## Geolocating a random island with geometry + CUDA — investigation summary ### What this topic is Three days ago (2026-08-16), a developer blogging as **yassa9** published a writeup solving **Sofia Santos' "Gralhix OSINT Exercise #004"** — a photo of a resort on an island — **without Google Lens**, using pure geometry and a CUDA GPU brute-force search. The full pipeline is open-sourced in the repo [`yassa9/geoint` → `gralhix_004`](https://github.com/yassa9/geoint/tree/main/gralhix_004). ### The challenge (official) [OSINT Exercise #004 on gralhix.com](https://gralhix.com/list-of-osint-exercises/osint-exercise-004/) asks three questions about the photo: (a) resort name, (b) island coordinates, (c) cardinal direction the camera faced. Difficulty is rated Easy for all three for experts. ### What yassa9 did differently (the "what changed") Instead of reverse-image search → resort website → Google Maps (the standard OSINT route), they built an **algorithmic geolocation engine** ([writeup](https://yassa9.github.io/osint/gralhix-004)): 1. **Metadata** — `exiftool`: nothing (WEBP, no EXIF/GPS). 2. **Geometric fingerprint** — a click-GUI records P0 (the resort islet), P1 (right island), P2 (left-front mountain island); the angle at P0 and the P0–P1/P0–P2 distance ratio become the fingerprint, with ±20% tolerance. 3. **Global candidate generation** — from OSM's `land-polygons-split-4326` (882 MB coastline vectors): tropics band (−30°…30°) → 141,131 polygons; local-density cap (≤10 neighbors within 5 km) → 51,576; clustering (≥3 points within 20 km) → 23,500 clusters; stratified sampling → **80,690,777 candidate triangles**. 4. **CUDA kernel** ([`match_kernel.cu`, 206 lines](https://github.com/yassa9/geoint/blob/main/gralhix_004/gpu_kernel/match_kernel.cu)) — one thread per triple on an RTX 3050 (sm_86): insertion-sort by area to pick P0 (smallest), a 2D cross product to assign P1/P2 by winding, then angle/ratio/size/sep windows; survivors write via `atomicAdd`. **80.7M triples in 204.1 ms, ~5.2 GB VRAM** → 158,784 pass → 8,915 unique after dedup. 5. **Cascading geo-filters** — open-water rectangle test → 948; coral-cay shape (Polsby–Popper compactness ≥ 0.5 + micro-cay halo) → 213; oval check via minimum rotated rectangle (aspect 1.05–2.2; fill ratio ≥ 0.75·(π/4), the ellipse ceiling) → 137; **NDVI ≥ 0.6** from Sentinel-2 via the Earth Search (Element84) STAC API → 66; **Copernicus DEM GLO-30** elevation (P0 ≤ 50 m; a 100–500 m peak in the ±50° fan 2–20 km ahead) → **26 survivors**, mostly southern Asia/Australia/Oceania plus one Brazil. 6. **Final report** — country lookup (Natural Earth) + Google Maps links; eyeballing the 8th row landed on **Micronesia**. ### The answer reached - (a) **Oan Resort** (on Oan Island) - (b) **7°21′48.4″N, 151°45′20.7″E** (7.363444, 151.755750) - (c) Camera facing **NW** (computed bearing 324.97°) This matches the established community answer exactly: [Orangutank's writeup](https://blog.cybercrun.ch/gralhix-osint-exercise-004/) gives Oan, 7.363269475869274, 151.7560074554341, camera NW; [Stefan Bulatovic's walkthrough](https://medium.com/@sbulatovic88/gralhix-osint-exercise-004-f9c1ea7ad709) gives Oan Resort, 7°21′47″N 151°45′20″E, North West. ### Why it matters - **It validates a compute-first geolocation approach**: a purely geometric "triangle fingerprint" exhaustively matched against every land polygon on Earth reproduced, with no image recognition at all, what the OSINT community found by eyeballing reverse-image hits. The kernel's 204 ms for 80.7M hypotheses shows GPU brute force making an "impossible" global search trivial. - **It inverts the standard OSINT playbook** into a reusable template: fingerprint → exhaustive search → geometric/spectral/terrain filters (compactness, NDVI, DEM) → final manual verification. - **It showcases free open geodata as building blocks**: OSM land polygons (ODbL), Sentinel-2 via Earth Search STAC on AWS (keyless), Copernicus DEM GLO-30 on AWS Open Data, Natural Earth boundaries — all cited and licensed properly in the writeup's data section. - **Relevant context**: the author explicitly notes "genuine human work, didnt use LLM generation" — Gralhix rejects walkthroughs with heavy suspected AI involvement, and her page states she is no longer accepting walkthroughs for #004. ### Caveats (from the source itself) The author admits the filters are hand-tuned heuristics ("everything became heuristic haha"), the drone elevation was guessed by intuition, and the cluster cap of 60 points means the search is sampled, not strictly exhaustive. The writeup is not on the official gralhix community-walkthrough list. **Key sources opened:** [yassa9 writeup](https://yassa9.github.io/osint/gralhix-004) · [GitHub repo (pipeline + README)](https://github.com/yassa9/geoint/tree/main/gralhix_004) · [CUDA kernel source](https://github.com/yassa9/geoint/blob/main/gralhix_004/gpu_kernel/match_kernel.cu) · [Official challenge page](https://gralhix.com/list-of-osint-exercises/osint-exercise-004/) · [Orangutank/cybercrun.ch walkthrough](https://blog.cybercrun.ch/gralhix-osint-exercise-004/) · [Stefan Bulatovic (Medium) walkthrough](https://medium.com/@sbulatovic88/gralhix-osint-exercise-004-f9c1ea7ad709)