Bellingcat Challenges: Maritime Mysteries
Continuing this series of write-up explaining how to solve the OSINT challenges offered by Bellingcat for the end of 2024. The tools used are listed at the end of each section. I am not affiliated with Bellingcat. Please find the write-up for the first week of exercise here.
As per Bellingcat’s wishes, the complete images are not included to avoid polluting the image reverse search results, however a description in italic has been added as well as a link to the image. The pictures and the challenges are available here.
1 — Fully Stocked
Container vessels are a common sight in ports around the world, but this one is particularly well-stocked. They’re a vital part of the global supply chain, but where is this one moored? In which city would you find this port?
Puzzle by Galen, Bellingcat
The accompanying picture shows the side of a ship with the letters “U A S C” on its starboard side. More than a dozen of container cranes can be seen. They are marked with a partly obscured word: “…RDKAI”. See the full picture here.
The lettering on the crane, could be there for several reason: a brand, name of the harbor, etc. To confirm this, let’s search RDKAI port crane in Google. This yields several links and images, including the image below.
The color of the upper part of the cranes in this image match the one in the exercise’s picture. The font of the lettering matches as well. The title of this picture mentions Hamburg and it is indeed the right answer. Note that the exercise picture is cropped version of another photography, which could help to verify that it is indeed the Burchardkai terminal.
Tools & Websites
2 — Operation Fleet Finder
Here are a handful of naval ships moored together, but grey is the only colour in sight. They all look the same! Can you help identify them? What is the MMSI number for the left-most ship?
Puzzle by Bellingcat
The accompanying picture displays two large ships painted in grey with a smaller vessel on the right. Two docks, as well as a floating barrier hint that this is a harbor.
Finding the right-most ship
As always, zooming on the picture will help us to isolate useful details. There is an American flag and a 69 on the island of one of the ships.
Another information we can add, is that the two main ships in that picture seem to be aircraft carriers. This narrows down the field of research: we are searching for an aircraft carrier, likely American. Lucky for us, they are few and far between.
Identifying the ship with the number 69 could help us to get to our ship of interest. This is a hull number and can be used to identify a ship if we know its type. Here “aircraft carrier” will be enough. Looking through the list of the US Navy aircraft carriers, we find the USS Dwight D. Eisenhower bears this number.
Who is your friend?
Interestingly enough, the list also mentions where the USS Dwight D. Eisenhower is stationed: Naval Station Norfolk. At the time of writing, it remained here according to MarineTraffic. Considering the American flag, it is likely to be where the picture has been taken.
Using the same list mentioned below, we can see that there are four other aircraft carriers stationed at the same place:
- USS John C. Stennis
- USS George H.W. Bush
- USS Harry S. Truman
- USS Gerald R. Ford.
To find the correct ship amongst these four vessels, we can use the design of their island.
This allows us to conclude that the mysterious vessel is the USS George H.W. Bush. His wikipedia page lists his MMSI as 368962000.
Tools & Websites
Google and Wikipedia.
3 — Cyrillic Confusion
In November 2024, two underwater data cables in the Baltic Sea experienced faults, disrupting communications between European nations and igniting suspicions of sabotage. A Chinese cargo vessel, the YUI PENG 3, quickly became a focus for both investigators and the online open source research community. Some mistakenly suggested that this port log showed the vessel’s captain was a Russian citizen (they confused a temporary harbor pilot with the ship’s captain). But a key question emerged: could the authenticity of the log be verified?
What is the original URL for this log? (don’t include the “http://” or “https://”)
The accompanying pictures is a table listing the movement of a ship called YUI PENG 3. It mentions several operations with their nature and date. See the full picture here.
Searching for a known document across the Internet is usually an easy task. Thanks to search operators available on various search engines, we can orient our query to seek strings of characters or a type of file.
But, this case is not so simple. Googling “No 165759” YUI PENG does not yield any worthwhile results. This is where we have to take into account the differences between search engines. Although Google is the main tool to explore Internet in western countries, other regions use different solutions such as Baidu or Yandex. These can yield a different result for a similar input.
Running the same search on Yandex does indeed give us the correct link:
skap.pasp.ru/Move/InOutMoveList/165759?harb=UL
Tools & Websites
Yandex.
4 — Clouded Perception
This serene lake is a beautiful sight, but something is off: this image has been manipulated. What should we do if an image is altered, either by hand or with AI? What is the 6 digit number hidden in the image?
