Separate the restaurant and employee names by an underscore.
e.g. osintuk{Burger_King_Julian}

Thoroughly enjoying the unexpected Madagascar reference in the example flag here.

A cursory look around the image gives us the latter part: ‘YURENA’ is printed prominently on the seat as having been the server for the table.

By screen-capping and rotating the plate’s logo, we can get partial insight as to what the venue may be. ‘100 …aditos’ Googling this is enough to find ‘100 MONTADITOS’, an Alicante-based restaurant.

Flag: osintuk{100_Montaditos_Yurena}

The Target (6pts)

The forensics team recovered a text file on the fugitive’s device containing nothing but the following alphanumeric string: 0110 CMN

We suspect this is a vehicle registration number associated with a company that our subject was interested in.

Task: Identify the name of the company that uses this vehicle.

Answer Format:

Use the osintuk{answer} format.

Enter the name as it’s written on the vehicle.
e.g. osintuk{Iberdrola}

The UK has number plate lookup services for tax and MOT information. While I don’t know what the Spanish equivalent would be, it’s reasonable to assume that something similar exists.

I wanted to start by getting baseline information on the number plate, so I simply ran it as a quoted string (“0110 CMN”) through Google. This led to website called ‘Metriculas del Mundo’, which showed the ‘CMN’ number plate as being registered in October 2003. While not helpful for here, I decided to keep this separate in case it turned out to be useful for a future flag.

The website also pointed out the number plate as being registered as a national plate in Spain rather than any form of provincial plate. This is a nudge toward checking national registers rather than region-specific ones.

I tried simply Googling ‘look up Spanish number plate’, and found a useful free checker just a few results down. This necessitated sorting through a few other paid or credential-access-only portals first. I settled for AutoInfo.

However, I hit a snag.

AutoInfo’s report lists the vehicle as being a ‘MAN’ truck, L 2000. It also lists the year of production as 1994, which seems unlikely if the number plate itself was registered in 2003. Sure enough, entering ‘osintuk{man}’ or ‘osintuk{man_l_2000}’ as the flags doesn’t succeed. Something’s not quite right here.

So far, it’s clear that:

Official portals need payment or credentials
Unofficial portals might not get the correct result
We need to try something else.

I’ve had some success in previous investigations with plate-spotting communities, and decide to try my luck there. A simple Google search for plate spotting websites brings up PlatesMania. Once registered, you can search for number plates in the top-right.

Bingo!

The challenge asks us to write the vehicle make as written on the vehicle. Rather than overcomplicate this, I simply went for ‘Prosegur’, which checked out.

Flag: osintuk{Prosegur}

The Routine (7pts)

We have alerted the relevant parties to ensure that the fugitive is not able to launch any of his criminal plans.

The forensics team has come back with another image they want you to look into that may help to identify a frequented location.

The attached photo appears to have been taken inside a gym with the view of a road outside.

Task: Identify the name of the gym brand and the name of the nearest bus stop on the same street as the gym entrance.

Answer Format:

Use the osintuk{answer} format.

Replace any spaces with underscores.

Replace any hyphens/dashes with underscores.

Separate the gym name and the bus stop name with an underscore.

Retain special characters, tilde/accent characters etc.
e.g. osintuk{Planet_Fitness_San_vía_Fernando}

A quick check of the image shows this to be the Number 6 bus in Alicante. Looking deeper still, we can see the word ‘MATRIX’ written back to front, in white text on a black background. Could this be the name of the gym, or a nearby storefront, that could lead us to the location?

A quick Google search confirms ‘Matrix Fitness’ to be a sports machine equipment provider as opposed to a gym itself, but the size of the logo on the bus implies the gym might double as a retailer.

Searching for ‘“Matrix” gym “Alicante”’ indicates a gym called ‘BasicFit’ in Alicante as using Matrix equipment.

Very interesting. I decided to run with this. I searched on Google Maps and found only 3 Basic Fits in the city, which is sufficient for cross-referencing with online maps of the No. 6 bus route, which is available here.

After following the route along, only one appears to be on the route - on C. Alonso Cano. A quick Street View check verifies the location as matching the description.

All we need to do then is click on the bus stop to reveal its name as ‘Cano-vía Parque’. Eight points well-earned.

