On the 20/11/2024 around 13:30 , Tadmor (Palmyra), situated in central Syria, was targeted by several airstrikes. Several videos came out in the hours after the attack.

This article aims to show the results of these airstrikes and verify the areas hit by them. Five out of six airstrikes have been verified, but for the last one, it was not possible to find proper footage of the area involved in the attack, nor was it possible to verify it using Sentinel Hub.

The document

Through research on social media, it was possible to find a post from the Facebook page of the “Studies & Documentation Centre in Palmyra City” describing the attack and providing the address of the location of the six airstrikes. Using the footage taken from the streets at the moment of the strikes, the addresses, and Sentinel Hub, it was possible to pinpoint the locations of the various airstrikes.

P.S. The article follows the order of the strikes as presented in the document, not their chronological order.

The first two strikes — 1/2

According to the document, the first two airstrikes took place at this address: H79G+955 تدمر، سوريا. Both explosions were visible from the streets and hit a residential area.

One of the first videos found on X shows both strikes mentioned in the Facebook post. The video displays two large columns of smoke in the direction of the mentioned address, with no other columns visible in that direction. For convenience, we will refer to this footage as “Video Reference 1.”

Another video from X, which for convenience we will label as “Video Reference 2,” was taken from along the same street as the first video, but further west. It shows the two strikes again, this time from a better point of view.

By combining the points of view from the two videos and using the buildings as references, it is possible to better understand what people on the street were observing at the moment of the strikes. This also helps in determining the precise locations of the strikes.It is important to note that, in “Video Reference 2,” it is possible to catch a glimpse of one of the buildings that was hit.

A few days later, Sentinel Hub updated the satellite images of the location, making it possible to see the two areas impacted by the airstrikes and gain a better understanding of the affected areas. Additionally, the address mentioned in the post was clearly hit.

Thanks to Sentinel Hub, combined with another picture found on Facebook, it is possible to see a missing building in the area of the second strike.

Both strikes hit what appears to be a residential area. The first strike is at the coordinates (34.568399, 38.275547), and the second one is at the coordinates (34.566520, 38.278447). It is important to mention that the missing structure, hit by the second strike, is labeled as a school on Google Maps.

The second strikes — 3/4

At a certain point, “Video Reference 2” turns the camera west, capturing two massive columns of smoke. The two explosions, also visible from the perspective of “Video Reference 1,” are located in the same area as the address mentioned in the previously discussed Facebook post.

Another frame from a video on Facebook, pointing west — as indicated by the presence of the castle in the top-left corner — also shows the two columns of smoke.

Thanks to Sentinel Hub, we can clearly see the area impacted by the airstrike. Cross-checking with the address mentioned in the Facebook post, it is evident that the area was indeed affected. It is also important to note that there appears to be a fifth strike in the same area (marked with a blue arrow).

As labeled on Google Maps, Strike №3 (34.565155, 38.273302) hit three condominiums (C1, C2, C3). While Strike №4 (34.564795, 38.267540) likely hit another residential area, as there is no specific labeling on Google Maps. The same for the Strike №5 (34.563300, 38.270297)

The last two strikes

The last two strikes mentioned in the article were located at the address H796+3C6 تدمر، سوريا. It was not possible to find any footage suitable for verifying the location of these two strikes. Additionally, even using Sentinel Hub, no visible changes could be detected in the area between November 17th and November 22nd.

False positive

At the coordinates 34.567962, 38.266485 on Sentinel Hub, it is possible to spot a darker area. Satellite imagery and Google Earth were used to verify whether this is an impact area. Google Earth shows a dark patch on the ground which, although it appears to resemble an impact area, is highly likely to be a false positive. Additionally, a picture from Sentinel Hub taken during the same period in 2023 shows a very similar image.

Here is a map from Google Earth showing all the locations of the airstrikes mentioned in this article, which took place in Tadmor (Palmyra) on 20/11/2024.

P.S. I wrote this article using only the information I was certain about.

I chose this particular geolocation from the Bellingcat Discord server, where there’s a dedicated channel for the members of the Discord to help geolocate videos and other media. Completed geolocations often end up on the Eyes on Russia map.

This is a great opportunity to challenge yourself, learn, and do something meaningful at the same time.

I picked this specific geolocation because it initially seemed especially challenging, but then turned out not to be. I thought the process I used to find the location would be a helpful example for those less experienced in geolocation.

P.S. I am just a member of the Bellingcat Discord server and i am not, in any way, affiliated with them or the CIR (Centre for Information Resilience).

THE DOCK

“Жителька одного з пошкоджених від падіння уламків «шахеду» будинків, чий 17-річний зараз знаходиться у лікарні, розповіла, що пожежа почалася приблизно через чотири хвилини після падіння уламку.

«Ми були на той стороні причалу. Почули що він падає, що він вже близько падає. Я схватила дитину за руку, ми встигли добігти до їдальні, до середньої кімнати. І все — нас завалило. Як ми вибралися — я не знаю», — повідомила Катерина.

Прислать новость @our_odessabot Забустить канал👉 @boost 👉🏻 ПОДПИСАТЬСЯ “

This is the picture in question, with its caption in Ukrainian from Telegram. There was also a video, but I did not use it, so I won’t mention it in this write-up.

Let’s break this down:

The picture shows a location on the water, so it could be a river, lake, or even a coastline.

We have a caption that needs to be translated (if, like me, you don’t speak Ukrainian).

