Bellingcat Open Source Challenge
I started at the bottom and worked my way up through challenges and categories.
- We can notice stickers and that the area is mountainous.
- I scanned the QR code using online tools (https://qrscanner.net). This takes us to a mountain shop in Austria: https://readyformountain.myspreadshop.at.
- Facebook account: https://www.facebook.com/profile.php?id=100082330361792.
- Instagram account: https://www.instagram.com/readyformountain.
- ReadyforMountain posted a photo from the Zillertal Valley, Austrian Alps.
- Another sticker takes us here in Linz, Austria: https://www.instagram.com/dersteinbocklinz/ and here: https://www.facebook.com/dersteinbocklinz.
- Another sticker takes us again to Zillertal. The sticker says BERGBUDDYZ Zillertal -2019-, confirming the area that we should now be checking.
- I did a simple Google search: Zillertal Peaks. The very first result I got was this website: https://www.komoot.com/guide/210079/peaks-in-the-zillertal.
- Komoot proved to be fantastic. After searching each peak from the top, I got to number 5: Wiedersberger Horn, which had a lot of similarities.
- Without a Komoot account, you can't view all the photos (over 400), but you can just connect your sockpuppet through Facebook if you don't want to waste time creating a Komoot account.
- The intelligence found on Komoot proved invaluable. I managed to solve the challenge by matching stickers found on photos, as well as visually identifying surrounding mountains. (See matching below.)
Challenge Answer: Wiedersberger Horn
- I downloaded the image and put it through Google Lens.
- I am a big fan of architecture, and I noticed a photo come up in the results straight away. The concrete border of the pond looked very similar to the border shown in the Bellingcat challenge photo, as well as the fence in the background.
-
Found this post on Instagram: https://www.instagram.com/p/Cvv-94SrHgS/.
-
Location is the Woodland Park Zoo in Seattle (https://www.zoo.org).
Challenge Answer: Woodland Park Zoo
- I knew this would be a hard one when I put the image through Google Lens and found nothing.
- As the writing seemed to be Russian, who better than Yandex to solve this? Epic and miserable fail!
- I went back to Google Lens, being very precise and slowly isolating what mattered. Bingo!
- Google Lens is dangerously precise when you know how to use it. You need patience,every single millimeter counts when isolating elements in a photo.
- What a superb find! It takes us to TikTok, where someone filmed from a vehicle (drive-by): https://www.tiktok.com/@narynnews_/video/7156845930434546945.
- I monitored conversations under the video. Lots of people said they grew up in this village (Kazan-Kuygan), but no intel mentioned the building.
- Again, I opted for Google, went to Google Maps, and searched for Kazan-Kuygan. Google Maps indicates the building is a library.
- The last time Google sent a car there was in Oct 2015, before the library was built.
Challenge Answer: Library
- Solved this one in a few minutes.
- Image → Google Lens.
- I isolated only one modern building, which took me here: https://it.foursquare.com/v/edificio-link-760/4e95f3fab8f73812d0b5017d.
- Then searched: Edificio Link 7-60 Bogotá in Google.
- On Google Street View, we can see a monument just across from where the motorcycle is (see below).
-
A simple Google Maps search without going into Street View provides the name of the monument (see below).
-
Challenge Answer: Julio Flórez
- I quickly understood that there was no GEOINT to do here unless someone had posted a matching image somewhere.
- I didn't even bother to do a search via Google Lens and instead tried to put the photo through ExifTool (see below).
- We can see GPS coordinates at the bottom.
- Google Maps -->
51°10'13.08"N 4°40'0.12"W, which takes us to Lundy Island. - I ran a search on Lundy ICAO.
Challenge Answer: EGZV
- Image --> Google Lens --> isolate the right side of the image
- One particular image seemed the same which takes us here --> https://www.stocksy.com/photo/788772/container-terminal-in-hamburg-harbour
- Image Title: Container Terminal In Hamburg Harbour
Challenge Answer: Hamburg
- I used AI to request photo analysis.
- Fed the photo into ChatGPT, who replied that only one ship could be identified (see below)
- We now know that the ship on the right is the USS Dwight D. Eisenhower (CVN 69)
- I could not think of any ways of identifying the ship on the far left, I thought about checking dates both ships were moored together, potential deployment and similar return dates, exercises the ships may have conducted together.
- I asked GPT how many aircraft carriers the US has, and the answer is 11. That leaves 10 possibilities as we found USS Dwight D. Eisenhower on the photo.
- I decided to use and compare markings and traces which makes each ship unique, and comparing all the markings, I found a match with USS George H. W. Bush (CVN-77)
- Each ship is unique in regards to marks and traces.
- See below
Challenge Answer: 369970663
- I searched on Google --> "yui peng 3" "165759"
- The Google search provided a Twitter Post with the original link --> http://skap.pasp.ru/Move/InOutMoveList/165759?harb=UL
Challenge Answer: skap.pasp.ru/Move/InOutMoveList/165759?harb=UL
- The title of the challenge gives a clue, there is probably something hidden within the clouds
- I first tried to solve this with this tool --> https://www.imageforensic.org and I got no results
- I then asked chatGPT to review the photo and nothing was found.
- Steganographic embedding can be analyzed using Error Level Analysis (ELA), so I tried this tool --> https://29a.ch/photo-forensics/#error-level-analysis and played with ELA (Error Level analysis)
- I saw numbers in the clouds, but couldn't make them out, so I saved the image and played around with it in Gimp, I managed to get something quite decent.
- I first noted 128309, then saw that it seems to be a 4.