Flag: osintuk{Basic_Fit_Cano_vía_Parque}

The Spectacle (7pts)

We are continuing to map the fugitive’s movements through the city centre. Forensics recovered a short video file from the device’s deleted folder. The fugitive stopped to film this street performance. We need to identify the performers to see if they can provide any additional footage of the surroundings that day which might include movements of the fugitive.

Task: Review the video evidence. Identify this specific street dance crew and provide their exact official handle/username as used on their primary social media platforms.

Answer Format:

Use the osintuk{answer} format.

Provide the exact username (do not include the @ symbol).
e.g. osintuk{alicante.dancers.official}

With this being a video, my first instinct was to transcribe the audio. I used TurboScribe to get the transliterated Spanish. Unfortunately, this didn’t provide any help.

After that, I started looking at the video itself. The dancers all (kindly) have a prominent logo on their back and broadly matching dress: white bandana (mostly), and black t-shirts.

The video shows the crew as doing breakdance, so I simply Googled ‘bboys Alicante’. The first result happened to bring up a match.

Flag: osintuk{ninjasquad.ofi}

The Unregistered Basin (4pts)

We have tracked the fugitive to a secondary hideout: the abandoned 19th-century estate known as “Finca Palmeretes” in Sant Joan d’Alacant. While reviewing the official Spanish property registry for structural vulnerabilities, we noticed an anomaly.

There is a distinct rectangular basin on the northeastern edge of the parcel. However, because of the property’s age and abandoned status, this basin is not officially classified as a swimming pool on the registry’s structural breakdown. We suspect the fugitive is utilising this unmapped structure as a dead drop. We need its dimensions to brief the tactical team.

Task: Locate Finca Palmeretes on the official Spanish property register map. Using the registry’s built-in functionality, provide the estimated surface area in square metres for the pool outline.

Answer Format:

Use the osintuk{answer} format.

Round your measurement to the nearest whole integer (no decimals).

Do not include ‘m2’ or ‘metres’ in your answer.
e.g. osintuk{16}

“Finca Palmeretes” in Sant Joan d’Alacant.

The first step is to find the Spanish property register. After a quick Google search, I found its Spanish name: ‘Catastro’. I then searched for ‘Catastro espana cadastre’ which led to a Spanish land registry mapping portal.

Clicking on the map allows for searches to be conducted free of charge. The first option asks for the cadastre number of the property, which I don’t have. However, it also allows for searching by geographical coordinates.

I got the coordinates by navigating to the property on Google Maps and right-clicking. I then inserted them into the portal to bring up the land registry map view for that address.

As per the challenge, we’re interested in the rectangular parcel in the North-West of the property boundary. The goal is to find its size in square metres. The mapping tool has a <-> symbol in the bottom left, which allows for m2 measurements to be taken.

I used this tool to get the measurements for the area: 48m2.

Flag: osintuk{48}

The Rendezvous (9pts)

Our forensics team extracted an unread voice note delivered to the device shortly after the raid. The sender, a known associate saved in the contacts as “Lucky Kev”, appears to be confirming a rendezvous for this evening, entirely unaware that the fugitive is on the run and the device is in our possession. We need to intercept this associate.

Task: Analyse the provided audio file. Identify the name of the establishment where “Lucky Kev” is going to be waiting.

Answer Format:

Use the osintuk{answer} format.

Replace any spaces with underscores.

Provide the primary brand name of the establishment.
e.g. osintuk{KFC}

Unlike my attempt with the Ninja Boys, the supplied .mp3 seems very appropriate for TurboScribe. The website’s able to transcribe the Spanish, and the adjacent Google Translate button gives the English translation hassle-free.

It’s hard to say what the ‘usual rock spot’ is. The example flag gives KFC, a restaurant. Following that thread, my guess is ‘Hard Rock Cafe’. It was worth a try, but sadly incorrect.

That said, we still have some threads left to pull. ‘Lucky Kev’ was a character in Benidorm, for example. I kept this to one side, and looked at the English translation - and the challenge - a bit closer.

We know the characters in this story to be based in Alicante. It’s implausible for a fugitive on the run to be travelling internationally. I went back to Alicante to see if these place names, Holanda and Londres, might feature in Alicante proper.

Turns out they do. Aha. Now we’re getting somewhere. With this in mind, I started looking at rock bars around Londres, Alicante. Zooming in to the Londres stop reveals ‘Rock Bar Frontera’, which resolves to be the flag.

