The OSINT Newsletter – Issue #95

👋 Welcome to the 95th issue of The OSINT Newsletter. This issue contains OSINT news, community posts, tactics, techniques, and tools to help you become a better investigator.

🏁 New CTF Challenge Live – Locating Epstein

A new CTF challenge has been posted on our CTF website. This week’s CTF challenge focuses on identifying the exact name of the location where a photograph of Jeffrey Epstein and Ghislaine Maxwell was taken.

Start competing in our Capture the Flag (CTF)

🪃 If you missed the last CTF, here’s a link to catch up.

Last week’s CTF challenge featured a domain OSINT task titled “The Phisher” (2 Parts). For Part One, the objective was to investigate the suspicious domain rnicrosoft, a clear typosquatting attempt designed to mimic Microsoft’s domain name. The challenge required performing a WHOIS lookup on the domain to gather publicly available registration details.

🪃 If you missed the last newsletter, here’s a link to catch up.

⚡ How I Went From Intelligence Analyst to Product Manager

The OSINT Newsletter – Issue #94

🎙️ If you prefer to listen, here’s a link to the podcast instead.

Episode 12 – Domain OSINT, Building Methods, and Turning Intelligence Into Products

Let’s get started. ⬇️

Sometimes with OSINT, it’s all about location. The ability to discover where an image was taken, a video was shot, or a newsworthy incident took place can make the world of difference to an investigation. From verifying frontline war-zone footage, to detecting digitally-altered imagery, there are probably more uses for geolocation OSINT than there are countries in the world (about 195, fyi).

However – part art and part science, working out where things are with OSINT takes a very particular set of skills. This issue will teach you:

• The basics of GEOINT

• The best geolocation tools online

• Manual methods (including visual recognition)

• …and how to place any piece of data in geographical context.

It’s time to take a tour round the world of geolocation OSINT. Let’s set off.

In beginners’ terms, geolocation OSINT (also known as GEOINT or geospatial intelligence) is discovering locations with analysis; usually to place a particular piece of data in a geographical context. This involves a mix of satellite imagery, mapping, and environmental or visual context clues – which all work together to give analysts an idea of where in the world things are.

GEOINT is used worldwide by the most advanced intelligence capabilities, like government departments and global defence firms. But even if you’re not wading into world conflicts, you’re still crossing borders – between the digital world, and the physical one. This area of OSINT is all about putting digital data in a physical context.

Geolocation OSINT mixes up two types of methods to make actionable discoveries. To pin down where something really happened, these are the two different areas of work you’ll need to explore: the digital, and the visual.

Visual analysis is the most popular, and most extensive, geolocation discipline. Images – including moving images aka video footage – are stuffed full of clues to work with.

Even minor details – like curb paint or utility pole design – can narrow a search from continent to city. Pro investigators will usually combine visual work with AI-assisted pattern analysis, to… Actually, we’ll go much deeper into image analysis later, so put a pin in this part for now.

Meanwhile, some work sits in the digital world; particularly processing metadata and IP searching. While IP geolocation is weak, it can occasionally reveal the target’s country or region – giving you a clear place to start. More importantly, images and documents often carry metadata with geographic indicators.

Of course, metadata won’t always be there; it’s often stripped by social media platforms to protect people’s privacy, or intentionally removed by the creator to obscure a file’s origin. But it’s always worth exploring.

Now, the tools of the GEOINT explorer’s trade. Put away your paper maps; from satellite platforms to reverse image search engines, this tech toolkit will shrink your search area fast. And the less jungle you have to beat through, the better your geolocation efforts will go.

• Google Earth: Still the bedrock of geolocation work. Google Earth will give you a fast visual impression of terrain types, distances and landscapes.

• Google Maps: Google Maps’ integrations with other features (like business pages and reviews attached to public Google profiles), are priceless for pinpointing a target’s movements, or verifying business addresses.

• Google Street View: Valuable for ground-level verification. Plus, the stored historical imagery allows you to confirm when structures were built or changed.

• Yandex Maps: Particularly valuable for Eastern Europe and parts of Central Asia. Includes a Street View feature, and covers areas that Google won’t.

• Bing Maps: Often provides alternative Street View coverage where Google has gaps. Like search engines, it takes multiple mapping platforms to get a full geolocation picture; not every one indexes everywhere.

• Traditional Reverse Image Search (eg. Google Lens, TinEye, Yandex): Reverse image search works by matching your searched image with similar shapes, colours, and distances in its library of indexed images. While traditional reverse image search can surface earlier uploads, higher-resolution versions, or media tied to specific locations, it won’t be able to tell you anything about an image that hasn’t appeared elsewhere.