I decided to start with the caption and translate the text to see if there was any additional information. Since we’re talking about Telegram, I just used the built-in feature to translate the text.

P.S. Normally, the spreadsheet for this project already has the city written, and in this case, the video was shared by a channel about Odessa.

Translating the text gave me more information and also guided me to Odessa. I was looking at the damage caused by the fall of a “Shahedu,” which I believe refers to the “Shahed” drones (please correct me if I’m wrong). It also confirmed that I was looking at a pier.

At this point, I gathered the most obvious information I could from the picture. However, the picture is too small, and I can’t just open Google Earth and start looking for that specific pier in Odessa.

So, the next step I took was to reverse-search the image. Google reverse image search did return results for this picture, but in this specific case, I chose to use Yandex. Why? Because I’m working on the Ukrainian-Russian conflict, and the most relevant languages are Ukrainian and Russian. Yandex should work better than Google, or at least narrow down the results to more helpful information, rather than websites simply using the picture without providing the details I needed.

P.S. You might still find something with Google, but in this case, I personally found that Google gave me too many unnecessary results.

As you can see, I opened all the links, but the first three are the most important.

Following one of the links, I ended up on a YouTube video with the title:

Одесса 5 минут назад. ПОСЛЕДСТВИЯ ОБСТРЕЛА ОДЕССЫ! ПЕРВЫЕ КАДРЫ С МЕСТА! ЖЕРТВ СТАЛО БОЛЬШЕ!

“Odessa 5 minutes ago. THE CONSEQUENCES OF THE BOMBARDMENT OF ODESSA! FIRST SHOTS FROM THE SCENE! THE NUMBER OF VICTIMS HAS INCREASED!”

This is indeed the same picture I was provided with, but there is an important difference. It is less zoomed in, making it possible to see behind the structure. There is a piece of land, which, in my mind, could mean that we are indeed on a coast but at a location where there is an inward indentation into the region. Alternatively, we could be looking at a narrower water surface, like a lake or river, and that piece of land might be the opposite shore.

So basically, one of these two options (see above picture). Also, the video gave me more information about the event. We can see that there has been a fire.

At this point, after noting the date from the YouTube video, I also tried using FIRMS and Sentinel Hub to see if there were any fires around Odessa, specifically in the locations where I thought I was more likely to find the right match. I had no results; they are great tools, but sometimes you also need a bit of luck to find exactly what you need.

LITTLE STEP AWAY.

The next part wasn’t really necessary to geolocate the picture, but I want to share a tool. I decided to look into the YouTube account that posted the video about the incident and found a second video. There were some more pictures, but I was more interested in what the person was saying.

So, I downloaded the video and used AssemblyAI Playground to get the transcript.

It’s a useful tool, honestly, especially when you need to translate languages you don’t know.

Anyway, the video didn’t provide much more information, except that the location is probably suburban, so I decided to look for it directly on Google Earth.

To recap:

• It’s a pier
• The YouTube video indicates there was a fire and gives us a better understanding of the building’s shape
• From the building, it’s possible to see the opposite shore, as it’s very close
• Suburban area

I like exploring Google Earth maps, and this was my first guess. But the area is too large, and the coastline doesn’t look like the one in the picture. The coast is covered in beaches, and then there’s the port.

Also, looking back at the YouTube video, it’s possible to see that the opposite shore looks very close and doesn’t seem to have any houses.

That’s why I shifted my attention to this part of the map. Since there aren’t many houses, especially with a dock, I started searching in this area.

And that’s how I found the location at 46.549384, 30.656294.

I’m writing this a week after completing this geolocation, and while doing this write-up, I realized there are many more methods. This wasn’t a difficult one, but what I wanted to focus on in this article was the reasoning behind it.

Let me summarize it for you:

• Collect all information: From the image and the text.
• Expand the information (find more pictures, more videos, etc.).
• Focus on the information that provided important clues (mostly the images).
• Develop hypotheses based on the information.
• Verify those hypotheses.

I hope you enjoyed this write-up and that, if you’re new, it gives you some good ideas for your next geolocation.

Hey hey! Welcome to a new entry on my blog. It’s been a while since I’ve shared anything, and now that it’s summer, I thought it was a great time to do some more exercise. This is going to be the write-up of exercise 22 from Sofia Santos. If you haven’t tried it before, give it a shot before reading my entry. Hope you enjoy it. Let’s dive in!

THE EXERCISE

In Japan, everyone knows about Truck-kun, the entity that drives around the streets, looking for people to send to another world, usually by killing them. In this exercise, we have to geolocate and find the license plates of two similar trucks. Are they Truck-kun? Maybe. But for sure, it’s a matter of national security. Or perhaps just a suggestion on where to go if your dream is to be the main character of an Isekai.

Sorry, I had to give this introduction. If you don’t know who Truck-kun is, search for it. Now, let’s move on to the exercise.

Your task is to:
a) Find the link to the camera’s live feed.
b) Geolocate the security camera.
c) Find the license plate of the vehicle highlighted in blue.
d) Find the licence plate of the vehicle highlighted in orange.

Let’s look at the two picture that sofia provided to us in her exercise.

So, we have two different pictures with two Truck-kuns resting at a port. The pictures were taken from the live feed of a camera, and we know the name of the port: Yamoto Fishing Port. We also have two different dates: one from 2023 and one from 2015.

Let’s geolocate the place first, shouldn’t be so difficult.