Flag: osintuk{Rock_Bar_Frontera}

The Dashcam Lead (5pts)

During interrogation, “Lucky Kev” was cooperative but unable to recall the make, model, or registration of the fugitive’s primary vehicle. However, he surrendered a photograph taken approximately one week prior to the raid, capturing a moment when he was travelling with the fugitive.

Analysts identified a distinct vehicle—a Mini Countryman—in the frame. We need to identify this vehicle registration plate to request potential dashcam footage from the owner that may have recorded the fugitive’s vehicle or movements on that day.

Task: Review the visual evidence provided by the associate. You must determine the complete, official Spanish registration plate of the Mini Countryman.

Answer Format:

Use the osintuk{answer} format.
e.g. osintuk{1234_ABC}

The earlier licence plate clue and example flag both give the format here, showing two letters as being required to get the full number plate. We can see ‘-10 JJC’ clearly, and the styling on the character to the left of the 1 indicates it as being a 7. ‘-710 JJC’.

This alone is sufficient for brute forcing. We have a 1 in 10 chance of guessing the correct flag. I started with ‘1710 JJC’ as a guess, and struck lucky! By nothing more than dumb luck, that resolved the challenge.

I expect there’s a better way to find the answer with concrete proof, but I wasn’t able to find it quicker than I could guess it. If you’re aware of a better way to tackle this, please leave a comment, or contact me at contact@veiledathena.com.

Flag: osintuk{1710_JJC}

The Dead Drop (10pts)

While reviewing the device’s photo gallery, investigators found this image saved in an album titled “Important”. We suspect it may relate to the fugitive’s secondary go-bag.

Task: Review the provided artefact. Identify the primary name of the main structure nearest to where this go-bag is hidden.

Answer Format:

Use the osintuk{answer} format.

Replace any spaces with underscores.
e.g. osintuk{Cruz_de_Benidorm}

The image appears to have been ‘soft redacted’ rather than hard redacted, meaning that editing the image’s brightness and contrast may well be enough to reveal the information underneath. Taking it to Forensically or using any other program to edit the brightness reveals further information at the top.

MERCADONA. S.A. A-46103834

‘Mercadona’ is a store brand in Spain. Their website has store locations listed and can be queried by location. It shows Alicante as having ~13 stores.

I unfortunately don’t have any indication of what the ‘main structure’ nearby could be, but I keep this in the back of my mind. The receipt contains the date, time, and ‘factura simplificada’ information on it. I suspected the latter might provide a store number, and wondered if that could be queryable. After searching around, I found a Mercadona link with advice on requesting an invoice from receipt details. This in turn led to the Customer Invoice Portal. Clicking Spain gives the word ‘Factura’, which I take as a sign to mean I’m on the right path.

After following this avenue further, I’m able to get to a point where I can - in theory - input the values on the receipt to get a furnished invoice. My thinking is that, by doing so, I might be able to get the correct store. Unfortunately, the drop-down box under ‘Solicita tu factura’ doesn’t contain any options, and after a lot of trial and error I ultimately found this to be a dead end.

Going back through the receipt however, I noticed something odd: the prices. Azafran (Saffron) should not cost 77 EUR for two grams. A selection of sweets shouldn’t cost 52 euros, either.

Looking closer, these appear to be coordinates.

I had to try various iterations to get it exactly correct, but soon worked out that Spain’s long coordinate is a very low number. Eventually I concatenated the two in the following way:

38.84251955499604, 0.10770246865256343042640

Searching for this on Google Maps leads us to Castell de Dénia, which both matches the example flag and solves the challenge.

Flag: osintuk{Castell_de_Dénia}

Escape Routes (3pts)

The coordinates decoded from the grocery receipt point directly to the coastal town of Dénia. Because the secondary stash at the castle was empty upon our arrival, we must assume the fugitive acquired the emergency cash and forged documents before we could intercept him.

Given his resources, we believe he is making a desperate attempt to flee the mainland via the town’s major commercial passenger ferry terminal. To intercept him, we need to urgently subpoena the passenger manifests from the primary ferry operator headquartered at this port to check for his new alias.

Task: Identify the dominant passenger ferry company headquartered at the port of Dénia. To execute the legal warrant for their passenger logs, find and provide the company’s official Spanish corporate tax identification number (CIF).

Answer Format:

Use the osintuk{answer} format.

