Geolocating counterfeit money stacks via OSINT & SOCMINT
Delve deeply into the conducted investigation
Hey investigators!
In today’s blog I will write about a spontaneous OSINT/GEOINT challenge I performed during which had to find the exact geolocation of a video showing money. A lot of money!
The truth is, it wasn’t an official OSINT challenge posted. Instead, someone tagged me in a video that was posted on Bruce Bane’s X profile. As always, I couldn’t resist taking on the task; it’s just not in my nature to let things go without digging in.
First and foremost, I watched the posted video to gather initial impressions regarding the overall background and atmosphere. The goal was to identify indicators that could provide clues leading to the precise geolocation.
Strong Indicators:
- The video reveals the presence of wind turbines and mountains on the horizon.
- I observed a “COPY” sign on the $100 banknote, strongly indicating that it could be counterfeit money.
- Additionally, it’s evident that there is a sea and islands on the horizon.
- Another significant indicator I’ve identified is the presence of “GEÇERSİZDİR” written on the $100 bills in Turkish, translating to “Non-negotiable” or, in other words, fake and worthless (Sahte in Turkish).
This strongly suggests that the potential location might be in Turkey.
I decided to give my beloved Google Lens a try, hoping it might provide potential matches for the input and deliver similar photos or even reveal the source of the image.
Tip: If you’re using a smartphone, clicking on the potential match can lead you to similar videos and sources across the web.
So, that’s precisely what I did. Because after clicking on the potentially similar picture on Google Lens, I hit a dead end as there wasn’t any corresponding video on TikTok as it initially suggested.
Here’s what I got on my smartphone:
With that in mind, I opted to visit the TikTok videos to gather some additional clues.
This video was posted by a well-known individual named “abzalyes.” The first two pinned videos showcase a substantial amount of money, and the second image is of the same location from the original video that Bruce Bane posted on his X.
I decided to do some dumpster diving to find juicy stuff on his TikTok.
Here’s some indicators I found:
All the videos I discovered on his page featured a guy named "anardreams" and some other individuals. The intriguing aspect was that they consistently filmed the money in the same villa. Hence, I decided to employ a powerful AI tool, as demonstrated in my previous blog – the tool called GeoSpy.
Guess what? It’s the same country I suspected based on the fake $100 bills with Turkish writing. Moreover, we now have a specific city named Bodrum, providing us with a valuable clue.
To cross-verify whether the island and the sea seen earlier could provide any potential insights, I opted to consult ChatGPT.
To bolster this evidence, I decided to upload the picture of the villa to Google Lens, leveraging its superb utility for identifying similar constructions.
I indeed found an interesting thing.
Can you spot the wind turbines? its the same as showed in the video.
I successfully located it on a real estate rental website in Turkey.
It’s the identical surroundings as the ones captured in the original video.
I also observed that all the cars/trucks in their videos share the same format, and there is a “TR” in the left corner of the license plate, indicating Turkey. These consistent pieces of evidence suggest that we are getting closer to pinpointing the exact geolocation.
After considering all these factors, I decided to scrutinize the wind turbines in detail to pinpoint their location on the map.
In this case I used a very powerful tool named Overpass Turbo.
Overpass Turbo is a powerful web-based tool that allows users to query and visualize data from the OpenStreetMap (OSM) database. It provides a convenient interface for creating and running queries to extract specific geographic information.
This specific query looks for nodes with the specified tags within a bounding box covering Turkey, which means in our case, it searches for wind turbines in Bodrum Turkey.
/*
This query finds wind turbines in Bodrum Turkey.
*/
[out:json];
(
node["power"="generator"]["generator:source"="wind"](35.8086, 26.0417, 42.1077, 44.7920);
);
out body;
>;
out skel qt;
There is also a World Turbine Map that can be very useful in this case.
Here’s what I came across in the Google Maps community pictures, its the same turbines.
Here are the turbines captured on satellite imagery:
You can see the turbines on the horizon
After conducting some SOCMINT on Youtube and other social platforms, I discovered that this hotel complex is named Bovilla Hotels & Villas in Yalikavak.
The exact coordinate of the video: 37.084387, 27.262355
As you witnessed during my OSINT investigation, we uncovered numerous details on the go that led us to the exact location of the money in the video. The video was shot in Bodrum Turkey, and we identified similar videos from TikTok users flaunting substantial wealth. However, it turned out to be a rented villa with counterfeit money, prevalent in various parts of Turkey.
Throughout the investigation, I also discerned that these individuals are Russians who brought their vehicles to Turkey, conversing in the Russian language. The helicopter shots they feature are also revealed to be rented. The investigation underscores the importance of attention to detail and a keen eye, emphasizing the necessity of thinking outside the box in this type of investigative work while using the right OSINT & SOCMINT tools.
Digital forensics empowers you to explore territories you might not have anticipated and unearth details that could even expose misinformation.
Don’t forget to connect with me on social media.
