In this new OSINT challenge, we will provide some hints to solve a problem that is common among those who want to buy or rent a house. Though it did not start as an actual OSINT challenge — that's what happened, more or less...
Thursday evening, 08:33 PM. The phone beeps, it is a Telegram notification. The message says:
"Guys, any chance you can help me? I saw a house, but I am not in town and I don't want to go on a wasted trip. I can't understand the area where it is located: 🔗 LINK. Do you think you could tell me the address?"
Well, we never back out of a challenge. And if that challenge is meant to help someone, even better!
The ad starts with: "For privacy purposes, the advertiser did not indicate the exact location of the property" — which sounds quite unusual, when it comes to downtown homes. To make our OSINT challenge more appealing, we will omit the city where the house is, and we will use, as the starting point, a selection of the 49 pictures in the original ad.
Finding the key elements
We can perform our analysis dividing it into three fundamental steps: identifying the city, narrowing the area, finding the house. To do so, we need as much information as possible. We then start by analyzing the elements in the pictures:
Bedroom
Looking at the first picture, the shape of the room suggests that we are in an attic (in blue 🔵) with a skylight ( in yellow 🟡) . This element will surely help us identify the correct building among the assumptions that we will make. We then notice a door phone (in green 🟢). Considering its unusual location, it is probably used as an intercom. So, the house must be built on different floors, at least three — with two floors only, it would be quicker to shout up the stairs, rather than to use an intercom.
Kid's room
If we took a thorough look at the room, we would definitely spot several interesting details. We focused, though, on a specific detail instead: a drawing representing a bridge, with an arch in its middle and, at its back, what looks like a castle. The fact that it is not framed and that is stuck to the wardrobe rather than nailed to the wall suggests that it must have been drawn by the room occupant. So, it is likely to represent something in the surroundings. We are setting this information aside for later.
The view outside the window
Obviously, the outside view provides most of the information and is probably the only way to gain further hints on where we are. The first key element is the mountain in the background (in red 🔴), because its profile is particular and easily recognizable. In the section marked in purple 🟣, we distinguish three areas: the first one, a small forest with few houses; the second one, the river; and the third one, that looks more densely populated. Below, we see a flat, dark roof (in white ⚪), which lacks railings — so, you probably cannot walk on it. At the same level, more or less, it is followed by two attached roofs (in blue 🔵). On the left, there is a building (in green 🟢) with particular shape and color compared to the other ones. For sure, it is not inhabited — it is more likely to be a factory, or an industrial building.
Step #1: Identifying the city
With all these details on hand, we start our OSINT research to determine the city where we are. For sure, we start by identifying the mountain in the background. To do so, this time, we are not using the Reverse Image Search as we did in the previous challenge, but Google Lens instead. So, we go to images.google.com, upload the picture of the view, select the mountain only, and find out that we are... definitely, in the wrong place.
Probably, Google Lens is including the elements that are out of our selection. So, we crop the picture to leave nothing but the mountain, and we repeat the procedure:
The first result seems to match the mountain profile. To confirm our assumption, we search for other images of "Monte Ascensione" (i.e. Mount Ascensione):
That's it, for sure. So, we probably are in the city of Ascoli Piceno.
Confirming the assumption
Observing the morphology of the territory on the map, it must be Ascoli Piceno, with no doubts. In fact, Ascoli Piceno is the only city in the area that is crossed by a river and far enough to see the mountain rather small. But if you look for total certainty, then you can have it by googling “Ascoli Piceno ponte” (i.e. “Ascoli Piceno bridge”, in English). Why a bridge? Scroll up to the drawing in the kid’s room, keep it in mind and then look at the search results:
It's a match, isn't it?
Step #2: Narrowing the area
Ascoli Piceno is not such a big city, but neither that small to analyze it all. So, we must narrow it down. First, the ad mentioned an "Independent house for sale in the Old Town", so we are going to isolate the historic center with WikiMapia.org:
In this way, we have considerably narrowed our research field. We can do better, though, if we consider the 3 areas identified in the previous stages: the forest 1️⃣ followed by the river 2️⃣ and, last, by a densely-populated area 3️⃣. Based on this, we marked in green 🟢 the area that best meets the criteria:
Can we do better than this? Yes. Despite the presence of buildings in front of the house, the landscape is visible. So, the house must be on an elevated area, or in an area not far from the river. We can then take off the inland and narrow our area of interest as follows, marked in red 🔴:
Step #3: Finding the house
Having narrowed our search field so much, we can easily find the house looking at the located area and searching for the key elements identified at the beginning of our analysis. In particular, we are looking for an orange industrial building, close to the river, with a white, round aerial and some sort of a small tower. Not far from it, towards the inland, there should be two attached roofs, followed by a black surface. Last, the house we are looking for features some skylights.
So, the house is in Via Giosuè Carducci, 2, 63100 Ascoli Piceno (AP), Italy.
Conclusions
Even this time, we demonstrated how every small detail — like a drawing in a photo — can be a source of much useful information, in the framework of a complex, comprehensive OSINT analysis.
Do you like our OSINT challenges and their solutions? Take part in the next one! Contact us to propose the next challenge.
