SPURIA // FIELD NOTES

A Taste of Influence, Part 1 — The Flag in the Avatar

A ten-second solve of the OSINT challenge A Taste of Influence Part 1: the flag was in the Gronda profile picture, and the stylised logo pins the year.

/easysocmint/#image-analysis#reverse-image-search#osintindustries

Source: A Taste of Influence — Part 1, OSINT Industries CTF Given: one profile URL on Gronda, a vertical social network for hospitality professionals Wanted: the name of a gastronomic event the subject attended, as OSINT{FESTIVAL_NAME}, uppercase, no spaces

Some challenges are worth writing up because they took hours. A Taste of Influence — Part 1 is worth writing up because it took ten seconds — and because the ten seconds came from looking at the one element on the page that most people treat as decoration.

The task

The brief described a professional in the international hospitality industry with a public profile on Gronda, a vertical social network for chefs, bartenders and restaurant staff. He attended a gastronomic event a few years ago. The event is not named anywhere in the profile text. Find it.

Input: a single profile URL. Flag format: OSINT{FESTIVAL_NAME}, uppercase, no spaces.

The path everyone takes

A profile URL plus “the answer is not stated directly” reads as an invitation to pivot. The standard reflex kicks in immediately: read the bio, walk the employment history, check the posts and their timestamps, extract the username, run it through WhatsMyName, find the LinkedIn and the Instagram, look for a tagged location or a conference post in the right year, cross-reference against a list of industry events.

That is a perfectly good methodology. It also would have taken thirty to sixty minutes here, and it was entirely unnecessary.

What actually happened

I opened the profile and looked at the avatar. The event branding was in the image.

That is the whole solve. No pivot, no enumeration, no second platform.

Why the avatar is a data field

On mainstream networks, profile pictures are portraits — cropped headshots, neutral backgrounds, usually stripped of anything identifying beyond the face. On vertical professional platforms the norm is different, and it is different for a reason: these users are building an industry reputation, not a personal brand. So the profile picture is frequently a photograph taken at work or at an event, and that photograph carries:

  • Branded workwear. Chef jackets and aprons with embroidered logos of the restaurant, the sponsor, or the event.
  • Backdrops and step-and-repeat walls. Press walls at trade shows are a solid grid of sponsor logos.
  • Badges and lanyards. Often legible enough to read the event name, sometimes the year and the attendee category.
  • Stage and booth signage behind the subject.

None of that survives on a platform where people upload studio headshots. It survives everywhere in hospitality, hairdressing, fitness, trades, and most other craft industries with their own networks. If your target is on a niche platform, the imagery is less sanitised than the text.

Practical handling: never judge the avatar at display size. Grab the direct image URL from the DOM, strip the resize and crop parameters from the CDN query string, and pull the original. A logo that is an illegible smudge at 200×200 is often perfectly readable at 1200 wide. Then reverse-image-search it anyway — the same photo frequently appears in an event gallery or a press release that names everything for you.

The detail that makes it more than a lucky glance

The wordmark in the image reads GA5TREET, with a digit where a letter belongs. The obvious assumption is leetspeak — a designer being cute, normalise it back to GASTREET and move on.

That assumption is wrong, and being wrong about it costs you the best piece of evidence in the picture.

The event is the GASTREET International Restaurant Show, a large annual industry gathering held at the Krasnaya Polyana resort near Sochi. In 2019 it ran its fifth edition, and the organisers restyled the wordmark for the anniversary: the S became a 5, for that year and that year only. Contemporary partner posts and the event hashtag confirm it, and there is even a separate domain, ga5treet.ru, registered in April 2019. Every other edition is spelled normally.

So the digit is not decoration. It is an edition marker, which makes it a date stamp. The avatar does not merely say “this person attended GASTREET” — it says “this person attended GASTREET in 2019”, which lines up exactly with the brief’s vague “a few years ago”.

That is worth generalising. When a logo in an image contains a character that does not belong, check whether it encodes an edition number, an anniversary, a year, or a location before writing it off as branding. Anniversary restyles, year badges, roman numerals and edition numbers in event marks are common, and they are frequently the most time-specific data in the frame — more precise than EXIF, which every social platform strips on upload anyway.

On the flag itself: submit the string as it appears in the artifact. The challenge is testing whether you read the image, so the image spelling is the answer. Normalising it to the prose spelling would have been the clever move that loses the point.

Takeaway

Add one line to the top of your profile-analysis checklist, above the bio and above the username enumeration:

Open every image at full resolution and read the text in it.

Avatar, cover photo, post attachments, gallery. Logos, signage, badges, name tags, screens in the background, labels on bottles. It costs ten seconds. Occasionally it costs you an entire investigation methodology, because there is nothing left to investigate.

Sources