Hacktoria — Wild Fire

The challenge gives you one screenshot and one question. A map, some red hatched polygons, and:

These evacuation zones are the result of an active wild fire. What is the fire incident number and discovery date of this fire?

The famous-sounding names are noise. The identification sits half-cropped at the right edge: an I-25 shield and the clipped “Colora…” / “…che Ci”.

Flag format: Hacktoria{1234-ABCDE-123456_dd/mm/yyyy}.

Up front: it’s the Aspen Acres Fire, southern Colorado — Hacktoria{2026-COCUX-001160_29/06/2026}. Both halves of that answer sit behind a trap, and the traps are the story.

Being wrong first

I started reading names off the map. Bradford. Devils Hole. Black Mountain. Wet Mountain Valley.

Bradford is in England, so I went to England — no Devils Hole anywhere near it. Australia then? Australia has no Wet Mountains. Two continents, ten minutes, nothing.

The mistake wasn’t reading the map badly, it was querying it badly: one name at a time, and every name I picked was among the most common toponyms on earth. Black Mountains exist everywhere anyone has ever seen a dark hill. Devils Hole is standard-issue American sinkhole naming. Bradford alone tells you nothing.

What I’d been ignoring sat half-cropped at the right edge of the frame: an I-25 interstate shield. Below it, Colora… and …che Ci, both clipped.

Half-cropped at the frame edge: an I-25 shield, “Colora…”, “…che Ci”. The US, Colorado, Colorado City — everything the famous names couldn’t deliver.

That’s the US. That’s Colorado City. Everything before that was noise.

Once the country is fixed, the rest collapses. Wet Mountain Valley plus a Wet Mountains label with an 11,530 ft peak. San Isabel. Gardner. Cuerna Verde Park — actually Cuerno Verde, the kind of Spanish name that puts you in the southern half of the state. State Highway 69 runs up the valley.

Individually, none of those are rare enough. Together they intersect in exactly one place: the Wet Mountains of southern Colorado, Custer and Huerfano counties, southwest of Pueblo. Roughly 37.9°N, -105.1°W.

The red polygons are useless for this step, by the way. They’re an overlay. They tell you which fire once you know where you are; they can’t tell you where you are.

Finding the fire

Location plus “active wildfire” is enough. The query that landed it:

wildfire evacuation zones Wet Mountains Colorado San Isabel Gardner

I actually typed 2025 on the end of that, out of habit, and it worked anyway — the engine ignored me. Worth noting because a wrong year in a query is usually fatal and here I got lucky rather than good.

One name comes back and leaves no room for a second candidate: the Aspen Acres Fire. Ignited near the Aspen Acres Campground about ten miles northwest of Rye, then 100 mph gusts drove it into Custer and Pueblo counties. Evacuation orders for Beulah, Rye, San Isabel, Colorado City, Wetmore — which is, roughly, the list of towns ringing those polygons.

The check that matters: does the shape match? The sheriff’s-office evacuation zones for this incident line up with the polygons in the screenshot. If they hadn’t, the name would have been a coincidence and I’d have kept looking.

Reading the flag format before searching

1234-ABCDE-123456. Four digits, five letters, six digits.

That’s not a generic placeholder. It’s the literal shape of a wildland fire’s Unique Fire Identifier (UFI):

YYYY - <5-char protecting unit ID> - <6-digit local incident number>

Recognising that is most of the challenge, because it converts a vague hunt for an “incident number” into three known fields. The year is already 2026. You need a unit ID and a local number. And critically: you now know that no news article will ever contain this string, so you can stop reading news articles.

The trap

InciWeb is the public source of record, and it fails you twice.

First, it refuses automation — robots.txt disallows it, so a scripted fetch gets nothing. You’re in a browser or you’re on a mirror.

Second, and this is the actual trap:

The InciWeb slug is copsf-aspen-acres-fire.

COPSF is Pike-San Isabel National Forest. Five characters. Sitting in the URL of the official incident page for this exact fire. It fits the format perfectly. It is begging you to submit 2026-COPSF-….

I nearly did. What stopped me was that I had no local incident number to go with it, which forced me to go find the actual record instead of assembling one.