Typing “Yamoto Fishing Port” into Google Maps led me directly to this port in Japan. By checking with Street View, I was able to double-check that I was looking at the correct location. Google Maps did show me another result, but I knew I was looking for a port, and I was sure, based on the name, that we were talking about Japan.

As you can see, there’s the same mural, and Truck-kun is also there, resting between one victim and another. It’s probably the truck from 2023. It looks very similar, with a red crane and a blue container on the back.

Before moving to the research of the plates, I want to take a look at the camera feeds and geolocate the camera.

In order to find the camera feed, I decided to search again for “Yamoto Fishing Port” and look at Google Images.

Scrolling down, one picture in particular caught my attention, especially because there was an IP address — or at least what I thought was an IP address.

This is indeed the camera feed we were looking for http://202.239.224.34/cgi-bin/guestimage.html. Now, let’s geolocate the camera, but first, I want to identify the model.

In the live feed, it says “MOBOTIX M15.” I’m not an expert on cameras, but I was curious. So, I simply did a search on Google and found a PDF file with the technical specifications of that camera.

Then, by simply using Street View, I positioned myself directly in front of the camera, just as we see in the video, and I could see the camera looking right at me.

It’s not far from the building, so it shouldn’t be too difficult to pinpoint the exact coordinates.

From the satellite view, it’s also possible to see the shadow of the pole, which means we can accurately determine its exact coordinates. (38.409480, 141.244609)

THE PLATES

Let’s now move on to the plates. When I searched for the port on Google Maps, I also noticed a link to a website.

I spent a lot of time exploring this website because I really love what they do. I recommend giving it a look, just out of curiosity. I’m not going to share the entire website here, but it’s definitely worth checking out.

The first thing I noticed as I scrolled down was a link to a Facebook page, so I followed the link and checked the profile. The person probably works there, so there might be a picture of Truck-kun.

After a bit of scrolling through his profile (which also helped confirm I was looking at the right port), I found a picture of Truck-kun. From the look of the truck, I can tell it’s probably the one from 2023. It also looks the same as the one in Google Maps, where the pictures were from 2023.

The crane is the same color, and the shape matches, so I’m sure it’s the right truck. Let’s just zoom in on the picture, and we can see the plate.

Plate 2023: 31–20

At this point, I got a bit lost trying to find the 2015 truck, but the Facebook profile didn’t have any pictures of trucks from that year. So, I searched for the guy’s name directly on Google and found his YouTube profile.

There are a few videos on his YouTube profile, and I watched all of them. In one video, from 8 years ago, the truck appears.

It’s probably the truck we were looking for, but we can’t see the plate. So, at this point, I decided to keep it simple and went back to the homepage. I noticed a link and realized it wasn’t the same website we saw before.

At this point, it was pretty easy. I searched the website and noticed a section with some dates. I went straight to 2015 and started looking for a picture of Truck-kun.

Funny enough, the video on YouTube helped me verify that it was the same truck. The crane was blue, and the tube was red, just like in the video. I simply zoomed in on the picture and got the plate.

Plate: 56–36

So, with that, I wrap up this write-up. I hope you enjoyed it, and if you did, I encourage you to try it yourself and check out my other write-ups! Have a great day!

Hey, welcome to my blog again. A few days ago, I was looking for new tools to use to monitor social media, and my research led me to this website that can help monitor TikTok. I read in the past the guide from Bellingcat on how to investigate TikTok (click the link if you haven’t read it). Also, I found a few articles on how to set up the algorithm in order to gather as much data as possible.

But I started asking myself: Is there any tool that can help me narrow down the research faster? or more precisely?

Now, I don’t know if there are more articles about it, and honestly, I did not exploit the website to its maximum. So, if you have any other suggestions on how to use it or even better tools, please share them. I’m happy to learn from anyone. Anyway, I thought that making an article about it could be helpful for anyone who works within the platform.

COUNTIK

Now, let’s go step by step; I want this entry to be a little introduction mixed with a bit of brainstorming about the possibilities of this website.

What I was looking for:

• A free tool
• Simple to use
• That can be exploited easily

This is how I came across Countik; it’s entirely free and has some nice tools that I think might be very good and helpful when you want to set up an account to monitor TikTok contents

The website has a few interesting tools, and I will concentrate on those that, for me, are more interesting to the purpose of this article.

Analytics

This is what the Analytics page looks like. After you enter the username of the account you are interested in, it will give you some information like: Total likes, Total followers, Total videos, and Followings.

So, a basic overview of the account (I am going to cover names, etc.; they are not relevant). But if you scroll down, you will have more information like Average Engagement Rates (last ten posts), Total Engagement Rates, and Average Video Performance. These are interesting data and can help decide if this account is interesting enough to monitor (I am not considering what kind of narrative or content the account shares).

In order to set up an account that we are going to use, let’s say, to monitor a specific situation X in the world where TikTok exists, consider that some countries have banned TikTok and they have their own platforms (for example, India has a platform called Moj), we might want other kinds of data.

The tools offer other insights like Hashtags, most used hashtags (by the user), mentions and top mentions.

Yes, it’s an anime account. Those data can be beneficial, particularly the hashtags, which can help you create a list of keywords to train the algorithm in your own account in order to always have videos and content about the research you are doing. The mentions can also help you do a bit of snowballing and create a list of accounts to save.