Provide the exact alphanumeric CIF string (no spaces or hyphens).
e.g. osintuk{B12345678}

Upon successfully executing this warrant and identifying the alias, local authorities will have the necessary jurisdiction to ground the vessel and take the fugitive into custody. Once this final piece of intelligence is secured, you can consider this manhunt officially closed.

Continuing from our last challenge, zooming in to Denia Port quickly identifies ‘Baleària Port Dénia’ as being the main ferry terminal. The listing also gives the terminal’s website.

A dummy search on the company website shows ‘Balearia’ to be the main ferry operator rather than just the port name.

With this identified, heading to the bottom of the Balearia website and clicking ‘Legal EN’ takes you to the company’s legal page, where we can find the CIF number.

Flag: osintuk{A53293213}

SIDE QUEST: Restricted Access (4pts)

Task: This particular 100 Montaditos requires a code to enter the bathroom. You must identify the code.

Answer Format:

Use the osintuk{answer} format.

Enter all required characters.
e.g. osintuk{678421*}

While this looked worrying from the offset - ‘Which 100 Montaditos was it?’ - a cursory look back at the receipt gives the answer in plain sight.

Flag: osintuk{504379#}

SIDE QUEST: Coastal Reconnaissance (5pts)

While indexing the remaining files in the device’s camera roll, analysts found this photograph of a metallic bull with an island visible between the horns.

Task: Review the photo and identify the popular old name in English for the island visible in the background.

Answer Format:

Use the osintuk{answer} format.

Replace any spaces with underscores.
e.g. osintuk{Alcatraz_Island}

I had a cursory look at the island in the image to make a note of its size, and then went along the coastline to find a match. This saved time conducting reverse image searches on the bull, and made more sense given how few islands exist around Alicante.

Doing so leads to Benidorm Island. This ties in with the ‘Lucky Kev’ find earlier, who is a character from the Benidorm TV show. Wikipedia lists the name as ‘Benidorm island’.

‘Benidorm Island’ surprisingly isn’t the flag. The challenge mentions a ‘popular old name’ in English. Searching for this brings up a Facebook thread naming it ‘Peacock Island’ instead, which resolves to be the flag.

Flag: osintuk{Peacock_Island}

SIDE QUEST: The Island Ceremony (3pts)

Task: Identify the first names of the couple who had a popular televised wedding on Peacock Island.

Answer Format:

Use the osintuk{answer} format.

Name the bride, then groom separated by an underscore.
e.g. osintuk{Janice_Mick}

Googling ‘Peacock Island televised wedding’ brings up ‘Joyce’ and ‘Monty’ as having been married there. The ‘JM’ theme fits the example flag, and is the answer here accordingly.

Flag: osintuk{Joyce_and_Monty}

SIDE QUEST: The Coastal Façade (5pts)

As we continue to analyse the camera roll imagery from the fugitive’s device, our team identified an unusual photo of an individual wearing a t-shirt with the Policía Nacional logo on it.

Task: Review the image and identify the official building number from the address of the building circled in red.

Answer Format:

Use the osintuk{answer} format.

Provide only the integer value.
e.g. osintuk{64}

The image supplied has ‘La Vila Joiosa’ next to the red-circled building, which is enough of a starting point to go straight to Google Maps.

This correlates to the name of the town - ‘La Vila Joiosa’ - which lies a short trip away from Alicante. After that, I simply searched for ‘colourful houses la vila joiosa’, which brought me to ‘Les Cases de Colors’ on Google. The promenade attached to the street matches the tiling seen in the supplied photo.

I then went to Google Street View and found the same area. Zooming in on the target house shows its number: 5.

Flag: osintuk{5}

SIDE QUEST: Financial Audit (6pts)

Task: Based on the photo from 100 Montaditos, how much money was spent purchasing what was on the table?

Answer Format:

Use the osintuk{answer} format.

Do not include the euro currency sign.
e.g. osintuk{6} e.g. osintuk{14.71}

The menu itself, while handy, is obscured. It shows a two-for-one deal on Raciones, but the drinks look suspiciously priced at just 1 euro each. Rather than rely on the menu alone, I decided to look for copies of it online. I found several menus on Tripadvisor.

These searches confirmed both meals to be on the ‘Raciones’ menu, and - better yet - that the discount only applies on Thursdays (Jueves). According to Exif data, the image was taken on 26th February 2026. This was a Thursday, so the discount applies.

By pursuing the menu hunt further, I found the drinks priced at 1.5eur each, taking the final bill to 10 euros.

Flag: osintuk{10}