OSINT Challenge #2 – The ideal house

OSINT Challenge #2 – The ideal house

In this new OSINT challenge, we will provide some hints to solve a problem that is common among those who want to buy or rent a house. Though it did not start as an actual OSINT challenge — that's what happened, more or less...

Thursday evening, 08:33 PM. The phone beeps, it is a Telegram notification. The message says:

"Guys, any chance you can help me? I saw a house, but I am not in town and I don't want to go on a wasted trip. I can't understand the area where it is located: 🔗 LINK. Do you think you could tell me the address?"

Well, we never back out of a challenge. And if that challenge is meant to help someone, even better!

Original picture of the ad found on the idealista website

The ad starts with: "For privacy purposes, the advertiser did not indicate the exact location of the property" — which sounds quite unusual, when it comes to downtown homes. To make our OSINT challenge more appealing, we will omit the city where the house is, and we will use, as the starting point, a selection of the 49 pictures in the original ad.

First picture used for OSINT analysis among those selected from the idealista real estate website
Second picture used for OSINT analysis among those selected from the idealista real estate website
Third picture used for OSINT analysis among those selected from the idealista real estate website

Finding the key elements

We can perform our analysis dividing it into three fundamental steps: identifying the city, narrowing the area, finding the house. To do so, we need as much information as possible. We then start by analyzing the elements in the pictures:


Key elements in the first picture used for OSINT analysis

Looking at the first picture, the shape of the room suggests that we are in an attic (in blue 🔵) with a skylight ( in yellow 🟡) . This element will surely help us identify the correct building among the assumptions that we will make. We then notice a door phone (in green 🟢). Considering its unusual location, it is probably used as an intercom. So, the house must be built on different floors, at least three — with two floors only, it would be quicker to shout up the stairs, rather than to use an intercom.

Kid's room

Key elements in the second picture used for OSINT analysis

If we took a thorough look at the room, we would definitely spot several interesting details. We focused, though, on a specific detail instead: a drawing representing a bridge, with an arch in its middle and, at its back, what looks like a castle. The fact that it is not framed and that is stuck to the wardrobe rather than nailed to the wall suggests that it must have been drawn by the room occupant. So, it is likely to represent something in the surroundings. We are setting this information aside for later.

The view outside the window

Key elements in the third picture used for OSINT analysis

Obviously, the outside view provides most of the information and is probably the only way to gain further hints on where we are. The first key element is the mountain in the background (in red 🔴), because its profile is particular and easily recognizable. In the section marked in purple 🟣, we distinguish three areas: the first one, a small forest with few houses; the second one, the river; and the third one, that looks more densely populated. Below, we see a flat, dark roof (in white ⚪), which lacks railings — so, you probably cannot walk on it. At the same level, more or less, it is followed by two attached roofs (in blue 🔵). On the left, there is a building (in green 🟢) with particular shape and color compared to the other ones. For sure, it is not inhabited — it is more likely to be a factory, or an industrial building.

Step #1: Identifying the city

With all these details on hand, we start our OSINT research to determine the city where we are. For sure, we start by identifying the mountain in the background. To do so, this time, we are not using the Reverse Image Search as we did in the previous challenge, but Google Lens instead. So, we go to images.google.com, upload the picture of the view, select the mountain only, and find out that we are... definitely, in the wrong place.

Results from Google's Reverse Image Search, using the whole picture

Probably, Google Lens is including the elements that are out of our selection. So, we crop the picture to leave nothing but the mountain, and we repeat the procedure:

Results from Google's Reverse Image Search, using the cropped picture

The first result seems to match the mountain profile. To confirm our assumption, we search for other images of "Monte Ascensione" (i.e. Mount Ascensione):

Comparison between an HD picture of Mount Ascensione and the one used for the analysis

That's it, for sure. So, we probably are in the city of Ascoli Piceno.

Confirming the assumption

Observing the morphology of the territory on the map, it must be Ascoli Piceno, with no doubts. In fact, Ascoli Piceno is the only city in the area that is crossed by a river and far enough to see the mountain rather small. But if you look for total certainty, then you can have it by googling “Ascoli Piceno ponte” (i.e. “Ascoli Piceno bridge”, in English). Why a bridge? Scroll up to the drawing in the kid’s room, keep it in mind and then look at the search results:

Results of our Google search for the query

It's a match, isn't it?

Comparison between the drawing and the picture of Ponte di Cecco in Ascoli Piceno

Step #2: Narrowing the area

Ascoli Piceno is not such a big city, but neither that small to analyze it all. So, we must narrow it down. First, the ad mentioned an "Independent house for sale in the Old Town", so we are going to isolate the historic center with WikiMapia.org:

City map of Ascoli Piceno, with its old town highlighted

In this way, we have considerably narrowed our research field. We can do better, though, if we consider the 3 areas identified in the previous stages: the forest 1️⃣ followed by the river 2️⃣ and, last, by a densely-populated area 3️⃣. Based on this, we marked in green 🟢 the area that best meets the criteria:

View on the city of Ascoli Piceno, with its key area highlighted

Can we do better than this? Yes. Despite the presence of buildings in front of the house, the landscape is visible. So, the house must be on an elevated area, or in an area not far from the river. We can then take off the inland and narrow our area of interest as follows, marked in red 🔴:

Identification of the minimum area where it is more likely to find the house with further OSINT analysis

Step #3: Finding the house

Having narrowed our search field so much, we can easily find the house looking at the located area and searching for the key elements identified at the beginning of our analysis. In particular, we are looking for an orange industrial building, close to the river, with a white, round aerial and some sort of a small tower. Not far from it, towards the inland, there should be two attached roofs, followed by a black surface. Last, the house we are looking for features some skylights.

Key elements in the third picture used for OSINT analysis
House found via Google Earth


Even this time, we demonstrated how every small detail — like a drawing in a photo — can be a source of much useful information, in the framework of a complex, comprehensive OSINT analysis.

Do you like our OSINT challenges and their solutions? Take part in the next one! Contact us to propose the next challenge.

Francesco Marano
Francesco Marano
Founder | Cyber Security Consultant

I'm an offensive cyber security expert with several years of experience as penetration tester and team leader.I love making software do things other than what they were designed to do!I do security research to find new bugs and new ways to get access to IT assets. I'm a speaker at events talking about my research to share my findings and improve the awareness about cyber security issues.

Related Posts