Hidden Marker
OSINT
Last updated
OSINT
Last updated
A whistleblower using the alias "spiriteawx" has revealed a large-scale art smuggling operation, leaking crucial financial documents and leaving behind cryptic hints. The goal of this challenge is to track down the smuggling location and identify the associated transaction.
Since we have a username, I used Sherlock to check for social media accounts.
Result of Sherlock:
Among these, we found an X account. Checking it revealed the following:
A tweet related to major art smuggling contained a link to Pastebin with financial records. The tweet also included an image, which supposedly shows where the smuggling took place.
This led me to a possible location: Prague, Czech Republic.
I then manually searched the map for about 30 minutes, but the area was too vast to check every street. Upon closer examination of the provided image, I noticed a vintage car, which stood out. This suggested it could be a known attraction. Searching for 'Prague Czech vintage cars location' on Google helped narrow it down.
The first result in Google Maps provided the answer.
FOUND IT! The street name is 'Celetna'. This gave me half of the flag.
Now, I needed to extract the transaction ID from the financial records. The logs contained over 1000 entries, and I had only 500 attempts to find the correct one.
After skimming through the data, I found suspicious entries such as:
After 12 failed attempts with different transaction IDs, I became suspicious of the redacted entry:
"-1","-1","[REDACTED BY ADMIN]","-1","-1", "-1"
I was initially confused as to why it was censored. Scrolling further, I found a comment in the Pastebin log:
It was there. I swear! - ArmoredVortex
This suggested that the log had been edited. If the original data had been altered, I needed to find an earlier version. Searching for "ArmoredVortex" and "spiriteawx" using Sherlock yielded nothing useful, so my last resort was the Wayback Machine.
Using the Wayback Machine:
Bingo! The redacted entry at line 537 was visible in an earlier version:
To determine the location, I first attempted reverse image searches but found no matches. Assuming the image was taken from Google Maps, I decided to use my favorite tool, .
