Ce matin, le FLA a mené une série de frappes de drones contre des positions des FAMa et des éléments russes de l’Africa Corps à Goundam. Ces frappes ont infligé de lourds dégâts matériels et humains aux positions ciblées.

Translation

This morning, the FLA carried out a series of drone strikes against positions held by the FAMa and Russian elements of the Africa Corps in Goundam. These strikes caused significant material damage and casualties at the targeted positions.

When looking at Goundam on OpenStreetMap, it has one area tagged as military: an ex-MINUSMA base which we would expect to be the area targeted by the FLA. However, nothing in the video matches this particular location.

Finding a candidate location

In these stills from the video we can distinguish a few things which are mentioned in the captions below.

This is a tremendous help as there is only one bridge fitting this description in Goundam: a part of the Route Nationale 33. The small size of the city allows us to verify this using OpenStreetMap and Google Earth Pro. The drone flies slowly, keeping the river on its right and dives before crossing the bridge. This would make this location (16.41322°N 3.65451°W) a likely candidate. Let’s confirm this with the rest of the video.

Confirming the location

Analyzing the trajectory of the first drone, we can draw a rudimentary scene: the drone flies over a wall, passes some trees and a first structure, possibly a shed, takes a quarter turn to the left and dives toward the liquid container. This fits the Google Earth satellite imagery of the candidate location.

Analyzing the video of drone #2, we can map several elements from the video to Google Earth’s imagery. This includes the bridge that helped us chose this location in the first place.

This gives us the following flight path for both drones. Using a more recent image from Vantor, dated 11 days before the attack, we can confirm the end of flight of drone #1. The setup of the trucks and liquid container matches with the first image of the video, helping us confirm the location.

The position of the sun also matches our candidate: using footage from drone #1. In the screenshot below, the building in the lower left corner of the is the structure next to the liquid container targeted by the drone. Using Suncalc we can assess that the footage does match that location and the time mentioned by the FLA spokesperson, most likely around 8AM UTC.

Conclusion

According to the video, drone #2 seemingly ended its flights in a cluster of trees. A fact mocked by a Wagner adjacent Telegram channel a day after the attack.

The final frames of the video for each drone have been located to 16.41319°N 3.65451°W (Drone #1) and 16.41358°N 3.65453°W (Drone #2) with a high level of confidence. We can assess with low confidence that the attack happened around 8AM UTC.

What is a CTF?

A “Capture The Flag” (CTF) is a competition where participants are tasked with answering several questions, also called challenges, by submitting a “flag”, usually a string of character following a particular format, e.g. “myctf{paris}”. Finding the correct answer to a challenge rewards you or your team with points, participants with the highest score at the end of the event wins.

Historically linked to cybersecurity, these contests can task participants with the decryption of a file, breaking into a web server (spun up for the occasion), etc. These events are an opportunity to team up with fellow practitioners, hone your skills and confront situations you might not encounter in your day-to-day activities.

Let us now dive into the many pitfalls a good CTF should not fall into.

Fighting the information asymmetry

A good CTF challenge should pique the curiosity of a participants and launch him on a chase around the internet, hopefully discover new tools, investigative techniques or pivots. We need to make the user ask themselves, “How can I answer this?” without sinking into despair. This is fine line to walk on as too vague a question will lead to ambiguity as to what answer we expect and too specific a question will give away the path to get to the answer.

We also need to account for the fact that a question might have several answers, that we do not know about. For example, before asking: “What is this person employer?” we need to ensure that this person currently only has one job or be more specific in our question such as “For which Spanish company does this person work?”.

Half of the work of an OSINT investigator is to ask the right questions, the other half is answering them.

Choosing the data sources

Unless you are doing a CTF specifically created to promote a tool or data source, you will need to take into account that most participants do not have access to a wide array of paid sources. Adding a challenge which necessitates access to Planet or Maxar without having the possibility to use free alternatives like Copernicus or Google Earth will only frustrate people as it would be perceived as a “pay-to-win”. Ideally the data should be accessible to every participant; its interpretation being the challenge.

It is illusory to thing that having access to paid tools will not give an edge to some. We cannot control for this factor. But we must ensure that there are freely accessible alternatives where the needed data exist. Before adding a challenge, make sure that the data needed to answer it is present in at least one freely accessible tool. Below is a list of types of data with suggestions of freely available sources.

Satellite Images

• Satellite image providers: Copernicus, Skifi, Soar, EOS, NASA Firms, etc.
• Mainstream maps: Google Earth, Yandex Maps, Apple Maps, etc.

