OSINT Challenges

Day 5

Advent of OSINT 2025 — Day 5 | OSINT4Fun

Q) In France, some municipal decrees (« arrêté » in French) are rather unusual, such as those forbidding the character encountered on 3rd December from disrupting Santa’s work. In December 2024, such decrees can be found on the WordPress sites of two communes. What are the surnames of these two mayors?

We need to locate the laws that were passed by municipal councils in France that forbid “Grinch” from disrupting Christmas. We are told that in December 2024 the decrees were uploaded to the city’s official (WordPress) website.

Government orders are generally uploaded to government websites as PDF documents. WordPress stores documents in a folder called “wp-content.” If the decree was uploaded as a PDF, then the URL to the file would contain the word “wp-content.”

Using this assumption, I crafted the following Google Dork:

inurl:wp-content "arrêté" "grinch"

The inurl: operator makes Google look for the word in the URL. The ".." (double quote) operator makes Google look for the exact word. So, this query will only return results that contain “wp-content” in the URL and “arrêté” and “grinch” in the body.

The first 3 results are official websites of French cities. The 3rd result, however, has an upload date of December 2022 and can be eliminated. The first 2 results fall in the time frame mentioned in the question.

Both PDFs had a decree that mentioned Grinch, but since I don’t read French, I was not sure what this law was talking about. I used Google Translate to translate the text into English.

The content in the PDF is not in text format, so you will not be able to select the text and translate it directly. I had to use Adobe’s document conversion service to first convert the PDF into an editable Word document.

Convert PDF to Word | Adobe Acrobat

Special Christmas Order 2024 | Ville Villers-Semeuse

Special Christmas Order 2024 | Ville Andrezieux-Boutheon

For the translation, I understood this was the correct decree. Both documents contained the mayor’s name at the end.

Dupuy Driol

Day 6

Advent of OSINT 2025 — Day 6 | OSINT4Fun

You come across this inspiring video on LinkedIn.

Q) Which influencer was the first to make this video go viral?

This question was a little weird for me, as I just stumbled into the correct answer. I am not sure if this was the intended way to solve the challenge.

First, I used a LinkedIn post date extractor to find out when the video was posted.

The post on LinkedIn was made on April 17, 2022. Since we know this is a reshare, the original post will have been made on a date before April 17, 2022.

A video is nothing but a collection of images. Which means we can use the same technique we have used with images to find videos. Using screenshots taken at different points in the video, we can find videos with similar content.

This works because most of the time frames from the video are used as the thumbnail. Luckily for us, social media sites only use frames from the first few seconds to decide the thumbnail. So using screenshots from the start of the video, we should be able to find all sites on which this video was posted.

I took the 1st frame from the video and performed an image search. There were multiple results from LinkedIn, but none of these accounts had sufficient followers to be called an influencer.

There was also a post by an account on Facebook that had thousands of followers; however, this video was posted after April 17, 2022, which disqualifies it.

The result also had a news article. This caught my attention because the title mentioned Anand Mahindra, who I know is the chairman of the Mahindra Group. Mahindra Group is a large multinational conglomerate from India.

The article has a direct link to Mahindra’s post on Twitter/X. The video was uploaded to Twitter on April 1, 2022, which is before the April 17, 2022 date. Clicking on Mahindra’s name will take us to his Twitter page.

He has over 11M followers and can definitely be called an influencer. Anand Mahindra turned out to be the correct answer.

Anand Mahindra

I also performed an image search using a frame that is a few seconds into the video. With this frame I was able to get Mahindra’s post on Twitter/X as the first result.

Day 7

Advent of OSINT — Day 7 | OSINT4Fun

In 1963, the Beatles released the first edition of their Christmas “flexi disc.” These limited editions, both humorous and a symbol of the group’s musical and artistic creativity, were distributed to members of the band’s British fan club.

Q) In the first flexi disc, one of the boys speaks at 4:05 and thanks three people. What are their surnames?

Since The Beatles are quite popular, I decided to just search Google to find the name of the Christmas album they had released in 1963.

The album name can also be found using the album cover provided in the question.

Using the Wikipedia article, I learned that the album was called “The Beatles Christmas Record.”

From the article we also learn that they continued the practice of sending out recorded Christmas albums on flexi discs till 1969.

Next, I searched Google for an MP3 version of the album. I found a link to the Christmas album on Internet Archive. By listening to the audio at the time mentioned in the question, I heard George Harrison thank 3 people.

The Beatles — Complete Christmas Collection

You can also pull up the transcript/lyrics for the album and read through it to find the 3 people that are thanked.

Collingham Rose Kelly

Q) When Freda Kelly is mentioned, you can hear the group exclaim « Good ol’ Freda! ». Several years later, this expression would be chosen as the title of a documentary about Freda’s life. In the trailer of this documentary, Freda explains that she had naively given her personal address for the fan club, and this is briefly illustrated by an envelope. From which city and which country does the mail come?

At the 0:45 mark the envelope in question can be seen.

The thing to understand here is that the address that is given at the bottom is the recipient’s address. The sender’s location can be found out from the text on the stamp. I searched online for “Galati” and found out that this is a town in Romania.

Galati Romania

Q) Those Beatles’ flexi discs are collectors items; for instance, a 1965 flexi disc is part of a museum’s permanent collection. What is its inventory number?

Using the Wikipedia article, I find out that the Christmas album released in 1965 was called “The Beatles Third Christmas Record.”

I searched for this album along with the word “museum” and found a link that took me to the site of the museum in Liverpool.

On this page I could see the inventory number for the record.

MLL.2005.41.28

Day 8

Advent of OSINT — Day 8 | OSINT4Fun

Q) Near this department store, several shots for a classic French film were illegally filmed without permission at the end of the 20th century. What is the filming date of these stolen shots?

Since we are given an image with no other clues, I performed a reverse image search on Google. From this I discovered that the department store in the picture is called “Galeries Lafayette” and is located in Paris.

Christmas display at Les Galeries Lafayette — Wikimedia Commons

Next, I decided to use Google dorking and look for articles that mention the store along with words like “illegal” and “movie.”

Galeries Lafayette "illegal" "movie"

This led me to a post on IMDb for a French theater play.

“Emmenez-moi au théâtre” — Trivia — IMDb

The post talks about a movie that has an illegal scene that was filmed at this location. The name listed on the poster is the name of the movie in question.

This post is listed under a TV show on IMDb since the movie is based on a theater play.

The name of the movie is “Le père Noël est une ordure.”

Santa Claus Is a Stinker (1982) — IMDb

Which translates to “Santa Claus Is a Stinker” in English.

Santa Claus Is a Stinker — Google Search

Finding the time at which this scene was filmed proved to be quite challenging. No matter how hard I looked, I could not find a single article that listed the date on which the illegal scene was shot. I could not even find it by setting my location to France using a VPN.

If anyone knows how this question can be solved using Google please let me know.

Defeated I turn to ChatGPT to see if it would find the date. The answer it provided was primarily based on an article from a French website.

I scanned through the article, and sure enough, it mentioned the date on which the illegal scene was filmed.

December 1981

If you found this write-up to be useful consider:

• Liking the Post: You can like (applaud) the post up to 50 times.
• Leave a Comment: Your feedback and comments are invaluable. They not only support me, but also enrich the discussion for other readers.
• Share the Article: If you believe others would benefit from this article, please consider sharing it within your network.
• Follow Me: Feel free to connect with me on Medium, LinkedIn, GitHub and Discord.
• Explore More: All of my posts can also be accessed on Source Code.

Thank you for your time. Your support motivates me to continue writing.