Puzzle by Galen, Bellingcat
The accompanying pictures show a person standing on a pier set on a beautiful mountain lake. The clouds and the surrounding mountains are soaked in a bright orange, too flamboyant to be genuine. See the full picture here.
How can we answer a question in a field we know nothing about? A natural first step is to look at what other people have done. Bellingcat has verified the authenticity of images before like in this article from Annique Mossou or this one on the MH17 flight.
One technique used to identify altered pictures is ELA (Error Level Analysis). It highlights areas with different compression level which can indicate areas where a picture has been modified. You can find a detailed explanation and instruction on how to use it on its creator blog. See below a comparison of the ELA of an image and its modified version.
Use the slider below to progressively overlay an altered image and its ELA output.
Forensically offers a web interface allowing users to perform ELA as well as other operations. By uploading the exercise image and tweaking the parameters in the ELA module, we obtain the picture below.
The digits 428309 are highlighted in the sky above the mountains.
Tools & Websites
Forensically, Bellingcat.com, fotoforensics.com
5 — Synoptic Code
This is a morse code transmission received on the 13th October 2024. The sender is thought to be the Yelnya, a Russian ship operating on the Black Sea.
.-. -.-. …- / -.. . / ..- -.-. — .- ….. / . — — … — . — — — -.. . — — / — — . — — . … — ….- ….. / . — — — — — … — ….- -…. / ….- . — — -…. — — . — -.. / … — .. — — ….- — — — ….. / . — — — — — .. — — — -.. — — — / ….- — — — . — — .. — — — — — / ….. ….- — — — — — — — — — / — … — — — .. — — — — — — — — / — -.. … — ….. — — — — — — / .. — — .. — — .. — — ….. .. — — / — — — — — — .. — — — -.. — — — / . — — … — — — — . — — .. — — / -… — / .- .-. / ..- -.-. — .- ….. / -.
Can you decode the message? What was the reported air temperature in degrees Celsius? (give your answer to one decimal place i.e. “12.3”)
Puzzle by Galen, Bellingcat
The accompanying picture shows a table matching the 26 letters of the latin alphabet with their associated morse translation. See the full picture here.
Understanding the format
After using one of the numerous morse translator available online, we are left with the following message:
RCV DE UCTA5 13181 99345 10346 41698 32405 10280 40120 54000 70200 83500 22252 00280 13012 BT AR UCTA5 N
To better understand this message, we need to understand what the subject of this exercise is, what is a synoptic code? According to this page from the US National Snow and Ice Data Center, it is “a code […] by which meteorological elements observed at the earth’s surface at synoptic times are encoded in groups of five figures”.
Thus, the information we seek is in the digits between RCV DE UCTA5 and BT AT UCTA5 N. To understand the message, we need to know the format used they use. After a quick google search, we find this blogpost suggesting that Russian meteorological reports in the Mediterranean use a code called FM-13-X-SHIP.
Decoding the message
This format seems to be widely used, this document from the Naval Postgraduate School of Monterey (CA) explains how to decode it. The Surface Air Temperature Group seems to contain the information we need.
We now need to identify the correct digit group in our message: 13181 99345 10346 41698 32405 10280 40120 54000 70200 83500 22252 00280 13012.
We know the group we are searching for begins by a 1, followed by a 0 or a 1. This leaves two possible group open: 10346 or 10280.
However, the first group (10346) is preceded by another group: 99345. According to the document mentioned above, it is the Ship Latitude Group which means that the following group (10346) is the Ship Longitude Group.
This only leaves us with the 10280 group which would indicate a positive temperature of 28.0°C.
Bonus
If we decode the longitude and latitude group, we obtain the following coordinate: 34.5°, 34.6° which is in the Mediterranean sea between Cyprus and Lebanon, not the Black sea as the exercise mentions. Where is the discrepancy coming from?
Well one explanation is that the synoptic codes did not originate from the Yelnya but were merely retransmitted, as suggested by the first part of the message: RCV DE UCTA5 which likely means that the following message has been received from UCTA5. UCTA5 is also a name that fits naming conventions of the Russian navy mentioned in the blogpost mentioning FM-13.
Because the message sent by UCTA5 also has a Observation Time and Wind Indicator Group (13181) we know that UCTA5 sent this message the 13th of the month at 18:00, which matches with the exercise’s instruction.
Tools & Websites
MorseCodeTranslator.com, i56578-swl.blogspot.com, met.nps.edu, nsidc.org
I do hope this article shed some light on the methods and reasoning that could be used to solve these challenges. If you did not already, check out Bellingcat.com for exciting OSINT challenges.