Leaked Data

• Paste website: Pastebin, etc.
• Organized leaked data: OCCRP Aleph or the Offshore Leaks.

SOCMINT

• Online service: EPIEOS.
• Comand line tools: Sherlock, Holehe.

Corporate registries

• Country / state specific corporate registries: Curaçao Chamber of Commerce, Company House, etc.
• Aggregators spanning multiple countries: North Data, OpenCorporates, etc.

WHOIS registry

• Online services: WHOXY, who.is, etc.

Maritime data

• AIS data visualisation: Marine Traffic, VesselFinder, etc.

• Ship photographs: ShipSpotting, Ship Photo Roster, etc.

• Ship crews: BalticShipping, etc.

Plane data

• ADS-B data visualisation: flightradar24, ADS-B exchange, etc.

• Plane photographs: JetPhotos, PlaneSpotters, OneSpotter, etc.

Defining a clear format for your answers

Most challenges will ask for an answer as a text input, then match this text against possible correct answers provided by the organisers. This works very well in a cybersecurity CTF, where you can ask users to find a string of character in a file: the user copies and paste their finding. There is no possible ambiguity on the format of the answer.

Things get a little trickier in OSINT because a question might have several correct answers. For example: When asking “Who is the current Russian leader?” you could get the following answers: Vladimir Putin, Vladimir Vladimirovich Putin, Владимир Путин? Accepting only “Vladimir Vladimirovich Putin” as an answer while not specifying the expected format can lead a participant with the correct answer to spend ten minutes fidgeting with their answer, trying to make it fit. This is easily avoided by clearly communicating the format of the answer you expect.

Another useful tools are scripts or regex to verify flags. Instead of expecting exactly “Maltego Technologies LTD”, we can match on any flags that contain “maltego”, “technologies” and “ltd”. This would validate correct answers like “Maltego Technologies ltd” or “Maltego Technologies LTD.” which we might not have accounted for when doing an exact match.

Choosing a scoring system

The basic principle of a CTF is that the highest score wins. But there are subtleties to this: should the team first to solve a challenge (a.k.a: first blood) obtain a greater reward for being the fastest or do we consider that solving the challenge whether in five or fifty minutes entitles participants to the same amount of points?

We can apply a degressive point system if the first option is chosen. However, it is better when reserved to the more difficult questions in your CTF. Applying this principle to a challenge that would take most people five minutes is not rewarding the fast or clever participants, it is rewarding the ones that clicked on the challenge first.

Catering to all levels

Not every CTF is made for a large public, but when they are, a problem quickly arises: how can we not bore the experts while not making the beginners feel completely lost? There are three maneuvers that we can use here: adding hints, multiplying the questions and breaking down questions.

Hints are little helps that competitors can unlock, they are usually unlocked by reducing the amounts of points given by a challenge. They can range all the way from mentioning the type of data that should be used (ex: “Use corporate registries.”) to giving the answer so people can go to the next question; in which case the cost of the hint should cover the entire reward for the challenge. They allow beginners to be guided through difficult questions meant for experts.

Diversifying the questions is also a good way to cater to different level if done correctly. Do not flood your CTF with five hundred questions that require participants to google something: artificially padding the content of your CTF will make for a boring event. If the duration of your CTF allows it, make challenges that require teamwork where more experienced practitioners can direct newcomers. For example, a geolocation challenge might need an expert to reduce the search zone to a few kilometers, but scouring Google Street View in that zone to find the exact place can be done by beginners.

Breaking down questions can also help beginners. Instead of asking a wide, open question such as: “Who created this website?”, you can direct beginners by breaking down the investigative steps in several easier questions, with every step unlocking the next one:

1. What is the registrant email in the WHOIS registry of this website?

2. What is the FlickR account linked to this email address?

3. Based on the photographs posted by this account, who is the person linked to this account?

I hope this article helps you to organise your own CTF. You will certainly encounter more problems than the ones cited above. Just remember that perfect is the enemy of good: these events are meant to be an occasion for the community to learn, network and share. There is a joy to organizing such events even if everything does not go perfectly.

This write-up will explore the methods through which our team THEM?! solved this challenge.

Finding the general area

You can access the challenge here. In case it gets taken down, here are a few images:

Searching the windmill, the most notable element in these picture, in Google Lens yields the following results:

This kind of AI overview is powerful but always need to be checked, in case of hallucinations. Here, we can use the street sign, near the yellow building in our second image. Searching for “priority road sign sweden” yield the following image from Wikipedia, confirming that this is likely a Swedish sign.

