What you don’t see and I do (part 2)
12 de May de 2025
A real investigation (Mario Casas edition)
A couple of weeks ago, we introduced what the discipline of OSINT involves—what tools are used, what kind of information can be obtained, and who uses these techniques.
But a promise is a promise, and a bunch of theory without a practical part falls short. At the end of the previous post, I mentioned we were going to take a look at the social media profiles of a public figure (Mario Casas) and see what kind of information we could extract.
Before we begin, I want to make a few things clear:
- The profile was chosen at random. I started thinking about famous Spaniards and he was the first that came to mind. What I mean is that I could have selected a profile I knew for sure would give me juicy information, but that would have made the exercise less authentic. OSINT is not an exact science, and you don’t always find the information you’re looking for—this is something I think is also important to convey.
- Obviously, I respect everyone’s privacy, and I will not share any sensitive information about any individual on this blog.
Let's go!
As I was saying, let’s take a look at Mario Casas’ social media to see if we can extract any interesting information. One of Mario’s most active platforms is Instagram. In fact, judging by the comments and the kind of photos he posts, it seems like he manages this account himself.
One important detail to pay attention to is that public figures with a certain level of fame usually have verified profiles. If you search for “Mario Casas” on Instagram, you’ll find a surprisingly large number of accounts under that name—but the one we’re interested in is the one with the blue checkmark.
Looking through his latest posts, one from the summer of 2024 really caught my attention.
If we read some of the comments on this post, we see that the photo shows Mario with his brothers, celebrating a barbecue at his house. Leaving aside the fact that it’s a collaboration with Coca-Cola, it does seem, at first glance, that the photo was taken at Mario’s home.
If we assume this statement is true (“the photo was taken at Mario’s house”), we can use this image to try to figure out the address of his home. Do you think that’s possible?
Back in the day, a common practice (still used, though less so on social media) was to check the metadata of images, since in many cases you could find the GPS coordinates where the image was taken, along with other interesting bits. Nowadays, however, social media platforms strip out metadata when you upload images to their servers.
For me, in OSINT, there are three basic principles:
- Pay close attention.
- Read carefully.
- Read between the lines.
That said, if we look closely at the photo, we can see a rather promising reflection in the window: it’s showing us what the neighboring house looks like, and what the neighbor’s chimney looks like (which, I’ll tell you in advance, tends to be a pretty distinctive feature).
However, let’s be honest—this image alone won’t be enough to figure out Mario’s address. Let’s keep browsing through his Instagram.
Around the same time as the previous photo, Mario and his brother posted this picture. Take a look at the caption: “Keeping what’s always mattered—moments in the neighborhood and with family.”
Mmm, interesting. Could it be that this place is located in the neighborhood where he lives? Let’s find out.
There’s something quite distinctive in this image: the bottle display with the sign above it.
We crop the part of the image we’re interested in and head over to Google Lens to use reverse image search and see what we can find.
Among the first results, we come across two particularly enlightening ones:
- On the one hand, there’s an article in Esquire magazine featuring an interview with Mario and Óscar (his brother), conducted in this bar as part of a campaign with Coca-Cola.
The article doesn’t mention the name of the bar, but it does include some interesting statements from Mario:“I live on the outskirts of Madrid, and the bar I go to is a place I use to disconnect, to get out of the house, have a snack with a Coke…”.
Alright, now we know Mario lives relatively close to this spot. Let’s keep reading:
“These ‘two neighborhood guys’ have found their own little refuge in Torrelodones, a charming town near Madrid.”
Bingo! We’re narrowing it down.
- The second interesting link we find is the Facebook page of the bar in question, which is called Espanis, located in Las Rozas, right next to Torrelodones.
Among the photos on this page, you can easily find the bottle display with the distinctive sign.
Alright, is this enough to find the house?
We’ve narrowed down the area quite a bit, but unless we have all the time in the world, it doesn’t seem very feasible. Let’s see if we can find another clue.
Let me tell you another little secret about OSINT:
Sometimes, even if we are very careful with our privacy, other people in our circle might not be as cautious, and it’s usually within the close circle where the best clues are found.
This photo wasn’t posted by Mario, but by his sister, and it gives us more interesting details:
It has a pool next to the house.
The pool is not exactly square; it has an unusual shape. Maybe an L-shape?
The surroundings of the pool are made of wood.
And if we keep digging a little more into related accounts, we find a reel from the day of the barbecue in the first photo, where we can see the following details:
- There is a covered barbecue to the right of where they are eating, which should be quite visible from an aerial view.
- The pool indeed has an L shape.
- There is a pine tree at the back of the property, in front of the pool.
- From this perspective, two houses can be seen in the distance.
Alright, I’ve provided enough clues. In the end, it’s all about following the thread and finding little breadcrumbs related to what we’re searching for.
At the end, we open the aerial view from Google Maps, put together everything we know, and…
Got it! If we play around with the perspective, we can confirm all the clues we’ve been gathering, such as the facade of the neighboring house, the barbecue, the pine tree at the back of the property, or the two houses visible in the distance.
Is that all?
Actually, not. If we were conducting a real investigation, our ideal case would be that this account had appeared in a data leak.
This is another common way of “pulling the thread,” which can lead us to discover email addresses we don’t know, which in turn can lead us to other profiles on different social networks, phone numbers, etc.
Let’s take a look:
At first glance, it seems that we may have a match with their username on a social network called Wattpad. It’s a platform where people can publish their own books or stories, recommend books, etc.
Have we been lucky?
Unfortunately for us (but luckily for Mario), that’s not the case, and his personal data doesn’t seem to have been leaked. The account we found on Wattpad belongs to someone with a taste for Turkish literature…
As I mentioned at the beginning, with OSINT, we don’t always find what we’re looking for, that’s the reality. But without a doubt, it is an incredible source of information used by journalists, private detectives, police forces around the world, and intelligence services.
I hope you really enjoyed this article and learned something useful (among other things, to value your privacy a little more).
I’ll say goodbye until next time, and I hope to keep finding interesting topics to post about. If you want to make an inquiry, or even suggest a topic for future posts, you can do so here.
