This is challenge number 2 in the 2021 SANS Holiday Hack Challenge ( Objective:

Welcome! In this game you will analyze clues and track an elf around the world. Put clues about your elf in your InterRink portal. Depart by sleigh once you’ve figured out your next stop. Be sure to get there by Sunday, gumshoe. Good luck!

This challenge seeks to put your Open-source intelligence (OSINT) skills to the test through game play. The goal is to track an elf that is traveling across the world. The idea is to catch this elf and identify them when you do. If you can’t then you lose. In order to correctly guess who the elf is once you catch them, you must investigate and collect information as you play. At the same time, you must investigate to learn what location the elf has flown to next. The kicker is that time passes when you investigate and search for clues in the InterRink portal (taking you closer and closer to Sunday). So this game is about balance between investigating too much and too little. Investigate too much, and you run into the deadline. Not enough investigation and you will fail to guess once you finally catch up.

Location clue #1 starts with:

Newly renovated, the castle is again host to the best holiday hacker conference in the world, KringleCon. Security specialists from around the world travel here annually to enjoy each other’s company, practice skills, and learn about the latest advancements in information security.

Not 100% sure where the elf is headed based on this, so we perform our first investigation. The clue is:

Their next waypoint was something like 51.219, 4.402

This was a long/lat coordinate that I was able to search on Google maps

Objective2 longlat

This tells us our next location is Belgium. However, we still don’t know anything about the elf so lets perform another investigation. The second clue is

They just contacted us from an address in the range.

We already know Belgium, but to double check we can run a whois on that IP range

88665a561824:Downloads bryan$ whois
% IANA WHOIS server
% for more information on IANA, visit
% This query returned 1 object


inetnum: -
organisation: RIPE NCC
status:       ALLOCATED


changed:      2001-04
source:       IANA


inetnum: -
netname:        BE-BELGACOM-ADSL1
descr:          ADSL-GO-PLUS
descr:          Belgacom ISP SA/NV
country:        BE

So now we have double checked that Belgium is the next location, but we still don’t have any intel on the elf. Let’s perform another investigation

They were dressed for 2.0°C and clear conditions. Oh, I noticed they had a Star Trek themed phone case.

We now learn that the elf we are trying to catch had a Star Trek themed phone case. We can use InterRink to lookup elves who are fans of Star Trek

Objective2 fandom

Objective2 possible elves

Ok, so we now know that the possible elves are

Sparkle Redberry, Ginger Breddie, Noel Boetie, Tinsel Upatree

Let’s depart for Belgium!

Objective2 belgium

We arrive and the first investigation clue for tracking our next destination is:

They said, if asked, they would describe their next location in three words as “frozen, push, and tamed.”

So it sounds somewhere cold. Let’s look at investigation clue number 2

They were checking the Ofcom frequency table to see what amateur frequencies they could use while there.

A quick Google search tells us that Ofcom frequencies has something to do with the UK, so we have our next destination. However, we still need to further narrow down the possible elves. Let’s look at clue number 3

They were dressed for 2.0°C and clear conditions. They kept checking their Snapchat app.

This tells us that the elf we are searching for uses Snapchat. We can now add that to our InterRink search

Objective2 interrink2

Objective2 upatree

Alright, there is only 1 match for elves who preferred social media is Snapchat and who are fans of Star Trek. We have now determined that Tinsel Upatree is our elf! So now we can move forward to our next destination (London,England)

Objective2 england

Our first investigation clue is

I think they left to check out the Défilé de Noël.

A quick google search turns up that Défilé de Noël is associated with Montreal. We know our next destination! And since we already know our elf we don’t need to investigate any further. Off to Montreal!

Objective2 montreal

And this is where we catch up to the elf, and make our guess.

Objective2 guess

Objective2 win

And we see that we guessed correctly. Tinsel Upatree was the correct answer!

Objective2 win