Getting the real record

My first route was a WFIGS-feed aggregator that mirrors the NIFC data. It gave me the answer, but it’s a secondary source, and a writeup that says “some site told me” isn’t a method. So here’s the primary source, which is public, unauthenticated, and queryable.

WFIGS — Wildland Fire Interagency Geospatial Services — publishes every IRWIN incident as an ArcGIS feature service. The current-incidents layer:

https://services3.arcgis.com/T4QMspbfLg3qTGWY/arcgis/rest/services/
  WFIGS_Incident_Locations_Current/FeatureServer/0

Append ?f=json to that and you get the schema — 97 fields, including UniqueFireIdentifier, IrwinID, FireDiscoveryDateTime, POOProtectingUnit, POOCounty, FireCause. Check the schema first; my first query 400’d because I’d guessed DailyAcres, which this layer doesn’t carry.

Then filter on the incident name. IncidentName holds Aspen Acres, without the word “Fire”:

curl -s -G "https://services3.arcgis.com/T4QMspbfLg3qTGWY/arcgis/rest/services/WFIGS_Incident_Locations_Current/FeatureServer/0/query" \
  --data-urlencode "where=IncidentName LIKE '%Aspen Acres%'" \
  --data-urlencode "outFields=IncidentName,UniqueFireIdentifier,IrwinID,FireDiscoveryDateTime,POOProtectingUnit,POOState,POOCounty,FireCause,DiscoveryAcres" \
  --data-urlencode "returnGeometry=false" \
  --data-urlencode "f=json"

LIKE '%…%' rather than = because you don’t yet know how the name is punctuated in the record. returnGeometry=false because the point location isn’t the question. One feature comes back:

{
  "IncidentName": "Aspen Acres",
  "UniqueFireIdentifier": "2026-COCUX-001160",
  "IrwinID": "{1CDF5E5A-F22E-4352-A582-C2A47663B93D}",
  "FireDiscoveryDateTime": 1782734686000,
  "POOProtectingUnit": "COCUX",
  "POOProtectingAgency": "C&L",
  "POOState": "US-CO",
  "POOCounty": "Custer",
  "FireCause": "Human",
  "DiscoveryAcres": 40
}

POOCounty: Custer, POOState: US-CO — that’s the geolocation confirmed independently of my map reading, which is the real value of hitting the primary source.

And POOProtectingUnit is COCUX. Custer County. Not COPSF. The national forest hosts the InciWeb page; the county is the protecting unit on the record. The UFI is built from the protecting unit, so the forest never appears in it.

Note also that UniqueFireIdentifier is its own field, already assembled. You don’t build the string — you read it. IrwinID is a separate thing entirely, a GUID, and it is not what the flag wants despite “IRWIN ID” being used loosely as a synonym for the UFI in a lot of writing.

The date

FireDiscoveryDateTime is a Unix epoch in milliseconds, in UTC:

from datetime import datetime, timezone, timedelta
utc = datetime.fromtimestamp(1782734686000/1000, tz=timezone.utc)
# 2026-06-29 12:04:46 UTC
utc.astimezone(timezone(timedelta(hours=-6)))
# 2026-06-29 06:04:46  (MDT, UTC-6)

Worth doing the conversion rather than trusting the date InciWeb prints, because a UTC timestamp near midnight lands on a different calendar day than the local one and the flag doesn’t tell you which it wants. Here it’s moot — 12:04 UTC is 06:04 in Colorado, same day either way. But you only know it’s moot after you check.

29/06/2026.

Flag

Hacktoria{2026-COCUX-001160_29/06/2026}

Two ways to lose this. Anchor on the famous toponym and spend your first ten minutes in Yorkshire — I did that one. Or read the unit ID out of the InciWeb URL instead of the IRWIN record and submit COPSF. The map baits you and then the official source baits you. Both times the answer is the boring specific field underneath, and both times the fix is the same: go to the record, not to the thing that looks like the record.

Sources

• WFIGS Incident Locations (Current) — the IRWIN record; primary source for UFI and discovery date
• InciWeb — Aspen Acres Fire — public incident page (and the source of the COPSF trap)
• Challenge: Hacktoria — “Wild Fire”