Raptor Reserve

Hacktoria ran Raptor Reserve over 36 hours on 5–6 September 2026. Two people finished it. I placed first.

The answer is Isla del Coco, Costa Rica — cocos_island_costa_rica. It is worth putting that here rather than at the end, because the interesting part of this one is not what the island was.

Two finishers is not a difficulty rating, because this challenge was not hard in the way CTFs are usually hard. There was no clever cipher and no rabbit hole. There were three separate places where you could do everything right and still see nothing at all, and the last one is the reason most people stopped.

The brief

The only information we have is that the place is called “Raptor Reserve”. The invite itself was passed along via a printed note.

Since this leaves so few options, I’ll extend your mandate beyond passive information gathering. Once you’ve identified someone involved with the day-to-day operations on the island, you’re allowed to electronically communicate with them to get information.

Flag format: name_of_island_country.

So: one proper noun, and permission to talk to someone once you find them. That second half is the real instruction. It tells you the answer is not sitting on a web page — it has to be asked for.

One word to start from

One thing I had going in, and it changes what follows, so it belongs here rather than in a footnote. The night before launch the challenge author posted this in the Hacktoria Discord:

A website and a mailbox exist, and neither is named in the briefing. Everything below is the search for two things I already knew were there.

Searching "Raptor Reserve" gets you nowhere. You get bird-of-prey rehabilitation centres in New Jersey and North Carolina, an African raptor centre in Camperdown, a chick pre-order programme, and a couple of Russian nature reserves. Nothing remotely island-shaped.

That is not a dead end, though. It is a data point. A term with no relevant search presence, in a CTF that launched hours ago, means the infrastructure exists but has not been indexed yet.

Freshly registered domains resolve immediately. Search engines take days.

So stop searching and start resolving.

Guessing the domain

Type raptorreserve.com into the address bar. Nothing. Type raptor-reserve.com. There it is.

That is the whole step, and it is worth being blunt about it, because the reflex here is to reach for a tool. Two guesses off a two-word name, and the hyphen is the first thing you try when the first thing fails.

Had those two missed, the next move is a handful more spellings at once rather than one browser tab at a time:

for d in raptorreserve.{com,org,net,io,co,info,xyz} \
         raptor-reserve.{com,org} theraptorreserve.com; do
  ip=$(dig +short "$d" | tail -1)
  [ -n "$ip" ] && echo "HIT  $d -> $ip"
done

HIT  raptor-reserve.com -> 172.66.0.70

Everything without the hyphen is dead; the hyphenated .com is live. 172.66.0.0/16 is Cloudflare, so that address tells you who fronts the site and nothing at all about where it is hosted.

The elegant approach failed, and that is worth recording. Certificate Transparency should have caught this — Cloudflare issues a certificate the moment you put a site behind it, and that certificate lands in the CT logs. I queried crt.sh for %raptorreserve% and %raptor-reserve%:

ct1.json -> 0 entries
ct2.json -> 0 entries

Nothing, for either spelling. Log propagation delay, rate limiting, or both. If I had treated CT as authoritative I would have concluded the domain did not exist and gone looking somewhere else entirely.

Against day-old infrastructure, typing the name into a browser beat the clever method.

The site

A single-page Carrd site. Marketing copy for an “exclusive experience”, a slideshow of AI-generated dinosaurs, and — at the bottom, exactly where you want it — a contact:

For inquiries please send an email to Lewis Catson, our Operational Director.

The address was not in the source as plain text. Cloudflare’s email obfuscation had replaced it with a data-cfemail attribute — the address hex-encoded and XOR’d byte by byte against a key sitting in the first byte.

There is no need to decode that yourself. Cloudflare ships a script that unpacks the attribute in the browser, so the address is already in the rendered page: open the site normally, right-click the contact link, copy address. view-source: shows you the hex, the live DOM shows you the answer.

If the script is blocked or you only have the saved HTML, CyberChef does it in two operations — From Hex, then XOR with the first byte as the key.

lewis.catson@raptor-reserve.com

Worth confirming the mailbox is real before writing to it, rather than after:

MX   5 mx1.hostinger.com.
MX  10 mx2.hostinger.com.
TXT  v=spf1 include:_spf.mail.hostinger.com ~all

Live mail infrastructure on Hostinger, nameservers on dns-parking.com, SOA serial 2026090403. Set up the day before the event.

Everything else on the site was a dead end, and checking that took two minutes: no subpages, no HTML comments, no hidden elements, sitemap listing only the index, and every image stripped of EXIF by Carrd’s processing pipeline. The dinosaur art is generated. There is no geography in it.

Making contact

The site says the clientele is ultra-wealthy and the referrals stay inside billionaire circles, so that is the role. I wrote as a recipient of the printed note.