Also, it’s important to mention that the website gives you data about the most recent posts from the chosen account.

How can this be useful? I will try to make an example. We want to know if this account is buying followers and likes in order to have more shares inside the platform. With this data, if we use another platform called Social Blade, we can cross-check the data.

N.B. I have no idea if Social Blade is accurate; those numbers look a bit too rounded. If you have other free tools, please share.

In this case, taking the data as accurate, we could cross-check the views, like engagement, etc., between the two websites and try to figure out if there is something strange. In this case, looking at Social Blade data, this account might be buying followers and likes. Is this important? It can be. Let’s say an account wants to have more visibility in a particular region; using bots could help the account grow and spread its narrative.

Let’s now make a point. This feature is helpful if you have a starting point, an account from which you want to start your investigation, and you need to gather content around the narratives of this account (for example, far-right narratives, conspiracy narratives, etc.) and other accounts it might interact with.

But what if you don’t have a starting point? You don’t have an account from which you can start snowballing, but you need to create a map of accounts in your TikTok account and you want to avoid seeing too much content that is not related to your investigation.

You need keywords, possibly hashtags, and the website has a nice function for that.

TikTok Hashtag Generator

This tool, created to help people grow their accounts, can be exploited also to find relevant hashtags to find the content we want. It’s particularly interesting how we can input a keyword, in my case, “crypto.” This will give us back a series of hashtags, like:

#crypto #cryptocurrency #cryptok #cryptonews #cryptotrading #cryptoinvesting #cryptotok #cryptonx #cryptomonnaie #crypton

This is followed by a table that shows you how many times the hashtag has been viewed, giving you an insight into what could be the best hashtag to use.

Why is this important? Because you might want to narrow your research, you don’t want content from the most prominent hashtags but more from the niche, or vice versa. Also, it works as well with emojis.

CONCLUSIONS:

We are at the end of the entry, so I will just make a couple of bullet points in order to wrap everything up.

Why should I use this tool?

• Is free
• Can Help you build a map of accounts to monitor
• Can Help you to find accounts to monitor.
• Easy to use

It’s a good starting point and is not automated, I know, so it takes time, but probably this website can help you speed up the process and be more precise. I am aware that there are other tools as well, probably more professional, but I honestly found it interesting to exploit programs or websites not designed mainly for OSINT. Also, it could be a good starting point for people who, like me, don’t have broad knowledge of more complicated tools to use.

Thank you for reading; I hope you learned something and that this article might help you in some way, any way actually. Have a good day.

TikTok monitoring: setting up. was originally published in OSINT Team on Medium, where people are continuing the conversation by highlighting and responding to this story.

Task briefing:

There are countless armed insurgent groups spread throughout the globe. The three images below depict individuals associated with internationally recognised terrorist organisations.

Your task is to identify to which group they have pledged their allegiance.

a) Photo 1

b) Photo 2

c) Photo 3

So we have three different pictures; I will work on them one by one. Let’s start with the first one.

FIRST PICTURE:

The first thing I notice is the color red, which is also part of the patch on the arm of the person closest to the camera in the picture. It looks like the second color could be black. Another important clue is the presence of the letter “N,” or at least I assume it is the letter “N”. Also they are wearing a black/red bandana.

I started the research with a reverse image search on Google. I was expecting to have to crop some part of the picture, but I was lucky and found one picture (from a news article shared on a Twitter account that I am not going to post) that might be about the same peoples.

The patch looks similar, but in our picture, it’s too blurred to understand anything. However, the colors red and black are present. Also present is the letter “N” in the right position (left arm). Two more clues are the uniforms, which are the same, and also the background that looks similar in our picture.

In the tweet I found, they are called “ELN guerrillas.” With a little research, I found that “ELN” stands for Ejército de Liberación Nacional, and they are active in Colombia. Here’s their flag.

This is the patch of the group:

So the final answer is: Ejército de Liberación Nacional

Let’s now move to the second picture. I will use the same approach, analyze the picture, and then start using reverse image search on Google.

SECOND PICTURE

This picture has less information, but what I can surely notice is the uniform and the little symbol on the rifle, also is a woman and that might me important. Starting from google inverser image research i did not have a lot results, so i had to check them. One picture took my attention.

Found on a Twitter account, I noticed that this woman was wearing a very similar uniform to the girl in our picture. The tweet states “Operation Claw Lock,” a military operation of the Turkish armed forces against the PKK (Kurdistan Workers’ Party). Still, I don’t see the patch on the uniform, so I decide to dig deeper.

Using Yandex to make the search using the words “PKK,” “Kurdistan Workers’ Party,” or “PKK patch,” I found a website at https://www.militantwire.com/p/weapons-used-by-the-pkk-in-2021 with a lot of pictures.

Again same uniform, but with some differences and also the flag of the PKK is this one here below:

I am confident that this person is part of the PKK, but the flag has a red background, and the way of wearing the uniform is a bit different. While the patch we see on the rifle doesn’t present the same background. Also, I found another picture on Alamy showing more than one flag of the PKK.

At this point, I need to confirm that it’s the right group. I assume those are groups part of the PKK. Also, our symbol’s main colors are red and yellow. I don’t know any of these groups, but many of those symbols have a star in the middle, so I would check them. Also, I want to consider that the person in the picture is a woman. The first group I am able to check is the YPJ. Here’s the flag.