Assuming that Google Lens is right, we restricted our search to the island of Öland. According to Wikipedia, this means we had to cover an area of more than 1300 km square kilometers.

Taking a shortcut

To avoid looking at thousands of kilometers of road, I used Overpass-turbo.eu to generate a list of all the windmills on the island.

[out:json][timeout:25];
//restrict our search to the island
area[name="Öland"];
(
  // search for windmills
  nwr["man_made"="windmill"](area);
);
// print results
out geom;

This gives us quite a large number of results, to check every pin in Google Street View in a data set this size, it is often best to export it as a .kml file and drop it into Google Earth. This will allow you to thoroughly examine each points by going down the list pin by pin.

Unfortunately, this did not lead us to the solution: Open Street Map (Overpass-turbo’s data source) is a collaborative initiative, relying on its vast community to maintain its database. This means that some elements can be missing for it: if nobody bothered adding this particular windmill, it will not appear in our search results. OSM is an invaluable source of information for GEOINT, but it is not infallible.

Please note that this windmill has since been added, however it was not present at the time of the CTF.

Reducing the area of research

After realizing that the list from Overpass-turbo.eu did not contain our target, we had to think of another way to narrow down our area of research.

Road Orientation

Because of the low altitude of the sun, we assumed this was either early or late in the day, which would position the sun in the east or the west. Because of its position in the picture, it would indicate that our road is roughly oriented North to South.

Type of road

The road shown in the picture is a very small road with no markings on the sides nor the center. This points to a remote area, separated from the main roads. This helped us to steer clear of the two main roads: road 136 and its, albeit smaller, equivalent on the east side of the island.

After this, the only thing left to do was to methodically check suitable roads. Unfortunately we quickly noticed that our assumption regarding the direction of the road was most likely false: because of how far north the island is. See below this screenshot from Google Street View with similar lighting as our target, in which you can see the sun while facing south. This Suncalc.org overview shows the sun’s behavior in December 2020. The orange line representing sunrise and the red line sunset.

By broadening the search to roads facing any direction and focusing on the northern part of the island due to architectural similarities, I was able to find the correct address here: 57.12492, 16.94668.

Tools

Google Street View, Overpass Turbo, Google Maps, Google Earth Pro, OpenStreetMap Wiki and Suncalc.org.

The 27th of March, the Telegram channel White Uncles in Africa shared the following video with this accompanying text:

🌴🇲🇱 В столице Мали снова замечен военный конвой с техникой и контейнерами. Западные теребоньки предполагают, что это для “Африканского Корпуса” (МО РФ).

Here is what Google Translate makes of this text: “🌴🇲🇱 A military convoy with equipment and containers has been spotted in the capital of Mali again. Western terebonki assume that this is for the “Africa Corps” (RF MoD).”

The first thing we need to do is verify if the caption is indeed correct.

To corroborate that this is a military convoy, we can focus on the licenses plates (white letters on a black background) which match the ones used by the Malian army (see examples here). The presence of men in military fatigue aboard several vehicles is also a strong indicator. Let’s geolocate the video to confirm it was taken in Bamako.

Where was the video taken?

Looking at the video, a large monument with a golden apex can be seen in the background. By searching it on Google Lens and adding “mali” as a search keyword, we can establish that this structure is the Monument de l’indépendance in Bamako (2.6371, -8.00471).

This monument is connected to three different roads: boulevard du 22 Octobre, Avenue de la Nation and Avenue de l’indépendance. Let’s determine which road was taken by the convoy.

No Google Street View? No problem

Normally, we would simply drop in Google Street view, look around and match specific features in the surrounding area to what is shown in the video. Unfortunately for us, Google Street View is not available in that zone. As an alternative, we have to search for footage of this area.

To demonstrate how to do so, we can take the big blue building visible in the top left corner of the central screenshot below.

This is most likely the building inside the red rectangle in the Google Earth Pro screenshot. This TikTok post from January 2025 shows a similar view of this building (left). This post was filmed roughly at the same place where our video was filmed, at the yellow dot on the Google Earth screenshot above, at 12.638027°, -8.005047°.

We successfully verified what the fact cited by the caption. However we have one problem: the video is edited, we cannot estimate how long the convoy is or its composition.

A second video of the convoy

Looking for other sightings of that convoy, we find a longer, unedited video published by the Bamako based media Cap Mali:

This 20 minutes video is a from a live broadcast and shows the convoy in its entirety:

• 104 trucks with a container
• 19 pickup trucks with a mounted gun
• 12 pickup trucks or cars
• 3 tank trucks (possibly carrying fuel)
• 1 car bearing red crosses
• 1 truck carrying a boat
• 1 truck carrying a Lonking LG100DT diesel forklift
• 1 towing and recovery unit Century 5230 from Miller Industries
• 1 QY50KD crane from XCMG

To confirm that these two videos show the same convoy, we search for the same vehicles being present in both videos, as shown in the screenshots below. This is made easier by the colored stripes on their push bars.

