VeiledAthena
Operation Gambler
The Destination (5pts)
Date: 09/04/2016
Time: ##:##:##UK Customs alerted us of a flag being triggered within their database. Their intelligence suggested that a passenger has entered the UK who is known for multi-million pound financial crimes.
Due to a mix-up with the response team that day, the suspect managed to slip out before being apprehended. Luckily, the team in the control room managed to note down the license plate of the vehicle he left in.
The vehicle has driven past traffic cameras showing the direction of travel. The first camera activation of the vehicle is at coordinates [52.242611, -0.948806].
Follow the directions below to identify where the vehicle stopped:
- Vehicle identified travelling North from coordinates: 52°14’33.4”N 0°56’55.7”W
- Followed the road as it curved round to the left.
- Right on T-junction.
- Second exit on roundabout.
- First exit on a roundabout next to a community centre.
- Followed road around bend
- Right on T-junction.
- Travelled south, taking the second exit on a roundabout, [passing a superstore on left.]
- Second exit on a large roundabout [passing a cinema.]
- First exit on next roundabout.
- An immediate left and then parked in a large car park.
**Where did the target travel to? **
Answer format:
- Replace spaces with underscores.
- Use osintuk{answer} format.
e.g. osintuk{location_name}
52.242611, -0.948806 takes us to Southfield Road, Northampton.
From there, it’s a simple matter of following directions - the end of which leads us to Northampton’s Sixfields Stadium.
Flag: osintuk{sixfields_stadium}
Ghost Plates (5pts)
Date: 09/04/2016
Time: ##:##:##Live CCTV footage from a nearby camera has been recovered; however, the extracted still images are grainy. As a result, the vehicle shown does not appear to match the recorded registration plate and is therefore believed to be displaying false plates.
The footage is of low to medium quality, and we are currently unable to confidently identify the vehicle’s make and model. Can you assist with further analysis?
What is the Make and Model of the vehicle?
Answer format:
- Put the make of the vehicle, then an underscore, then the model of the vehicle.
- Use osintuk{answer} format.
e.g. osintuk{make_model}
Grainy though the image is, Google Lens is still sufficient to crack this case. It’s rather scary how good AI image detection has become.
Flag: osintuk{Volkswagen_Passat}
The Away End (5pts)
Date: 09/04/2016
Time: ##:##:##Our team remained on site for several hours; however, during a shift change the parking area became fully occupied, resulting in a temporary loss of visual contact with the subject. It appears the target intentionally selected this date to meet their contact, exploiting the increased crowd density to blend in and reduce the likelihood of detection.
During the surveillance period, both the Financial Investigations Unit (FIU) and the Sports Betting Intelligence Unit (SBIU) reported intelligence indicating that the target was meeting with a known offender involved in sports betting–related crimes, they are part of Organised Crime Group (OCG) COBBLERS. Additional reporting suggests that a substantial sum of money was wagered on this particular football match within certain organised crime group circles.
The intelligence assessment further notes that this contact may have links to the away team on that date. Who was the away team for this match?
**What is the name of the opposing team? **
Answer format:
- Replace any spaces with underscores.
- Use osintuk{answer} format.
e.g. osintuk{football_team}
A quick search for ‘Cobblers’ shows it to be the nickname of Northampton Town F.C.
We now know with added certainty that we should be looking at Sixfields Stadium, their home arena. Searching for games played there on 9th April 2016 shows they played against the Bristol Rovers (and drew, 2-2).
Flag: osintuk{bristol_rovers}
Loose Lips Sink Ships (10pts)
Date: 17/04/2016
Time: ##:##:##A covert source with links to the known sports betting offender has reported that a bystander overheard and witnessed a transaction connected to the investigation. This individual is now believed to be under threat and in hiding. It is critical that this person is identified promptly so that appropriate safeguarding measures can be implemented.
Within the local football community, this individual is known only by the nickname “The Local Oaf.” The covert source is unable to confirm OAF’s true identity.
Communication data has been intercepted with the below conversation and a picture being shared between the OCG COBBLERS. Intercepted communications between members of the organised crime group (OCG) COBBLERS indicate active efforts to identify and locate this individual. The communications reference a witness who overheard a conversation at a football match and subsequently disclosed details of a significant bet to others. The messages suggest escalating intent, including attempts to identify the individual via football-related publications and a direct effort to attend their home address.