It’s promising, especially because it’s a women’s unit, but there’s a point in their story that sets me away; they are not part of the PKK, let’s say they have a good relationship. Also, looking at the pictures, I am not able to see something that can resemble our picture. Considering that there is a woman in the picture, I decide to have a little chat with ChatGPT, asking: Is there any wing of the PKK formed by women? The answer:

Yes, the Kurdistan Workers’ Party (PKK) has a women’s military wing known as the YJA Star, which stands for Yekîneyên Jinên Azad ên Star (Free Women’s Units).

The flag is a bit different but still very similar, so I give it a closer look.

I am able to find a video on Reddit about this group, and I decide to take a screenshot:

The rifle is the same and the symbol is the same. Also, the uniform is the same. To further prove my point, I keep researching and opening links.

Searching for “YJA Star” often brings up the media outlet ANF News. So, at this point, I decide to search in their database.

At the page https://anfenglish.com/women/-72171, I found an article with a video of the YJA Star, and now I am sure the girl in our picture is a member of this group.

The uniforms look the same, just with the sleeve down. Another video at: https://anfenglish.com/women/-72135 shows one member with the sleeves up.

Another article at: https://anfenglish.com/women/-72141 show similar uniform and sleeves up.

At this point, I am confident, after cross-checking the information and observing how they wear the uniform (not all the time), to say that the answer is YJA Star.

THIRD PICTURE

The main color is black, and they all have the same vegetated uniforms (I’m not sure if that’s the right name for that uniform, sorry) and gear. Also, in the background, it’s possible to see a little flag, black with a white triangle, and there is something written in the middle of the triangle.

Using Google reverse image search, I don’t find anything, so I decide to use the combination (“terrorist” AND “black flag with white triangle”) on Google image , I am able to find some results. In particular, one of them states the name of a jihadist group.

The flag looks the same, only reversed. But I am pretty sure the picture is depicting the Jaish ul-Adl group.

Also, searching the name on Google, it’s possible to find more pictures like this one that show the same people, or at least, people wearing the same gear and uniform as the ones in our picture.

Thank you for reading my entry; I hope you really liked it. It was very fun! If you want to see more, check my other entries here! Have a good day!

Task briefing:

The video below was recorded during an earthquake.

Please find the answer to the following questions:

a) What was the magnitude of this earthquake?

b) What are the coordinates of where the camera was likely located in order to record this scene?

GEOLOCATING THE CAMERA

So, I will start by looking at the video to see if I can identify any information regarding the city. Personally, I find it easier to first determine the city and then locate the earthquake.

In the video, as shown in the picture above, I can see “Terminal 3,” which is related to the camera/webcam that recorded the video. The date will be useful for determining the magnitude of the earthquake, and in the blue square, there’s a distinctive building (”I know you are in google” jonny is speaking with the building).

At this point, I decided to first crop the entire video and see if I get any results.

I found the same video on YouTube, but it was published 7 years ago. The video’s title is “Cutremur Chisinau 24.09.2016.” Using Google Translator, I translated this from Romanian and i got “Earthquake Chisinau 24.09.2016”. Chișinău is the capital of Moldova.

I want to geolocate the street where the camera is located. However, I don’t want to search aimlessly for that particular building, and I’d prefer not to conduct extensive research on Google. So, I’ve cropped the image of the building in hopes of getting a result.

The building is named the Antrium Shopping Centre. I managed to find a result on Yandex Map, but I’m switching to Google Maps. To expedite the process, I’m using the plugin OpenSwitchMap (which is very useful!). However, I’ve noticed that I’m not particularly happy fond of the satellite imagery provided by Google for that area. So, I’ve switched to Google Earth and set the date to 2016.

Funny fact: I don’t know if it’s part of the exercise, but I can’t use Google Street View on this street. Sofia, did you choose this location on purpose? (P.S: It might just turn out that I don’t know how to use Google Street View. I just wanted to take a walk…)

In the Yandex satellite image, I immediately recognized one of the buildings, which allowed me to narrow down the location more precisely. Now, I’m beginning to pinpoint the position of the camera.

I began pinpointing all the buildings I could see in the video and marking them on Google Earth. After this, I pinpointed the small building in the purple circle, using it as a reference to determine the correct location of the camera.

By adjusting the date on Google Earth, I was able to identify the pole on the left and use it as a second reference point to locate the camera.

I am now certain about which building I am looking at. Using the building as a reference, especially the point where the camera stops recording (indicated by the red arrows), I can pinpoint the probable location of the camera. It is likely in the building marked by the red arrows.

I’ve extracted the coordinates, and this is where I believe the camera is located: 47.017413, 28.852653 (more or less).

I was certain it was a camera attached to a wall because it moved during the earthquake and was too still beforehand to be handheld. I decided to crop the video again, and after searching on Google, I found an article that mentioned ‘surveillance camera’.

FINDING THE EARTHQUAKE MAGNITUDE.

It shouldn’t be too difficult given that we have both the date and time. I proceeded with a simple search on Google, using the formula: City + Date + Time (referring to the moment the camera began to vibrate).

At [https://agora.md/stiri/22697/foto--cutremur-puternic-resimtit-la-chisinau-magnitudinea-de-aproape-sase-grade-pe-richter], I found some information about the earthquake. To determine the earthquake’s magnitude more accurately, I visited earthquake.usgs.gov and used the date and time to search for the specific earthquake.

In earthquake.usgs.gov the magnitude is 5.7.