The important thing is what you ask for. Do not ask “where is the island” — an operator in character can refuse that. Ask the questions someone actually arranging a trip would ask, where refusing makes no sense:

• Which airfield does my pilot file for?
• Which port should my captain clear, and what are the approach coordinates?
• Whose jurisdiction are we in, and do I need a visa?
• Nearest hospital with a trauma unit, and evacuation time?

Any one of those answers gives you a country. And then the part that actually mattered:

The images on your page look rendered. I’d like actual photographs of the accommodation and the grounds, taken on site, exactly as they came off the camera.

Because the flag was never going to be in the prose.

A reply arrived within the hour: a status update on the settlement, the boat routes and the cave system, signed off by the Operational Director, with Hacktoria’s own “this is fictional” disclaimer at the foot. And three images.

A note for anyone building a similar pretext: the reply came from a Hostinger vacation autoresponder (X-Loop: Hostinger Mail Virtual Vacation). Nobody read my carefully constructed logistics questions. Any email at all would have returned the same three images. My pretext was theatre — good practice, zero causal effect. Worth knowing which parts of your tradecraft actually did work.

Three empty frames

Here is where the challenge actually caught people, and it catches you twice.

The first time is in the inbox. Gmail showed three lines of text and then gave up:

Gmail clips a message over roughly 102 KB. Three inlined images push this one far past that, so what you get by default is the first paragraph and a link — the rest of the briefing, and every image, sits behind “view entire message”.

The second time is after you click it. Now you have the whole mail, and three empty rectangles where the images should be:

Three frames, correct size, no content. This looks exactly like a message whose images failed to load — the thing you shrug at. The text around them is the actual briefing: a perimeter wall under the canopy, plotted boat routes, helicopter tours dropped because the jungle is too dense, cave exits connected to underground tunnels. The villain copy is the challenge’s fiction, and Hacktoria’s disclaimer saying so is at the foot of the same mail.

They had not failed to load. They were never external files, so there was nothing to load.

This is the part that has to be said plainly, because it is where the challenge ended for most people: the frames are empty because it is Gmail. Two separate Gmail behaviours stack up here. It clips the message because three inlined images make it large, which is the notice in the screenshot above. And it does not render data: image URIs at all — Gmail sanitises them out of the HTML it shows you, so even the full view gives you sized, empty boxes.

The author said as much himself, a few hours into the event:

The shortest fix is not a decoder, it is a different mail client. Proton, Thunderbird, anything that renders data URIs shows the three images with no work at all — which is worth knowing before you build a pipeline for a problem your inbox invented.

I did not have that hint, and went the other way. It gets you the same three files and it works in any client, including the one that broke: the raw source is one menu entry away.

Gmail → ⋮ → Show original (German UI: “Original anzeigen”). On a message that renders wrong, this is the first move — it shows you what actually arrived, rather than what your client decided to draw.

<img src="data:image/jpeg;base64,iVBORw0KGgoAAAANSUhEUg...

In the raw source the images are right there, inlined into the HTML body as base64 data URIs. Nothing had to be downloaded — the bytes were in the message the whole time, and getting them out needs no tooling at all: copy one data:image/...;base64,... string, paste it into the browser address bar, and the image opens. Right-click, save. Three times.

One thing will bite you. MIME wraps long lines, so the string you copy out of the raw source carries line breaks and possibly soft-break markers — paste that and you get a broken image. Strip the whitespace first; CyberChef’s Remove whitespace into From Base64 does it if the string is long enough to be annoying by hand.

The other detail changes nothing here but is worth knowing: the src declares image/jpeg while the decoded bytes start \x89PNG. The browser renders it anyway, because it sniffs the content and ignores the label. Trust the bytes.

Three images out. And the raw source gives you the headers for free: DKIM had actually failed on this message (body hash did not verify), because the mail routed through a MailChannels relay that rewrote links in the body after signing. SPF and DMARC passed, so it landed in the inbox anyway.

What the metadata said

No GPS. All three were Canva renders (xmp:CreatorTool: Canva (Renderer) ... brand=HACKTORIA), which strips location data. But Canva preserves the document titles, and those were a free table of contents:

catson-email-images - settlement
catson-email-images - boat-routes
catson-email-images - the-cave

Geolocating the island

The images themselves were the payload, and all three were Google material:

1. A satellite crop with a Google Earth crosshair — a settlement beside a river mouth, two long light-roofed buildings and several smaller teal-roofed ones, muddy sediment discolouring the bay.

The crosshair is Google Earth’s own, so this is a screenshot of a lookup someone else already did — the building layout and the sediment plume are the two features that will have to match.

2. A Street View panorama shot from an inflatable boat, looking at a steep forested shoreline over turquoise water.

A boat bow in the frame means this is Street View, not a photo — and Street View collected from a dinghy narrows the planet to a handful of coastlines.

