← All writeups

Operation Lutetia

August 2026 · OSINT UK CTF · 15 challenges

The Initial Audit (3pts)

An open-source intelligence digital puzzle hunt, designated Operation Lutetia, has appeared online. A mysterious individual using the alias Harris Capes has challenged the internet to follow a deliberate trail he has laid across France. This puzzle is designed to test your investigative patience and your ability to look past surface-level data by navigating through a series of main objectives and optional side quests. The first stage of the trail begins with a piece of logistical data. A vehicle registration plate has been recovered, which is directly tied to the initial movements of Harris Capes within the region using Bolt.

Task: Analyse the registration plate GR-410-WF to identify the vehicle manufacturer and the full Vehicle Identification Number (VIN).

Answer Format:

  • Use the osintuk{answer} format.
  • Separate the manufacturer and VIN by an underscore.
  • Case sensitivity is not important.
    e.g. osintuk{honda_xxxxxxxxxxxxxxxxx}

Welcome back to OSINT UK’s CTF! Let’s dive straight in.

Rather than going to any pre-known website, I started by simply Googling ‘search French licence plate’. The first result, ‘immatriculation-auto’, identified the model and part of the VIN.

This partial VIN result is enough to help confirm the true VIN when its found.

Further Googling led to Autoref. This required a quick sign-up, and allowed for the direct querying of French number plates to identify the VIN. This was the perfect tool for the job, giving both the make and VIN in full.

Flag: osintuk{toyota_SB1ZS3JE80E468028}

The Glass Monolith (4pts)

Successfully verifying the vehicle details allows you to progress to the first physical milestone posted to the trail. Harris Capes has provided a single photograph looking down an open street.

Task: Analyse the attached image to identify the official name of the tall building in the middle.

Answer Format:

  • Use the osintuk{answer} format.
  • The name must be provided in French.
  • Replace any spaces with underscores.
  • Case sensitivity is not important.
    e.g. osintuk{tour_eiffel}

Whenever I see images like this, my first two steps are always:

While no coordinates were identified, Gemini immediately picked this up as being Avenue du Maine, with the tower being Montparnasse Tower (Tour Montparnasse). This actually served as a strong reminder of how confidently wrong AI can be - simply searching for ‘Tour Montparnasse’ on Google Images will show this tower to be completely different.

Here’s the Montparnasse Tower for comparison.

While looking through the results, one building looked remarkably similar head-on. This transpired to be the ‘Tribunal de Paris’, or Paris Judicial Court - a direct match.

Beyond identifying the flag, this challenge also showed just how varied the architecture in Paris can be.

Flag: osintuk{tribunal_de_paris}

The Window Frame (5pts)

Moving away from the court plaza, Harris Capes has uploaded a short video file. The clip captures a close view that zooms into a vehicle parked below, but we think he has made a mistake and may have leaked his location.

Task: Analyse the attached video file to identify the name of the building he is in.

Answer Format:

  • Use the osintuk{answer} format.
  • Replace any spaces with underscores.
  • Case sensitivity is not important.
    e.g. osintuk{st_pancras_renaissance}

The first few frames of this clip, pre-zoom, shows a restaurant called ‘Mama Africa’. It’s adjacent to a store starting with ‘W’, which appears to say ‘WAG’. This is enough to commence searches.

Sure enough, a search on Google Images identifies a visual match along 25 Avelue Corentin-Cariou - directly opposite a 4-star hotel.

Flag: osintuk{moxy_paris_la_villette}

The Gathering (3pts)

There has been speculation that Harris Capes spent time in the area around the hotel to attend a major 2026 hacker conference.

Task: Identify the name of the hacker conference.

Answer Format:

  • Use the osintuk{answer} format.
  • Case sensitivity is not important.
    e.g. osintuk{blackhat}

My spidey senses are tingling here. By right of being in this industry, I’m aware of Le Hack being a major Paris-hosted conference with ties to Epieos, a well-known firm in the OSINT space.

Hunches are great starting points but poor methodologies, so let’s do some working out.

A simple Google search for ‘lehack 2026 address’ identifies ‘Cité des Sciences in Paris’ as being the venue address. Unsurprisingly, searching for this venue on Google Maps shows it to be a two-minute walk from the pre-identified hotel. Lehack it is.

Flag: osintuk{lehack}

Paint Roller (4pts)

Harris Capes posted a photograph of some street art located not far from his previous location.

Task: Identify the artist who painted this street art, locate their Instagram account, and provide their unique numeric user ID.

Answer Format:

  • Use the osintuk{answer} format.
  • Provide only the numeric ID.
    e.g. osintuk{123456789}

There’s a few more steps to this one, specifically:

For the first step, I turn to trusty Google Lens once more. It identifies Cart’1 as the artist. I identified his Instagram page through Googling his name. This showed him to be a French street artist based in Lyon, and his posts match the art style - making him our likely target.

I found a website called CommentPicker which allows you to enter an Instagram handle or profile URL and to receive the UID in exchange. It seemed to work without any issue and didn’t require signup. As shown below, it gave the UID 491582890, which resolves the flag.

