Gralhix Exercise #016

Or how to find an A-10 Thunderbolt II

Exercise Challenge

Gralhix’s latest exercise presents us with an intriguing image: a mean-looking military jet soaring above the clouds, with a rural, arid landscape far below.

The task instructions cut to the chase:

On November 25, 2020, a Twitter user shared the photo below. It depicted a military aircraft flying over an “undisclosed location”. Your task is to disclose that location.

Notably, this is the first exercise Gralhix has rated as hard for both beginners and experts. The gauntlet has been thrown!

A closer look reveals the aircraft as an A-10 Warthog/Thunderbolt — a controversial aircraft in US Military politics. For its fans, it’s a “cool” and powerful symbol of US airpower. For its critics, it’s expensive and long obsolete for the modern battle space.

Given the terrain and the tweet’s date, initial thoughts drift to potential locations like Syria, Iraq, or Afghanistan.

The difficulty is evident, as this exercise ticks several boxes:

• ✅ High altitude perspective
• ✅ Remote and sparsely inhabited visible area
• ✅ Nearly four-year-old tweet (the picture could be even older)
• ✅ Unknown orientation
• ✅ Overcast conditions

Solution Summary

Our investigation unfolded through several key steps:

1. A Google Image Search of the exercise photo provided crucial context, centering our search on Southern Turkey, near the Syrian border.
2. Searching by the credited photographer yielded additional images of an A-10 aircraft, possibly the same one, taken on the same day. One picture featured a distinctively shaped peninsula, proving an excellent candidate for a focused image search.
3. This search provided coordinates for the peninsula, greatly narrowing our search area.
4. Simple Overpass Turbo Queries were used to create KML overlays, helping visualize rivers in the search area and confirm geolocation via the road network.
5. Finally, close image analysis revealed that the aircraft was flying north, allowing us to adjust the map/image orientation, resulting in a strong match.

Final Result: Aircraft geolocated at roughly 37.658539° 38.098462° (Google Earth Pro viewing altitude: 1,380 meters)

Exercise 016 Solution: 37.658539° 38.098462°

Detailed Walkthrough

Step 1: Initial Image Search

Our first move was to perform an image search on the exercise photo. This yielded an authoritative source and broader context: The aircraft was participating in Operation Inherent Resolve, and contrary to the Twitter date, the photo was taken in 2017.

Centcom Image Highlighted

The CENTCOM result was cause for celebration. CENTCOM refers to US Central Command, whose area of operations includes the Middle East and Southeast Asia. An official military source provides a solid foundation for our investigation.

Image archived from original (link)

Step 2: Contextual Research

Quick research revealed that A-10 Thunderbolts were deployed to Incirlik Air Base in 2015 to provide close air support in operations against ISIL. The modernized A-10 has a range of 645 kilometers before requiring refueling. To organize our search, we visualized what we knew: the base the A-10s were operating from and their effective range.

Red circle indicates the A-10 Thunderbolt 2 combat range from Incirlik Airbase

Note on Satellite Imagery: Throughout this investigation, I made a conscious effort to use satellite imagery from 2017 whenever possible. This approach was chosen to align as closely as possible with the photograph’s date of May 31, 2017. By using contemporaneous imagery, we can minimize discrepancies that might arise from changes in the landscape over time, enhancing the accuracy of our geolocation efforts.

Step 3: Date and Photographer Search

Searching by the photographer and date yielded additional pictures of an A-10. One showed the aircraft over a large body of water with a distinctive peninsula and shorelines — an excellent candidate for a focused image search (link).

Among the matches was an academic journal that provided coordinates for the peninsula (link). The news articles mentioned the pictures were taken during a refueling operation, which is often done above large bodies of water or unpopulated areas.

“THE EFFECT OF PHOSPHORUS AND ZINC ON YIELD AND ON SOME AGRONOMIC CHARACTERISTICS OF COTTON (Gossypium hirsutum L.)” in APPLIED ECOLOGY AND ENVIRONMENTAL RESEARCH 17

Step 4: Initial Geolocation

We used these coordinates to geolocate the A-10 over the large body of water with an image overlay that lines up with the shoreline.

Step 5: Narrowing the Search Area

Assuming our exercise image would be relatively close to the refueling spot, we used Overpass Turbo to generate a KML overlay of rivers in the area. This helped visualize where the aircraft might be in relation to the river shown in the original image.

[out:json][timeout:90];

// Find all rivers within the bounding box
way["waterway"]({{bbox}});

// Output all rivers
out geom;

Just five lines to make all this happen!

We looked for a sparsely populated location with a good stretch of river without major bends, featuring a mix of arid land and possible farmland.

This looks interesting.

Several features looked familiar: an arid ridge/hill, a rectangular-shaped island, and a smaller island.

