I love cats — Athena Trace 2026 Writeup

The challenge

Someone left a very cute cat on the internet. The owner is louder online than they think. Find the public contact email address the cat’s people hand out, and submit its MD5.

Flag format: trace{md5} — lowercase hex, MD5 of the email address string with no trailing newline.

Two sentences, two hints, and both matter:

• “the cat’s people” — not an individual. The target is a business, and the address is one it publishes deliberately.
• “louder online than they think” — the answer is on a channel the operators treat casually, not on the one they curate.

The second phrase is the whole challenge. It’s telling you in advance that the first address you find won’t be the right one.

Stage 1 — Identify the venue

The artifact is a cat photograph taken inside a business. Working the interior — signage, fittings, layout — and cross-referencing against mapping data identifies the venue: a cat café trading as Chubby Meows, with a corresponding domain at chubbymeows.com.

Business premises are comparatively easy targets here, and deliberately so: a venue that wants customers publishes its location, exterior, and interior across Maps, review sites, and social platforms. That’s a different situation from geolocating a private residence, and worth keeping straight — the reason this is a fair challenge is that everything downstream is information the business publishes in order to be found.

Stage 2 — WHOIS (a dead end, and that’s fine)

The reflex on a domain is WHOIS. Here it returns redacted registrant data — the default since GDPR-era privacy services became standard.

Not a loss. It rules out a path in one query and tells you the answer has to come from published content rather than registration records. Cheap negative results are worth collecting early.

Stage 3 — The bait

The site footer carries a contact address in the standard form:

info@[domain]

This is the trap. It’s real, it’s on the official site, it’s exactly what you’d expect — and it’s not the address the challenge wants.

Why it’s wrong is worth spelling out, because the reasoning generalises. A footer info@ address is often a structural placeholder: it ships with the template, it’s what a web designer puts there, and it may route nowhere anyone reads. The address a small business actually hands out is the one it types into replies and posts — and small operators overwhelmingly do that on social platforms, not by editing their site.

That’s what “louder online than they think” means. The curated surface (the website) and the active surface (the social page) carry different data, and the active surface is more current.

Stage 4 — The real address

Searching the domain rather than browsing the site surfaces the operator’s Facebook page, where the contact address given out is a different one:

[handle]extra@gmail.com

A free-mail address, distinct from the domain address, sitting on the platform where the business actually talks to people.

Lesson: when hunting a business contact, enumerate every surface before settling — website, Maps listing, Facebook, Instagram bio, review-site profile, business directory entries. They disagree surprisingly often, and the discrepancy itself is the finding. A single address found on a single surface is a hypothesis, not an answer.

The pattern is realistic rather than contrived: countless small businesses run a Gmail account as their working inbox and leave a decorative info@ on the website.

Stage 5 — The trailing newline

You now have the address. This is where attempts get burned.

The spec says no trailing newline, and it says it because the natural command gets it wrong:

# WRONG — echo appends \n
echo "address@example.com" | md5sum

# RIGHT — -n suppresses the newline
echo -n "address@example.com" | md5sum

A single 0x0A byte on the end produces a completely different digest. There’s no partial credit and no diagnostic — a wrong hash and a right-address-wrong-encoding hash look identical from the submission box. Solvers can sit on the correct answer for a long time convinced their OSINT is wrong.

Safer alternatives that sidestep shell quoting entirely:

printf '%s' 'address@example.com' | md5sum

import hashlib
hashlib.md5(b"address@example.com").hexdigest()

Python’s approach is the most robust: b"..." contains exactly the bytes you typed, with nothing appended.

Two more encoding traps worth checking if a hash won’t validate:

• Case. Email local parts can be case-sensitive; hash the string exactly as published.
• Invisible characters. Copying from a rendered page can pick up zero-width characters or a non-breaking space. Retype it, or pipe through xxd and look at the actual bytes.

Flag

trace{9f4a5b5289f7a9e9e691618838bf602a}

Takeaways

1. A prompt that hints at a decoy is describing your first result. “Louder online than they think” said, before any searching, that the obvious address would be wrong. Read the flavour text as specification.
2. Website ≠ active channel. Curated surfaces go stale; social pages carry what the operator actually uses. When they disagree, the working channel usually wins.
3. Negative results are progress. Redacted WHOIS closed a branch in one query.
4. Enumerate all surfaces before committing. The discrepancy between listings was the entire finding.
5. Hash encoding is part of the answer. echo vs echo -n is a one-byte difference and a total mismatch. When a spec mentions a newline, it’s warning you about a real failure mode.

A note on scope

The target here is a business publishing contact details in order to be reached, and the WHOIS registrant data was redacted and stayed that way. Nothing in this chain touches a private individual’s personal information.

That distinction is the one that matters in this kind of exercise: the same techniques pointed at a person who never asked to be findable produce a very different, and much less defensible, result. Email addresses in this writeup are partially masked — not because they’re sensitive, but because publishing plaintext addresses feeds scrapers, and the business gains nothing from that.

Sources

• Chubby Meows — the venue’s own site; the footer carries the info@ decoy address
• Chubby Meows on Facebook — the active channel in Lahore where the working address is handed out
• WHOIS — the GDPR-era conflict that made redacted registrant data the default
• GNU coreutils: echo — -n: “do not output the trailing newline”, the one byte the whole stage turns on
• Python hashlib documentation — md5(b"...").hexdigest(), bytes in, nothing appended
• Challenge: Athena Trace 2026 — “I Love Cats”

Figure: screenshot of a Google Maps place gallery. Map data and interface © Google; user-contributed photograph © its respective contributor. Reproduced here for the purpose of analysis and commentary.