I checked the solution, and it turns out I got it! Sofia had positioned the camera just a few meters to the right. I also missed the Google view from inside the building, which might have been a quicker approach than what I took. However, I thoroughly enjoyed all the “geolocation calculations” I did. I hope you enjoyed this entry, and thank you for reading my blog!

Hey! Thank you for reading my new entry. I want to offer a brief introduction to this new rubric, and I want to clarify one thing: I don’t consider myself an expert. However, this blog was created to share my learning journey through the OSINT world. I generally focus on geolocation because I find it fascinating, and there’s a distinct pleasure when you pinpoint the correct location. I decided to create a section dedicated to any tips I come across that might be helpful for geolocating photos or videos. The purpose of this rubric is to share knowledge and assist those who are just starting out, as well as those who are more experienced in the practice of geolocation.

LANDMARKS: Why are they so important?

As defined by the Oxford Dictionary, a ‘landmark’ is an object or feature of a landscape or town that is easily seen and recognized from a distance, especially one that enables someone to establish their location.

But why are landmarks so important? Simply put, they provide us with the opportunity to narrow down the location of the photo we are examining. For example:

Geolocate this picture. (i know is very easy, it’s just an example)

Yes, it might seem straightforward. But what is the reasoning behind this geolocation? You see a landmark, such as the Eiffel Tower, and your first thought is, “I must be in Paris.” You then go to Google Maps and search for a structure similar to the one in front of the tower. Using Google Street View, you locate the exact spot.

This simple example illustrates why landmarks are so crucial in geolocation. The more widely recognized the landmark, the easier it will be to pinpoint the exact location. But what kinds of landmarks can you use?

Generally speaking, landmarks can be monuments, tall buildings, shop signs (we can even consider the name of a shop as a landmark), or even mountains. (I’m sure the list is even longer.)

Which are the best landmarks?

Personally, the best landmarks are the tallest ones, because they can be seen from various positions due to their height. They are generally easier to spot in satellite images as well, since they cast shadows on the ground or on the rooftops beneath them.

Look at the beautiful shadow the Eiffel Tower casts on the ground. However, depending on the place you are geolocating, you might not find any kind of landmark, or at least not one that’s easily recognizable.

So which landmarks can i use?

You need to identify your landmarks. This advice is especially useful when you at least know which city you are geolocating in; otherwise, you’ll likely need to determine the city first. This approach is particularly helpful for ongoing investigations.

Lately, in my geolocations, I’ve found it very useful to understand how high-voltage lines are distributed within a city, as well as to know the positions of potential radio towers around the town.

In areas without tall buildings, these are likely the best references to pinpoint something you might see in a video or to help you narrow down a position. Just remember, that at least you need to have them into the picture/video you are geolocating.

Radio towers:

Personally, I find radio towers the most challenging to locate because they don’t seem to follow a specific pattern; they appear to be placed randomly throughout the city. (If there’s a discernible pattern, please message me; I’d love to know!) To locate them, you’ll need to scrutinize the map closely. One hint is that, like all tall structures, they will cast a shadow on the ground. However, it’s worth noting that the visibility of this shadow can vary based on the quality of the satellite imagery you’re examining.

As you can see from the picture at the coordinates 9.058912, 7.427747, there’s a radio tower. It’s challenging to spot initially, but once you identify the shadow, it becomes easier.

In this image, we can see the same tower (I’m not entirely sure it’s a radio tower; it looks like it might not be finished. Regardless, use your imagination! I sourced this image from Google Street View.) By utilizing the coordinates of the tower, we should be able to find our precise cordinates.

As long as that tower is in plain sight, or even further away, pinpointing its location can make geolocating all videos and pictures much easier (at least video or picture that have something in common).

HIGH-VOLTAGE LINE:

That’s my favorite part: how can I spot a high voltage line?( P.s The high-voltage tower need to be on the picture or at least on the background.)

I’ve found a few rules that might be helpful to you:

First: Similar to radio towers, they cast a shadow on the ground. Be careful regarding the quality of the satellite picture, as this can affect visibility. They might not always be easy to spot; sometimes, they can be quite invisible, also sometimes is possible to see the cables.

Second: They are interconnected, generally spaced at consistent distances from each other. It can change based on the enviroment.

Third: they generally follow big or central street.

Now that you know the rules, you can locate your high-voltage line. Let me explain. You just need to find one. Naturally, if you’re aware of the general area (like a neighborhood) where your picture was taken, you can better pinpoint the position. If not, you simply start by identifying one line, then the next, and so on. In a nutshell:

First: Explore the map, getting as close as possible to where you believe the geolocation photo was taken. If you’re uncertain, begin by examining the main streets of the area you’re focusing on. If you can access Street View or even Mapillary, use them; they will help you locate the line.

In this example, I spotted this tower. (It took more time to find a new one than to use the ones I already had).

From the satellite view, I can pinpoint the coordinates of the tower (9.032843, 7.504595).

This example is actually perfect because the tower is nearly invisible.

Second: At this point, by following the street, I should be able to locate another tower not far away. Using the Google Earth ruler, you can measure the distance between the two towers.

Third: use the distance from the first measurement as a reference. Draw a line with the ruler, following the streets, and near that endpoint, there should be another tower.

In this case, we located a tower 250 meters away. So, now you have a range between 230 and 250 meters (note: sometimes they might be closer, like the one next to “tower example 3,” due to the environment). If it’s particularly difficult to spot a tower, consider using the time machine feature in Google Earth.