- To make sure, I just went over each white part in the clouds to get all numbers.
Challenge Answer: 428309
- I used CyberChef made by the GCHQ to decode the Morse
- It provided this:
RCVDEUCTA513181993451034641698324051028040120540007020083500222520028013012BTARUCTA5N - I then typed on Google --> "synoptic code filetype:pdf" which provided this document: https://www.vos.noaa.gov/ObsHB-508/ObservingHandbook1_2010_508_compliant.pdf
- I saved it and fed it to ChatGPT
- I then asked GPT for help in finding the air temperature and pasted the decoded Morse into the chat. (See response below)
- A lot of people say that AI makes us lazy, and it does to a certain extent, but if something is powerful and helps, why shouldn't we use it?
- It helped me solve the challenge quite fast.
Challenge Answer: 28.0
- Solved this one fast, I didn't want to pivot on any car registration plates even though I knew this was Germany from the D on the plates.
- I just looked around, saw Stoffe, then I could make out Shishandi without the ending or knowing what letter it was, I just starting typing out shishand on Google and it automatically proposed "shishandis Frankfurt"
- Address:Stiftstraße 18 - 20, 60313 Frankfurt am Main, Germany
Challenge Answer: Stiftstraße
- The first thing I did was to go to https://cleanup.pictures and to get rid of the dumpster, so that Google can work on something clear and not concentrate on a dumpster.
- I put the photo through Google lens which took me here: https://www.instagram.com/keithmcnallynyc/p/Cxe0in5INme/
- It looks exactly like the Alley on the photo, and Instagram user @keithmcnallynyc said "FAR FROM THE WHITE HOUSE. Dirty, No-Good Alleyway in Washington D.C. Home of Minetta Tavern in February 2024.
- I searched for "Minetta tavern" dc on Google and the Google home page results on the right side show the same kind of alley on streeview.
- I clicked on the right and went to Google streetview and found the alley with the same Graffiti "GOOF.TROOP".
- I also carried a Google search on "Washington alley GOOF.TROOP" which takes us to a Reddit post from 7 years ago (https://www.reddit.com/r/Bombing/comments/8qti01/goof_troop/). Meaning this graffiti is very old and was in the alley over 7 years ago.
- The place the man was standing when he took the photo: https://www.google.com/maps/@38.9099127,-76.9979881,3a,75y,212.27h,67.37t/data=!3m7!1e1!3m5!1sPJpiDyrT0Fp1vCNT_h_eOA!2e0!6shttps:%2F%2Fstreetviewpixels-pa.googleapis.com%2Fv1%2Fthumbnail%3Fcb_client%3Dmaps_sv.tactile%26w%3D900%26h%3D600%26pitch%3D22.629999999999995%26panoid%3DPJpiDyrT0Fp1vCNT_h_eOA%26yaw%3D212.27!7i16384!8i8192
- The issue was with coordinates, and Bellingcat set them a little too far, so I had to play around with digits.
- The correct answer could have been 38.909, -76.997 and Bellingcat should maybe have set various correct responses which would have saved me a lot of time
Challenge Answer: 38.910, -76.998
## Highway to the Unknown
- This one was very tricky
- I started as usual by putting the photo through Google Lens --> no result
- I then isolated only the car with what it was carrying on the roof, most photos coming up in the results were from Nigeria.
- I then isolated the house and we can see Nigeria coming up again.
- It seems the country that keeps coming up is Nigeria.
- I ran searches for over 45 minutes, using keywords next to the building such as --> Nigeria, Company, building, office, embassy, association, Africa, highway, house, famous building, official, ng, and whilst doing these searches I was trying different isolation combinations on the house, and sometimes moving just slightly will change the results.
- Nothing worked, so then I started listing Nigerian cities
- Which big cities in Nigeria have highways (as the challenge title states), the first city to check would be Abuja.
- I typed Abuja next to the image and went through photos, going down, I saw the gate that looks very similar to the gate on the photo.
- It takes us here and we can see everything is identical: https://commons.m.wikimedia.org/wiki/File:Daughter_of_Abraham_foundation_building_jabi_Abuja.jpg
- I first typed the foundation name and got it wrong , I then realised Bellingcat was asking for the name on the building and not the foundation!
Challenge Answer: Julie Useni
- This one was solved fast.
- I watched the video 4-5 times, looking everywhere.
- A screen caught my attention and it stated on the screen 31 DELOACH
- I typed this into Google --> "31 DELOACH"
Challenge Answer: Zach DeLoach
- This one has been the hardest to solve so far as it took me a while to see meaningful details on the photo, I was looking for a 100% photo match which I didn't get.
- As always, I started by putting the photo through Google lens, after going through many photos, I gathered that this is some metro station in Prague.
- After a long time (too long) searching, I noticed that there is what seems to be natural light on the platform which is strange as metro stations are usually all closed up.
- I stress that AI simply is not used enough in OSINT and is a huge time saver!!!
- I asked GPT about metro stations in Prague that have natural light 👇
- I searched for each station by a simple Google images search, going through each station name one by one.
- When searching for Hurka, I got a match. (Photo on the right found on Flickr)
- The match is to the station, same floor and ceiling and same sort of lighting, but I don't think the image found is the right platform.
- So we now know the metro station is Hurka
- We just need to find platform match and to know what direction the metro on the Bellingcat challenge photo is going in.
- Found this video: https://www.youtube.com/watch?v=zAa1mWGt_rU
- It was then easy to match sides, and going down on the platform, we can see the left side is towards: Zličín
Challenge Answer: Zlicin