SPURIA // FIELD NOTES

A Taste of Influence, Part 2 — Name to Registrant Record

Part 2 of the A Taste of Influence OSINT challenge: name to city to business project to a pre-GDPR WHOIS record, and why the phone number is the part that matters.

/mediumsocmint/#cross-platform-pivot#osintindustries

Source: A Taste of Influence — Part 2, OSINT Industries CTF Given: the same single Gronda profile URL from Part 1 — a name in Cyrillic and Latin script, a current employer, a city Wanted: an email address tied to the subject, as OSINT{EMAIL_ADDRESS}, uppercase, @ as _AT_, . as _DOT_

Part 1 ended in ten seconds, because the answer was sitting in the profile picture. Part 2 does not give you that. Same profile, same single input URL — but this time the target is not on the page at all.

The task

The brief states that the individual maintains a presence across several platforms, and that an email address is recoverable from public sources even though it is not shown on the main profile. Identify it.

Flag format: OSINT{EMAIL_ADDRESS}, uppercase, @ written as _AT_ and . as _DOT_.

A note on redaction: the address is not reproduced here, and neither is the phone number that anchors the identification. The target is a real working professional with a real inbox, not a fictional persona, and a CTF flag is not a licence to publish someone’s contact details to search engines. The route below is complete as a method. If you write up challenges built on live profiles, redact by default.

Where Part 1 pays off: it doesn’t

Worth saying plainly, because the challenge text implies otherwise. The Part 2 brief opens with “following the identification of the gastronomic event” — which reads as though the answer to Part 1 is the key that opens Part 2.

It is not. The route below never touches the anniversary festival from Part 1. The event that actually mattered was a different one entirely, and it surfaced from a plain name search, not from anything Part 1 produced.

That is a challenge design issue rather than a solving issue, but it is worth naming, because chained challenges train a bad reflex: you assume the previous answer must be load-bearing and you spend twenty minutes trying to make it fit. Test that assumption early. If the prior flag does not open anything within a few minutes, treat the two parts as independent and start from the raw input again.

The route

1. Establish the subject. The profile gives a name in both Cyrillic and Latin script and lists a current position at a cultural centre in Yekaterinburg. Two things come out of that immediately: a city, and a professional field.

One detail worth pausing on — the profile handle transliterates the final Cyrillic х as x, while most published references spell it kh. Those are two different search surfaces. Querying only one of them silently halves your results, and this is a recurring trap with Russian, Ukrainian, Greek and Arabic names, where several competing romanisation schemes are all in active use. Build both forms before you start, along with the original script.

2. Pin the professional history. Searching the name together with role and city terms surfaces coverage of a World Pasta Day event in 2020, which names him as head chef of a café in Yekaterinburg. That is the first real anchor: a specific business, tied to a specific person, in a specific city.

3. Correlate accounts across platforms. The full name leads to a professional chef account, and adjacent in the results sits a second presence belonging to a culinary project rather than to him personally. That second entity is the pivot — personal accounts are curated, business accounts leak.

4. Harvest business contact data. The culinary school associated with that project published a phone number. The same number appears in the description of a public cooking video from the same project, alongside a business email address. Neither is the flag. Both are corroboration material, and the number in particular is about to do the heavy lifting.

5. Go to historical WHOIS. The project’s own domain was registered in 2013. The archived registration record from that period lists the registrant name, the city, the same phone number already collected in step 4 — and a personal registrant email address on a Russian free-mail provider. That is the answer.

Confirmation

This is the step that separates a solve from a guess, and the challenge quietly rewards doing it properly.

A registrant name matching your subject’s name proves very little on its own. Common names collide, and “Konstantin Gladkikh, Yekaterinburg” is not a rare string. What upgrades this from a name match to an identity match is the phone number: an identical number appears in the culinary school’s public listing, in the video description, and in the 2013 registration record. Three independent surfaces, one number, one city, one culinary project, one name.

That is a chain of corroboration rather than a coincidence, and it is the standard you should hold yourself to outside of CTFs too. If your only link is “the name is the same”, you have a hypothesis. If an independent identifier appears on both sides of the join, you have an identification.

What generalises

Pre-GDPR WHOIS is a permanent personal data leak. Registrations from roughly 2013 and earlier were made in an era before privacy proxying was the default and before the 2018 redaction of registrant details became standard. Anyone who registered a domain then — for a restaurant, a school, a side project — quite likely published their real name, address, phone number and personal email into a public database, and historical WHOIS services retain those snapshots regardless of what the record shows today. The domain can be expired, transferred or long dead; the 2013 snapshot survives it.

Two working rules follow:

  • When a subject is linked to any business, look for that business’s domain and pull the registration history, not the current record. The current record will almost always be redacted. The oldest one usually is not.
  • Small businesses are the soft target in a personal investigation. People protect personal accounts and forget that the company Facebook page, the school’s contact block and the domain registration from a decade ago were all filled in by the same person in a hurry.

And a note in the other direction, since this cuts both ways: if you ever registered a domain before 2018 without privacy protection, that data is still out there. It cannot be recalled from the historical snapshots, only outlived.

Part 3, briefly

There is a third part to this challenge — recover the last four digits of the individual’s phone number — but it does not need its own writeup, because the answer is already sitting in the record from step 5.

The 2013 WHOIS registration lists the phone number in full. The same number was cross-confirmed in step 4 against the culinary school’s public listing and the video description, which is exactly the corroboration that made the identification solid in the first place. So Part 3 adds no new investigative work: you read the last four digits off a number you already had, already verified across three sources, and already used to anchor the identity. (The digits stay redacted here for the same reason everything else does.)

It is a fair illustration of a general point, though. In a well-built chain, later stages often resolve to data you have already collected — the work is in the earlier pivot, and the later “challenges” are checking whether you gathered thoroughly rather than just far enough to grab the one flag in front of you. Collect the whole record when you find it, not only the field the current question asks about.

Takeaway

Part 1’s rule was open every image at full resolution. Part 2’s is narrower and older:

When a person is connected to a business, the person’s data is in the business’s paperwork.

Domain registrations, imprints, trade register filings, licence applications, video descriptions with a contact block pasted in. None of it is on the profile you were handed, all of it was published voluntarily, and the oldest copy is usually the least careful one.

Sources