3. A Street View panorama on foot, at a cave mouth in dense jungle.

Ground-level Street View with no road under it: a backpack trekker walked this. Boat plus trekker on the same island is the combination to search for.

Image 2 is the one that solves it. Street View coverage taken from a boat, along the shore of an uninhabited tropical island, exists in almost no places on Earth. Combine it with image 3 — a trekker on foot, inland, in rainforest — and you are looking for a remote island where Google ran a special collection with both boat and backpack.

The email text narrows it further: dense closed canopy, a cave system with multiple exits, a boat-navigable route, and enough room for a settlement and a lodge. Helicopter tours were dropped from the programme because the jungle is too dense.

That is a searchable description, and it is where the reasoning turns into a query. Google publicises these collections, so the special-collect is the search term — not the terrain:

google street view boat island national park collection
"street view" trekker island uninhabited "no roads"

Both routes land on the same short list of islands where Google ran a bespoke collect. Cross it against the constraint the email adds — rainforest, a cave system, a ranger settlement — and one name survives.

Isla del Coco, Costa Rica.

Why not Galápagos

Galápagos is the obvious competitor and has to be knocked out explicitly, because it satisfies the first three criteria: a Google special collection, boat-based coastal Street View, uninhabited protected islands. It fails on vegetation. Galápagos is arid — cactus, scrub, bare lava. Images 2 and 3 show closed rainforest canopy with tree ferns and leaf litter, which does not exist there. The cave system settles it in the same direction: Cocos is cut by lava tubes and sea caves in wet forest; the Galápagos tubes sit in dry highlands with nothing resembling image 3 around the mouth.

Isla del Coco fits on every axis. Google captured Street View there as part of the platform’s Costa Rica launch, using cars, bikes and backpack trekkers depending on terrain. The island has no roads, so a boat collection is the only way to cover the coast. Its single permanent settlement is the ranger station at Wafer Bay, sitting at a river mouth — which is what puts the sediment plume in image 1. And Michael Crichton used the island as the model for Isla Nublar in Jurassic Park, which is the entire joke the challenge is built on.

Confirming it

Two independent confirmations, and the first one is the stronger.

Open the coast of Isla del Coco in Street View and drive the blue line that runs over the water. The bow of the dinghy and the rope across it are in every frame — the same bow, the same rope, in the same position as image 2. The challenge image is not like Google’s boat coverage. It is a frame out of it.

Same vessel, same rope, same capture run. This identifies the imagery, which is worth more than matching a hillside — a forested shore looks like every other forested shore.

Then the settlement. Navigate to Wafer Bay on the north shore and put image 1 beside it: the two long light-roofed sheds, the teal-roofed buildings around the lawn, the paths running down to the beach and the sediment-brown water off the river mouth.

The building layout carries across at a different scale and a different capture date. Ranger station at Wafer Bay — the island’s only permanent settlement, which is why the case could put a lodge here at all.

One thing to watch. Maps and Earth pull different satellite tiles, and the tile over the island interior is heavily clouded at mid zoom — enough to make you think you are in the wrong place.

The cloud is a tiling artefact, not evidence against. Step the historical imagery slider to another date, or zoom into the northern bays, and the island is clear.

Flag: cocos_island_costa_rica

Takeaways

A term with no search results is information. No index presence plus a live event equals infrastructure that exists but is too new to be crawled. Switch from searching to resolving.

Record what failed, not just what worked. Certificate Transparency should have found this domain and returned nothing. Had I trusted it, I would have ruled out the correct answer.

When an image does not render, ask whether the failure is yours or the sender’s. The rendered view is an interpretation of the message, not the message. Three empty frames looked like a delivery failure and were a client behaviour — Gmail clipping a large mail and stripping data: URIs. The fix was either a different client or the raw source; the mistake was assuming the frames were empty for everybody.

Identify the imagery, not the landscape. A forested hillside matches a thousand forested hillsides. The dinghy bow in the frame matches exactly one Street View collection run, and that is a much narrower claim to verify.

Ask for logistics, not for locations. “Where is the island” is refusable in character. “Which airfield does my pilot file for” is not, and it yields the same country.

Sources

• Challenge: Hacktoria — Raptor Reserve, run 5–6 September 2026; flag format name_of_island_country. The challenge page credits Klumgongyn; the site and the mailbox were announced by Frank in the Discord the night before. The challenge page now lists raptor-reserve.com as a hint — the domain guessing above is the route in if you did not wait for it.
• Cloudflare email address obfuscation — what puts data-cfemail in the markup, and why the address is not in the HTML as text
• Google Maps — Isla del Coco — turn on the Street View layer: trekker lines inland, boat lines along the coast
• Isla Nublar — the Crichton connection, and the reason the case is about dinosaurs
• Isla del Coco National Park — UNESCO listing; uninhabited apart from the ranger stations, one of them at Wafer Bay