Flag: osintuk{491582890}

Corporate Footprint (4pts)

Harris Capes has provided a 9-digit registration identifier linked to a business in the area: 518903695.

Task: Determine the exact official total share capital (capital social) recorded for this company.

Answer Format:

  • Use the osintuk{answer} format.
  • Provide only the raw numerical value.
  • e.g. osintuk{50000}

This is a two-step challenge: identify the company from the corporate registration number, then identify the official total share capital (‘capital social’) for that company.

The first step can be solved using the French Trade Registry, where you can simply query the number to get the firm. This wasn’t hard to find, and shows the firm to be DPBC (Demory Paname Brewing Company).

Once secured, a quoted Google search for “dpbc” “capital social” shows the share capital value for the firm courtesy of Societe. This gives a value of 199,295 euros.

Flag: osintuk{199295}

The Waterway Crossing (5pts)

Harris Capes shared a night photograph looking down the canal through a distinct bridge structure.

Task: Identify the official name of the bridge shown in the photograph.

Answer Format:

  • Use the osintuk{answer} format.
  • Replace any spaces with underscores.
  • Case sensitivity is not important.
    e.g. osintuk{pont_neuf}

As prior, I started by running the image through Google Lens. A Wikiloc result showed this as being ‘La Villette’, which struck me as being very similar to the hotel location we saw earlier.

With this in mind, I went to Google Maps, and saw La Villette - and an accompanying bridge - not only being close to the LeHack environs, but also being directly next to Paname Brewing Company from the preceding challenge.

Google lists the bridge’s name as Pont Levant de Crimée, and a search on Google Street View confirms this to be the same bridge.

Flag: osintuk{pont_levant_de_Crimée}

The Escape Route (4pts)

Harris Capes was spotted boarding train TGV 6121 departing south from Paris Gare de Lyon. He got off at the second intermediate stop on the route to make his way to a nearby airfield.

Task: Identify the 4-letter ICAO code of the closest airfield to this train stop.

Answer Format:

  • Use the osintuk{answer} format.
  • Case sensitivity is not important.
    e.g. osintuk{lfpb}

A search on Zugfinder shows this to be the route from Paris Gare de Lyon to Marseille-St-Charles. Searching further on SNCF Connect found the exact train and its intermediate stops - the secondmost being Aix-En-Provence Tgv.

The nearest regional airport to this station is an 11-minute drive away with the ICAO code LFMA. This resolves the flag.

Flag: osintuk{lfma}

The Warbird (4pts)

Harris Capes posted an update mentioning he managed to hitch a ride on a vintage C-47 Dakota IV registered as F-AZOX.

Task: Identify the original serial number assigned to this aircraft when it was built in 1945.

Answer Format:

  • Use the osintuk{answer} format.
  • Case sensitivity is not important.
    e.g. osintuk{12-34567}

Well well well - it’s time for me to plug my own tool!

Last month, I started constructing a free online tool - Plane Resolver - that can query live flight serial numbers in order to return national registry information against the plane. This includes the ICAO 24-bit hex and, where available, ownership information. If ownership information isn’t visible, then a direct link to the national registry is provided.

While France needs some debugging - full information isn’t yet pulled - it does link to the correct data. For the purposes of this investigation, it gives the current serial number as ‘33352’ - a useful clue.

By knowing the current registration and serial numbers, more targeted searches can be provided using standard search engines. This identified a Wikimedia page containing the current registration (‘F-AZOX’), serial (33352) and original registration (44-77020) - the latter resolving our flag.

Flag: osintuk{44-77020}

A Look Back (8pts)

Harris Capes just released an update about an apartment he stayed at a few days ago at 22 Rue de Forbin, Marseille. He mentions he only picked the spot because he knew the previous owners who sold the property back in 2015.

Task: Find the exact date and sale price for this property in 2015.

Answer Format:

  • Use the osintuk{answer} format.
  • Use the DDMMYYYY_000000 format as the date, underscore, then the price.
  • Do not use any special characters except the underscore.
    e.g. osintuk{25122015_520710}

This is trickier. I started by seeing if there were any French equivalents to Rightmove and Zoopla that might show recorded house sales prices. My search led to Meilleurs Agents, which showed historical property sales price per land parcel in graph format. While not the complete answer, this did show ‘Notaires, INSEE’ as two datasets used for this claim.

More importantly than that, the listing also shows the ‘Section Cadastrale’ - the cadastre section (land parcel) linked to the sold property itself, which itself can be queried against any national land registry. The reference in question is 8100B01, with a parcel number of 0100.

Searching for a queryable cadastre led me to the Demande de Valeur Foncière (DVF), a queryable portal which can be used to export CSVs of relevant data. However, quick usage showed that this only provided data going back five years - ergo not meeting the ticket for what we were looking for.

At this point, rather than search engines, I asked Claude if it knew of either:

In an absolute world-class result (and terrifying indictment of how much AI is likely to impact analyst employability going forward), Claude identified CQuest, an online archive of information published by the French government.

A subdirectory within there included ‘valeursfroncieres’, referring to the DVF service we saw earlier. Files on there were dated by year, indicating an archive of information from that year from the service.

