When I started this room, I honestly thought it would be another quick OSINT challenge.

Cache Me Outside — Following a Retired Hacker's Digital Footprints | TryHackMe Write-up

Cache Me Outside — Following a Retired Hacker's Digital Footprints | TryHackMe Write-up

"OSINT isn't about collecting information. It's about knowing where to look next."

When I started this room, I honestly thought it would be another quick OSINT challenge.

I expected to search for a username, find a few social media accounts, answer the questions, and move on.

I couldn't have been more wrong.

This room does a great job of showing how one small clue can lead to another until you eventually reconstruct someone's entire digital footprint.

Let's walk through how I solved it.

Challenge Overview

The room introduces us to a retired hacker who supposedly disappeared from the cybersecurity scene years ago.

The only thing we're given is a leaked conversation screenshot.

No usernames.

No IP addresses.

No domains.

Just a screenshot.

That meant the investigation had to start with whatever unique information was visible inside the image.

Step 1 — Finding the First Lead

Whenever I'm solving an OSINT room, I try to identify the strongest pivot point instead of searching randomly.

Looking carefully at the conversation, one thing immediately caught my attention.

A public Komoot profile.

Instead of wasting time searching different platforms, I opened the profile directly.

The Komoot profile revealed two very useful pieces of information:

The target's full name
His GitHub profile

That was enough to continue the investigation.

At this point, the first challenge question was already solved.

Step 2 — Inspecting GitHub

The GitHub profile looked surprisingly clean.

There was no email address in the profile.

No contact information.

No obvious clues.

Only a single repository.

I opened the repository and started checking everything.

README.

Repository files.

Commit history.

Still nothing.

At first, I thought I had reached a dead end.

Step 3 — Git Never Forgets

One thing I learned while doing OSINT is that GitHub stores much more than what appears on the webpage.

Instead of looking at the commit itself, I opened the patch version by simply adding:

.patch

.patch

to the end of the commit URL.

Immediately, the commit metadata appeared.

Along with it…

The author's email address.

That solved the second question.

It also reminded me that developers often expose information without even realizing it.

Step 4 — The Hardest Question

Finding the phone number was definitely the most difficult part of this room.

I searched the GitHub profile.

I searched Google.

I checked archived pages.

Nothing.

After spending some time looking for another clue, I discovered that sending an email to the exposed address triggered an automatic response.

So I gave it a try.

A few moments later, I received an automatic reply.

The email signature contained exactly what I was looking for.

Sometimes the answer isn't hidden on a website.

Sometimes it's hidden inside an automated email signature.

Step 5 — Following the Username

Now I had something much stronger than before.

A GitHub username.

Instead of stopping after finding the phone number, I searched for the same username across multiple social media platforms.

Eventually, I found additional accounts.

Most of the posts weren't useful.

Except one.

One image contained a small billboard in the background.

Most people would probably ignore it.

I didn't.

After zooming in, I noticed the text:

irigatii.ro

That tiny detail became my next pivot.

Step 6 — Reverse Image Investigation

Rather than guessing the location, I opened Google Lens.

The billboard matched a real business.

After checking Google Maps, I finally identified the city.

The target was located in Timișoara, Romania.

Step 7 — The Final Clue

Only one question remained.

The tram station where the target got off on 7 May 2026.

Since I already knew the location, all I had to do was inspect the nearby tram stations using Google Maps until everything matched the challenge description.

Investigation Flow

Discord Screenshot
        │
        ▼
Komoot Profile
        │
        ▼
GitHub Profile
        │
        ▼
Commit History
        │
        ▼
Patch Metadata
        │
        ▼
Email Address
        │
        ▼
Auto Reply
        │
        ▼
Phone Number
        │
        ▼
Username Pivot
        │
        ▼
Social Media
        │
        ▼
Billboard
        │
        ▼
Google Lens
        │
        ▼
Google Maps
        │
        ▼
Tram Station

Discord Screenshot
        │
        ▼
Komoot Profile
        │
        ▼
GitHub Profile
        │
        ▼
Commit History
        │
        ▼
Patch Metadata
        │
        ▼
Email Address
        │
        ▼
Auto Reply
        │
        ▼
Phone Number
        │
        ▼
Username Pivot
        │
        ▼
Social Media
        │
        ▼
Billboard
        │
        ▼
Google Lens
        │
        ▼
Google Maps
        │
        ▼
Tram Station

What I Learned

This room isn't about using advanced tools.

It's about thinking like an investigator.

Every piece of information becomes the starting point for the next step.

Instead of searching everywhere, you simply keep pivoting from one clue to another.

That's exactly how many real OSINT investigations are performed.

Final Thoughts

I really enjoyed this room.

It's beginner-friendly, but it teaches one of the most important concepts in OSINT:

Always follow the evidence.

One screenshot was enough to uncover a GitHub account, an exposed email address, a phone number, social media accounts, a real-world location, and finally the exact tram station mentioned in the challenge.

If you're new to OSINT, I definitely recommend giving this room a try before moving on to more advanced investigations.

Contents