• AI-Assisted Geolocation (eg. GeoSpy, picarta.ai, EarthKit): AI geoguessers take reverse image search to the next level. By matching landmarks, terrain, skylines and languages on visible text, they attempt to recreate the geographic metadata behind an image. Yet like all AI, they will still hallucinate: even advanced systems can’t tell the difference between the coastline of Puerto Rico and Barbados, for example.

Both documents and images carry metadata, but image metadata is far more useful for geolocation. There will often be GPS coordinates in EXIF metadata, plus device model and timestamp data. Even the altitude the photographer was at, and the direction they were facing, will be visible with a quick metadata extraction. Even a simple online service like exif.tools can do the job.

Niche tasks will require unexpected tools: sun position calculators, for example, can help you with shadow analysis – a useful way to ascertain the time of day and location a picture was taken. Many curated lists – or OSINT toolboxes – are full of similar surprise tools that could help you later.

Put away your (Google) maps – and let’s turn back to visual analysis. Elite geolocation analysts rely on pattern recognition developed through practice; years and years of honing their ability to spot the most obscure useful details in an image. Of course, you don’t have years and years… so just go through this checklist.

1. Architectural Analysis: Buildings are different everywhere in the world. Look at roof shapes (flat vs pitched), window and balcony styles, and construction materials to get an idea of location. Concrete panel blocks could suggest a post-Soviet state, for example.

2. Road & Transport Indicators: Road infrastructure is also regionalised. Check lane markings, which side of the road they drive on, sign typography and bollard shapes. Even traffic light orientation can be country-specific – and has helped crack cases.

3. Language & Typography: If they’re speaking Chinese, it’s probably in China. You can even narrow the location down even further just by analysing any text you can see; alphabet systems (Latin, Cyrillic, Arabic, Mandarin, Cantonese etc.), dialect variations, domain suffixes on signage, and phone number suffixes can tell you where an image is specifically from.

4. Vegetation & Ecology: Trees, plants and flowers will reveal which climate zone the target is in. For example, palm species suggest either tropical or subtropical regions. Even the grass colour can tell you rainfall levels; dry, dusty greenery is more likely to suggest Arizona than South Dakota. Check agricultural crops too – if the fields are full of corn… more likely Midwest.

5. Shadow & Sun Analysis: Determining shadow directions sounds like black magic. But analysing shady spots can show you the hemispheric orientation of your image. Measure shadow length, height, and angles, then compare them against timestamps to validate or debunk the claimed capture dates.

6. Terrain & Topography: Lastly, landforms and terrain textures can tell you macro-location information. Mountain silhouettes, coastal curvature, and even the specific hue of the soil can help close in on a specific part of the world. Matching sections against satellite imagery is a common closing technique.

A beautiful young traveller is abducted during a European trip. During her final, brief phone call she manages to whisper: “White walls… red curtains… balcony outside.” The call cuts.

You are her father: a middle-aged GEOINT practitioner with a very particular set of skills. Time to use them to discover where she was taken.

You begin by checking her socials, where you find a video she posted earlier that day. In the background you see a street view from her apartment balcony. Visible details include cream-coloured Haussmann-style buildings. This indicates your daughter was in Paris.

Zooming in on the footage frame-by-frame, you see that one of the Hausmann-style buildings is a cafe. By using reverse image search on the cafe’s distinctive red awnings – and cross-referencing Paris business listings – you identify several candidate streets.

You take your search on to Google Street View. “Walking” around your candidate streets, you “look” in the windows opposite each cafe to see if you can spot the key details: white walls, red curtains, balcony outside. You eliminate candidates until one street aligns perfectly.

Returning to the original video, you extract the metadata from the video file. GPS coordinates are absent, but timestamp and device data remain. It was posted with an iPhone, in Paris… cross-referencing upload time with her known movements and daylight conditions confirms the exact location. Time to go get the bad guys.

After that whistle-stop tour round the world of geolocation OSINT, you should know:

• It’s half art, half science. Geolocation OSINT is both visual and technical

• Don’t forget your tools – Even the unexpected ones

• Cross-reference everything. Geolocation is triangulation. Where points converge – that’s your spot.

See you next week, investigators!

✅ That’s it for the free version of The OSINT Newsletter. Consider upgrading to a paid subscription to support this publication and independent research.

By upgrading to paid, you’ll get access to the following:

👀 All paid posts in the archive. Go back and see what you’ve missed!

🚀 If you don’t have a paid subscription already, don’t worry. There’s a 7-day free trial. If you like what you’re reading, upgrade your subscription. If you can’t, I totally understand. Be on the lookout for promotions throughout the year.

🚨 The OSINT Newsletter offers a free premium subscription to all members of law enforcement. To upgrade your subscription, please reach out to LEA@osint.news from your official law enforcement email address.