In this case, it also helps you see the cables, making it even easier.

Fourth: Just repeat.

This represents just a section of the city’s power line, but I can continue mapping. This will add more landmarks to my map, facilitating easier geolocation within this city.

Conclusion:

I hope this wasn’t too tedious, and thank you if you read the entire article. In conclusion, this is just advice: don’t solely rely on tall buildings or obvious landmarks. Sometimes, you need to create your own personalized map, filled with locations that can assist you in pinpointing your photos.

I hope you will find this tip usefull and that you will use it in your geolocation!

GeoTips: Ep 1 Unusual Landmarks. was originally published in OSINT Team on Medium, where people are continuing the conversation by highlighting and responding to this story.

Hello, welcome to my latest entry. Today, I am working on another exercise from Sofia Santos’s website — Exercise 011. It is particularly challenging but crucial for understanding several tricks and recognizing the importance of logic in OSINT.

To begin, I decided to conduct a Google reverse image search on the picture to see what I could find.

The picture was taken on December 17, 2015, at the signing of the Libyan agreement. Thanks to this research, I have also been able to find additional pictures that better showcase the faces of two other people.

At this point, I began to explore further within Google Images and found a picture from a different source that appears to be related to the event I am investigating. By visiting the website where this picture is located and examining other available images, I managed to find a photograph of the book that all the politicians were signing

It is also possible to view more pictures, and particularly, two of them display one of the individuals we are possibly looking for. Is possible to understand the position of the signature.

At this point, I decided to use Google Lens to analyze the signatures in the book, and I came across a PDF

The PDF I found is likely from December 17th. I infer this because, first of all, not all the signatures present in the book are in the PDF. Second, one of the signatures (it’s the first one I saw) looks the same, suggesting it’s the same individual. Also, the date is written next to a few signatures.

I start to translate the names with google lens and i obtain a list.

Using the name written in Arabic, I began to search on Google, cross-referencing with the picture I had.

Saleh Hemma Abkda

Mohamed Amazeb

Mustafa A. G. Abushagur

For the last one, I am still not sure if it is him, so I need to search for more information. I decide to go back and review the pictures again. Also, I notice, that google mess up with the translation.

Upon reviewing the pictures again, I noticed this one, so I decided to analyze it. The shape of the head looks quite similar, especially the hair. It is also possible to discern where his signature is, allowing for cross-verification.

The signature matches, and the shape of the head and the hair are quite similar, so I believe I have identified him.

Fadeel Muhammad Al-Amin

POST COMMENT:

I would like to share what I learned from this exercise. While I am not an expert (yet), I am a learner, eager to contribute my insights to the OSINT community. Firstly, sometimes it’s more effective to not overthink and to maintain simplicity. This was my second attempt at this exercise. The first time, I found myself trapped in a loop, seeking impossible ways to find a perfect match. The second time, I simply followed the “flow” — a term I fondly like to use. Often, the information we seek online is readily available, and every piece is interconnected. So, what have I realized? Sometimes it’s beneficial to pause, try different things , clear your mind, and then try again. (probably this don’t work in a workspace, but for exercise and learning yes)

The second insight gained from this exercise is more technical: the utilization of different languages is crucial. Many of these names would not have surfaced if I had searched for them in languages other than Arabic (thank you Google Translate). Great exercise as always.

Thank you for reading this write-up. If you enjoyed it and would like to read more, please click here.

Write-Up: Exercise 011 — Facial Recognition was originally published in OSINT Ambition on Medium, where people are continuing the conversation by highlighting and responding to this story.

Hi! Today, I decided to have fun trying to solve the last exercise from Sofia Santos’ website. The first part of the write-up is meant to be funny, so don’t take it too seriously. I hope you will enjoy it.

FIRST PART:

I was on my phone, bored, looking to see what was new on Instagram, when a notification blinked at the top of my screen. Sofia Santos had just published Exercise 20. Great, I still have to finish the others, but let’s give it a look.

First thought: “For sure, there is a simple and logical action to find the exercise.”

First action: “Frenetically click every part of the picture and the website.”

My logical action wasn’t working. Then I remembered: let’s just open another exercise and change the number in the search bar.

Of course, that was too simple. So where could this exercise be? Naturally, the first logical action is to frenetically click all around again.

Here we go, I got you! (I exclaimed), hidden in plain sight. Or at least that’s what I thought when I saw the option to click on this part.

SECOND PART (THE SERIOUS ONE):

Alright, just joking. Let’s get serious now. Let’s go back to the URL that contained Exercise 020. Sofia left us a couple of clues on the page to help us understand how to get to the exercise.

To find Exercise 020, we need to go to https://archive.org/web/ and use the Wayback Machine.

We input the URL into the search bar and then proceed to look for August.

There are two snapshots, so I guess it’s the one from August 28.

a) Well done! You have found it!

Welcome to OSINT Exercise #020!

Task briefing:

The internet is a digital ecosystem in constant transformation. Websites change appearance, domains change owners, businesses open and close, and accounts are created and deleted.

In July 2023, x.com went from being an almost blank page to redirecting to twitter.com.

Your task is to go back in time, until the year 2000, and find the following information within the x.com website:

b) The Frequently Asked Questions page.

c) The list of members of the management team in July.

It doesn’t sound impossible; I definitely have to use the Wayback Machine to solve this exercise.

