Challenge 22: The Ghost Account
Disclaimer: This scenario is fictionalized and designed for educational purposes. Any names, aliases, or narrative elements are part of a constructed exercise intended to support analytical skill development. Participants are expected to rely solely on publicly available information and to conduct all research responsibly and ethically.
Hey Digital Detectives,
When the analyst went missing, I started monitoring every channel we shared, including the sock puppet accounts he ran. We kept the credentials for those personas in shared records so we wouldn't step on each other's work, which meant I had access to their email accounts. If he surfaced anywhere, or if someone else tried to use what he left behind, I wanted to see it. His last post went up on July 2. It's been 100 days since I asked for your help in Challenge 21, and in all that time, nothing. No messages, no sign-ins, no posts.
Early this morning, the email account tied to one of his personas received a security notification. Someone had signed in to the sock puppet at 3:13 AM, local time, from a device and location the account had never been accessed from before.
When I looked into it, I found that the account had published a new post minutes after that sign-in. A single photograph with a short caption, nothing like what he ever posted on that persona. Two minutes later, an account with no posts of its own left one comment underneath it:
Still looking for him?
I haven't changed the password or locked anyone out. If whoever has this account realizes it's being watched, I lose the only live lead I have.
I've been tracking Red Scorpion for a year now. It started this same weekend last year, with an adversary who didn't just steal identities, but mimicked them. Before I act on any of this, I need to know if that post came from him.
Intelligence requirement
Your role
You are assisting Mrs. OSINT as an external analyst. The persona is perigee.watch, a satellite-tracking account on a photo-sharing platform called Framewell. Your investigation starts with the two artifacts below, and any open-source research you do from what you find there is fair game.
Framewell works like Instagram. Click any username to open that profile, open a post to see its comments, and use the ··· button on a profile for About this account. Hover over or tap a date to see the exact time, and use Image info on any post for its camera details.
Ground rules: observe only. Don't follow, comment on, or try to interact with any account, and leave the website itself alone. Its code and hosting are out of scope.
Artifacts
Your objectives
Answer those two and you've answered the question I need most. If you want to keep pulling the thread:
New to account analysis? Start here
Before you can say something is out of character, you have to know what in character looks like. Open the oldest post first and work forward. For each one, note the date and time it was posted (hover over the date), the time zone shown with it, the camera (open Image info), how the caption is written and how it ends, and what the photo shows.
A note on one post might look like this: Post 3 · posted 6:40 PM (UTC+01:00) · Canon EOS R6 · short caption, all caps, ends with a hashtag · beach at sunset
Do that for a few posts and the pattern shows itself. Then open October 30 and check it against your notes. Anything that doesn't match is a finding.
Your assessment
Close out with a short assessment, the way you'd brief it to me. Everyone answers these three in the form:
A well-supported "undetermined" is a valid answer. A confident answer you can't back up is not.
Went further? Add these
Who: if it isn't him, who is most likely operating the account, and what do they want?
Alternative explanation: one you considered and why it's weaker.
Intelligence gap: what you still can't answer.
Next collection: what you'd look at next.
A note on AI use
Work the evidence yourself first. Building the habit of reading a profile, cross-checking details, and reasoning through a conclusion is the actual point of this exercise. If you use AI tools at all, treat them as a last resort for a narrow, stuck point, not a first move, and be prepared to explain your reasoning in your own words.
Submit your findings
Submissions close Sunday (11/1) at 11:59 PM ET. The challenge stays live after that. If you're working it later, share your walkthrough or approach in the comments.