Larger island (2) “above” the smaller island (3)

However, their spatial relationship in Google Earth didn’t match the exercise image.

Here, the smaller island (3) is “above” the larger island (2)

The key realization came when I understood the discrepancy in orientation:

1. In the exercise image: The aircraft is flying “down” the image (south in the image frame, but actually northward in reality).
2. In Google Earth: The default view is north-facing.

This misalignment made feature matching challenging. To rectify this, I had two options:

• Make the Google Earth view south-facing, or
• Rotate the exercise image to align with the north-facing map.

I chose to rotate the exercise image, effectively performing a “barrel roll” in Google Earth Pro:

The larger island is annotated with orange oval, blue annotations show a match with roads outside of the overlay. The yellow curve lines up with a winding road/path in satellite imagery

This alignment immediately improved feature matching and confirmed we were in the right location.

Step 7: Verification

To verify our findings, we first aligned key features, noting how roads in the exercise image overlay lined up outside of the exercise image boundaries:

Red markings are the larger and smaller islands, and numbered yellow markings are points where the exercise image overlay lines up with the satellite imagery underneath

Finally, we confirmed more rigorously with an Overpass Turbo KML overlay of the road network, raising our confidence in the image location to almost certain by ICD 203 standards.

Orange road network overlay provided by Overpass Turbo lining up additional points of continuity with exercise image and underlying satellite imagery

Lessons Learned

1. Spatial Orientation Awareness: Be mindful of spatial orientation. This exercise would have been solved much quicker if I had realized the A-10 was traveling north sooner.
2. Tool Limitations: Overpass Turbo wasn’t a magic bullet for this scenario, but it helped narrow down areas of interest and provided stronger verification than manual methods alone. It’s crucial to recognize what a tool can and can’t do.
3. Effective Use of Overlays: This exercise showcased the power of using overlays in Google Earth Pro. Both KML and image overlays helped advance the investigation and simplify report writing.
4. Visual Notekeeping: Using Google Earth Pro as a visual journal helped transform an overwhelming problem into something manageable.
5. Web Page Archiving: One crucial habit I need to develop is consistently archiving web pages during an investigation. OSINT researchers should make this a standard practice for several reasons:

• Preserving Evidence: Web content can change or disappear at any time. Archiving ensures you have a record of the information as it appeared during your investigation.
• Verifiability: Archived pages allow others to verify your sources and findings, enhancing the credibility of your work.
• Legal Considerations: In some cases, archived web pages may serve as evidence in legal proceedings.
• Tracking Changes: Archived versions can help you track how information evolves, which can be crucial in ongoing investigations.

To implement this practice, consider using tools like the Wayback Machine or archive.today. These services create snapshots of web pages that you can reference later, even if the original content changes or is removed. For example, in this investigation, I archived the CENTCOM article and other key sources. This would ensure that even if these pages are updated or removed in the future, I (and my readers) would still have access to the information that formed the basis of this investigation.

Additional Considerations

For future exploration:

• Developing methods to estimate size from high altitude, using known information like aircraft wingspan and estimated altitude.
• Exploring techniques to match unique curves (e.g., in rivers or roads) on maps, which could significantly speed up similar investigations.

Conclusion

This challenging exercise, worthy of its “hard” rating, offers an excellent opportunity for developing a more involved problem-solving chain and organizing information effectively. It demonstrates the importance of combining various OSINT techniques and tools, from initial image searches to complex geospatial analysis.

ICD 203 Confidence

Based on our investigation and the evidence gathered, we can assess our findings as “very likely” (80–95% probability) according to ICD 203 standards. This confidence level is supported by:

1. The successful matching of key geographical features from the image to satellite imagery
2. Corroboration through Overpass Turbo overlays of road networks
3. Alignment with known operational areas of A-10 aircraft during the relevant time period

However, it’s important to note that there are limitations to our certainty:

• The vast area involved in the search
• Potential limitations in the resolution or timeliness of available satellite imagery
• The inability to conduct a comprehensive check of every possible river in the region for a match

Despite these limitations, the multiple points of comparison, especially from the Overpass Turbo overlay, provide strong support for our geolocation.

This investigation underscores the power of OSINT in uncovering information from seemingly limited data. It also highlights the importance of persistence, critical thinking, and the creative use of available tools in solving complex geolocation challenges, while maintaining a realistic assessment of the confidence in our findings.

Acknowledgments

Thanks to Gralhix for creating such high-quality exercises (link). Sixteen exercises in, and each challenge remains fresh and interesting.

Also, a special thanks to OSINT TEAM, a publication on Medium, for their helpful feedback and encouragement. Check out their group publication at OSINT Team, where I’ll be contributing articles soon.

We invite readers to share their thoughts, questions, or alternative approaches in the comments. Your insights could provide valuable perspectives for the entire OSINT community!