I am going to look directly at July 2000, hoping to find the answers to both questions in the same snapshot.

At this point, because I’ve never used the Wayback Machine, I decide to search for a tutorial that explains the functions of this tool.

Here’s the tutorial I found: https://www.youtube.com/watch?v=ts1tu1BiSuY

After watching this tutorial, I was able to find a better way to explore the domain itself to find what I was looking for.

Using the “Site Map” function, it’s possible to see all the pages of the domain that have changed over time. By just searching on the wheel, I was able to find the FAQ page, as well as the page discussing the management team.

Both pages are dated in 2000, and the management team page is dated July 6, 2000, so the exercise is complete.

To find the management team, I can also use the feature under the name “URLs,” which is a searchable database. By filtering with the word “database,” I can find this link with the snapshot I found on the wheel.

Post comment:

It’s not the first time I’ve heard of or tried the Wayback Machine, but it is the first time that I actually needed to understand how to use it properly. I guess one of the beauties of doing OSINT is that sometimes you are faced with certain problems and you need to go back to study and learn something new, as I did in this case.

If you enjoyed this write-up and want to read more, just click here.

Thank you for reading.

p.s my google is in italian so the names of the cities are in italian.

Task briefing:
The text below is a partial transcript of a phone call in which you can only read one side of the conversation. Despite the text being completely fabricated for this exercise, the location described is real. Your task is to geolocate where the person was at the time of this fictitious phone call.

Here you go. Now, I need to geolocate the origin of the person’s call, so I need to read the transcript carefully. I can only see half of the conversation.

The two most important pieces of information mention the “German language” as one of the languages spoken in the country. The second clue is about the sea, which is said to be an hour and a half from where he is. Additionally, there’s mention of a station nearby.

Germany, Austria, Belgium, and Luxembourg are my initial guesses. However, Latvia also has a significant number of German speakers.

Germany is probably not the country I’m looking for because he’s speaking about learning something, which I assume is a language. Also, we need a country with a coastline, so Austria and Luxembourg can be ruled out. Belgium remains a viable option.

I’m leaning towards Belgium, as it seems to fit the description. As for the sea, it needs to be about an hour and a half from where he is. He also mentioned that the sea is connected to a river and it’s the same body of water.

Brussels does have some canals, but they aren’t directly connected to the sea. Instead, the city of Antwerp has larger canals that are directly connected to the sea, even if it’s located at the border of the country.

The subject is speaking about “going to meet a person at the sea,” so I assume he is referring to the coast in front of the UK.

Now, what is important to consider is that the person doesn’t travel by car, but probably by trains and buses.

Using Antwerp as the starting point and checking the distance with Google Maps, I assume I am in the wrong city.

Looking at the cities in Belgium, I also noticed the city of Ghent.

There is a river connected to the sea, and it’s full of canals. Upon closer inspection, I realize that all of Belgium is crisscrossed with water canals.

Using Google Maps, from Ghent to Ostend on the coast, it takes only 44 minutes. The text did not mention where the cousin is living, but I choose to use Ostend as the main point because most travel from Ghent to the coast would require the subject to pass through Ostend. If we choose different places, the travel time will approach 1 hour and 30 minutes, but that would be mere speculation.

If I choose the town of Dendermonde, I get a travel time even closer to the one that the subject plans to do next week.

Looking closer, I can see there is a river. I’m also beginning to think that in the call, the subject was referring to the fact that the country is full of rivers and artificial canals connected to each other. It was probably an attempt to hasten the end of the call.

In the call, there’s mention of “prayers,” so I think the best approach would be to look for mosques.

Moskee Al Ansaar is the one into the city; the others seem a bit far.

There is also a station nearby, so it’s likely the place I’m looking for.

At this point, the only question is “where does the cousin live?” This is because it can change the travel time and the city I am searching for.

In the conversation, there’s mention of a carpet that made him think of wearing swimming shorts. What comes to my mind is that the carpet might be as blue as a swimming pool, but in the last mosque I was looking at, there’s no trace of it.

I’ve decided to go back to Ghent and look at the mosques present in the city.

There are a few mosques, but scrolling through, I can see one with a carpet that reminds me of a swimming pool.

There is also a train station very close, and the river is literally next to the mosque.

So, between the two mosques, which is the place I am looking for?

Both of them have canals, but the one in Ghent is better connected. Both of them have the train station nearby. Both of them take about 1 hour and 30 minutes to reach at least one of the places on the coast. However, the text doesn’t mention where the cousin lives. From Ghent takes 44 minutes to get to Ostend but around 1 hour and 30 minutes to other locations. Dendermonde takes 1 hour and 30 minutes to Ostend but at least 2 hours to the other locations. In the end, only the mosque in Ghent has a carpet that resembles a swimming pool.

So, in conclusion, the location where the subject was is: Ghent

I hope you enjoy this entry, if you want to read more just click here, there is a list of those challenges.

Due to lack of time, don’t miss out on any helpful info about the OSINT community. Read our free weekly newsletter and stay informed about the OSINT community for free. Join the free newsletter at osintupdates.com right now.

Stop wasting time reading the same content about OSINT again and again. Read high-quality, non-repeated OSINT blogs for free at osintblogs.com! Don’t forget to subscribe so you don’t miss out on new blogs.

Exercise 019: Geolocating a phone call was originally published in OSINT Ambition on Medium, where people are continuing the conversation by highlighting and responding to this story.