I downloaded the 2015 archive as a .txt file. Opening it showed the following. This appears to be a mess (and for human eyes - it is), but the data does appear to be structured, and includes both sold prices and dates of sale. This was more than sufficient to ask Claude to find the relevant entry.

Beyond finding the flag, I would like to thank Claude for saving me trawling through 250,000 lines of French property sales. It identified the sales price as €100,000, and the sales date as 16th July 2015.

Flag: osintuk{16072015_100000}

Tracking the Shipments (3pts)

Harris Capes has checked out of Marseille and left a new clue about his next move. In his latest public update, he mentions tracking an asset being loaded onto a rail shuttle to connect with a transatlantic carrier, leaving behind only the vessel’s unique global identifier: IMO 9709207.

Task: Find the written name of the specific cargo vessel assigned to this identification number.

Answer Format:

  • Use the osintuk{answer} format.
  • Replace any spaces with underscores.
  • Case sensitivity is not important.
    e.g. osintuk{OCEAN_PACIFIC_EXPRESS}

The IMO (International Maritime Organisation) number is typically queryable via MarineTraffic, VesselFinder and various other sites in-between. A search on VesselFinder identifies the ship as the ‘CMA CGM MARSEILLE’.

Flag: osintuk{CMA_CGM_MARSEILLE}

The Transatlantic Route (6pts)

In his final post, Harris Capes leaves his followers a puzzle about where he’s going next. He says he’s got a spot on a cargo ship and he’s sailing the exact same route the CMA CGM Marseille did back in 2024, on Voyage SB 2403111S. He won’t name a single one of his own stops. If you want to know the ports he’ll be hitting, he says, go and look up that old voyage yourself. Start with where it docked on the 2nd of April.

Task: Locate the 2024 Menzell Döhle “Long Term Schedule Line Europe” document and track the CMA CGM MARSEILLE route for Voyage SB 2403111S. Identify the name of the destination port where the ship was scheduled to arrive on the 2nd of April.

Answer Format:

  • Use the osintuk{answer} format.
  • Replace any spaces with underscores.
    e.g. osintuk{SANTO_DOMINGO}

Once you have cracked this final leg of the journey and submitted the correct port, you have officially completed the campaign and your hunt is over. Harris Capes thanks you for playing, and congratulations on solving the final challenge!

This sounds challenging. I don’t think I can get the document just by typing the route number in in Goo-

Oh.

Going into the document and searching for ‘2-Apr’ reveals the destination to be ‘Degrad Des Cannes’, thus resolving the flag and completing the main challenge line. Now on to the side quests!

Flag: osintuk{DEGRAD_DES_CANNES}

SIDE QUEST: A Rosy Outlook (3pts)

While exploring the area around the court building identified in Task 2, content from 2023 and 2024 shows a distinct pink sculpture temporarily installed outside.

Task: Locate this pink sculpture and identify the official name of the specific artistic movement it represents.

Answer Format:

  • Use the osintuk{answer} format.
  • The name must be provided in French.
  • Case sensitivity is not important.
    e.g. osintuk{cubisme}

Google Maps videos of the location show a pink statue visible in Sept 2023. The resolution and size are too low and small to identify what the statue is here, but we now at least know (literally) where to look.

A second video angle shows the statue as being a waving humanoid figure.

While also small, this second image is distinct enough to use. By turning to Old Reliable - Google Lens - we can quickly identify the sculpture as being ‘Mr Pink’, an art instillation by Philippe Katerine, and an example of ‘mignonisme’ or ‘cuteism’ - thus resolving the flag.

Flag: osintuk{mignonisme}

Speaking Engagement (3pts)

The hacker conference featured a speaker who is part of the UK OSINT Community leadership team.

Task: Identify the name of the individual from the UK OSINT Community leadership team who spoke at the event.

Answer Format:

  • Use the osintuk{answer} format.
  • Replace any spaces with underscores.
  • Case sensitivity is not important.
    e.g. osintuk{john_smith}

This one’s quite cheaty - I already knew the answer. However, this can be found by searching for the earlier-identified conference (‘lehack’) and various permutations of ‘UK OSINT’. By doing so, the website can be found and talks browsed until Mr. Richards is identified.

Flag: osintuk{joshua_richards}

Tension Control (5pts)

The hacker conference had a table for lock picking, and they appear to have hosted a challenge.

Task: Identify the organisation running the challenge and find the alias of the individual who ended at the top spot of their challenge leaderboard.

Answer Format:

  • Use the osintuk{answer} format.
  • Provide only the alias of the first-place individual.
  • Case sensitivity is not important.
    e.g. osintuk{padlockmaster}

Going to the LeHack website immediately shows what’s on at the event - including the segment aptly named ‘lockpicking ninjas’. Clicking into this shows the organiser as being ‘Red Team Alliance’.

By going to Red Team Alliance’s website page, we can immediately find the leaderboard from lehack, with ‘pocpic’ at the top - this resolving the flag, and completing another OSINT UK challenge. Many thanks to the OSINT UK team and challenge creators!

Flag: osintuk{pocpic}