10/04/2016 - O##### - som snitch overheard the convo at the match the other day, hes gone round tellin people about the bet. any1 kno some1 called the local oaf?
…
15/04/2016 - O##### - right lads, ripped this stiker off the stadium wall, B#### says this site rights abot footie stuff and they kno who this oaf is.
15/04/2016 - O##### -
15/04/2016 - D##### - just cjecked his sight m9, the snitch wrote in on their sight yesterday, got the snitch’s name
15/04/2016 - T##### - J#### no’s were he lives, I’ll pop over 2morra 💪
15/04/2016 - D##### - Do him in lad, make sure he shuts his mouth
…
16/04/2016 - T##### - Just been to his gaff mate
16/04/2016 - O##### - was he in
16/04/2016 - T##### - nah ill com back lata
At present, it is unclear precisely what information OAF overheard or the level of violence the OCG may be prepared to use. However, the intercepted messages demonstrate an immediate and credible threat. The OCG appears to be actively attempting to locate OAF and may already be ahead in identifying them.
It is therefore essential that OAF’s real identity is established as a matter of urgency, allowing law enforcement to locate and safeguard the individual before the OCG does.
What is “The Local Oaf’s” real name?
Answer format:
- Enter first name, then an underscore, then the last name.
- Use the osintuk{answer} format.
e.g. osintuk{firstname_lastname}
This is substantially harder than following road signs!
As the image provided is of a crest and this is a football-themed challenge, I started by looking at the two teams mentioned: Northampton and Bristol respectively. This showed Bristol Rovers’ colours and pattern as all-but-matching the ripped logo.
Reverse image searches on the destroyed logo don’t turn up anything of note, but the date catches my eye - 17th April 2016. Could dorking with this help?
I started constructing Google dorks for forums and blogs relating to the Bristol Rovers on and around 17th April 2016. This led to no results, so I extended by search range to 2016 inclusive. I then got more specific - rather than searching for just ‘blog’, I went through the main blog hosting services of that time: Wordpress, Tumblr, and finally Blogspot.
Interestingly, Google search results proper didn’t find the correct result - but its AI Overview did. It pointed directly to the ‘Partizan Bristle’ blog, which has a matching logo and Russian newspaper-themed background.
Once on the website, the local oaf - George Bowerman - is listed on the right-hand column.
Flag: osintuk{george_bowerman}
The Final Whistle (10pts)
DISCLAIMER: No real people need to be searched. You have everything you need in the source files.
Date: 17/04/2016
Time: ##:##:##The witness, now identified as George Bowerman, is currently missing. Following the intercepted communications, it is confirmed that the OCG visited his home address on 16/04/2016. Fortunately, he was not at the property.
To ensure his safety and place him in protective custody before the OCG locates him, emergency authorisation was granted to triangulate the signal from his mobile device.
The triangulation data resulted in a small search area where we believe he may have headed to the local Travelodge to lay low after becoming aware that the OCG was looking for him.
We have seized the hotel’s digital guest registry for that week.
Analyse the attached guest list (guest_log_export_20160418.csv). We could not identify George Bowerman in the list, but as he is hiding, he may have given a false name. Can you identify any patterns that may point us to the right room he is staying in? Once we have his room number, we can put him in protective custody and put an end to this OCG.
What is the alias surname being used and their room number?
Answer format:
- Enter the surname, then an underscore, then room number.
- Use the osintuk{answer} format.
e.g. osintuk{Smith_123}
MAXIMUM 3 GUESSES
Once you have completed this final challenge, you can claim a certificate. Visit the “Solution” tab once you have submitted the correct answer for this challenge for instructions on how to claim.
An unusual one for OSINT UK: a challenge with jeopardy! Only three guesses allowed.
To tackle this, I opened the CSV and organised the data into a table. This allows for filtering in ascending and descending order so that we can read the entries in clearer format.
Having done so, four entries stand out as having paid by cash. This alone is unusual, and indicates somebody doesn’t want to be found.
Looking at these four entries closer, and one stands out for two reasons: paying upfront with no housekeeping, and having ‘cryptomail’ as their domain rather than something more benign. This logic holds, and it resolves the flag.
Flag: osintuk{Weeberg_214}