1_cJZNd_lKzFwk96WMFwQtyg.png 1_NukithvgQo6biyaiGf0OXA.png 1_TQBNzZ5l5iNJYTfeVZTQ_g.png 1_aRPHKVND3iy-tbkpLuB9hQ.png

While doing interviews, the camera pans around and gives us some precious information to help geolocate this footage: showing a gas station called Soleil Oil. By typing that name in Google Maps, we can easily establish that this footage was taken from the roundabout at 12.612658°, -8.044582°.

To better understand the path taken by the convoy, we can take a look at a map and add the direction taken by the vehicles in each video.

Tools and Websites

Google Lens, Google Earth Pro, TikTok and Francoplaque.

I hope that this short blogpost was informative, to go further on that subject, you can read this excellent post focused on a similar convoy spotted earlier that year: Special Report: A Convoy of Over One Hundred Russian Vehicles Arrives in Mali .

• First week: Bellingcat Globetrotters
• Second week: Maritime Mysteries

As per Bellingcat’s wishes, the complete images are not included to avoid polluting the image reverse search results, however a description in italic has been added as well as a link to the picture. The challenges are available here.

The answer to each challenge is highlighted in bold at the end of its section.

1 — Name that street!

There are plenty of areas to walk in cities around the world, and this street is one of them.

But where is it?

What is the name of this street?

Puzzle by Kolina, Bellingcat

The accompanying picture shows a street, seemingly in a city center. Buildings, approximately four stories tall, are located across the street. Cars with visible license plates are parked near it. See the full picture here.

This first exercise is quite simple, zooming in the picture we see a street sign with German words on it, a German license plate and a store named: JP STOFFE.

We know that we are likely in Germany thanks to the first two clues, hopefully the last one will help us to narrow it down further. Searching for JP STOFFE in Google Maps yields only three results, all near the German city of Frankfurt:

After testing the three possible locations, the North-East one seems to be the correct one. This can be confirmed using Google Street View. The name of the street is Stiftstraße.

Tools and Websites

Google, Google Maps, Google Street View.

2 — What a Dump!

Sometimes the most interesting things are found in the most unexpected places…

… but sometimes those places are full of trash.

This dumpster is in an alley somewhere, but where?

Where was the photographer standing when they took this photo? Use latitude and longitude in decimal format with three decimals (12.345, -67.890).

Puzzle by Jake, Bellingcat

The accompanying picture shows a green dumpster with several graffiti and a partial phone number. The surrounding alley is full of graffiti. There is a small, bridge-like, structure connecting two building on each side of the alley. See the full picture here.

Let’s direct our attention to the dumpster mentioned in the description of the challenge. There is a white logo on it, as well as two graffiti.

The logo belong to the company Waste Management, Inc. which, according to its Wikipedia page, operates in North America.

Guilt Parade is a music band from Washington DC, according to their Bandcamp profile.

Howard U seems to be a reference to Howard University, a research university also located in Washington DC.

Using Google Lens on the roofs on the left side of the alley and adding “Washington DC” in the search bar yields several results mentioning Brentwood, a neighborhood in DC. If we repeat the same process on the entire picture the Instagram post below comes up. Accompanied by a caption mentioning Minetta Tavern, this image bears similarities to our picture: brick buildings full of graffiti, worn out concrete slabs as pavement, dumpsters, and taller building surrounding the alley. While none of these elements are unique individually, their combination is close to the exercise’s picture.

Minetta Tavern is located less than two mile from Howard University and near Brentwood. Looking at the streets nearby with Google Street View, we stumble upon this familiar view:

After searching for the Street View picture closest to the exercise picture, we end up with the following coordinates: 38.909, -76.998.

Tools and Websites

Google Lens, Google Street View, Google, Google Earth Pro.

3 — Highway to the Unknown

A car’s moving quickly along a highway, luckily there are some visible structures in the rear-view mirror and on the road-side to help you with your geolocation.

The prominent building bears the name of a person, what is that name?

Puzzle by Lucy, Bellingcat

The accompanying picture shows a red car, speeding down a highway with a black contraption on its roof. A side view mirror can be seen on the foreground, showing a pedestrian bridge. In the background, a two story building surrounded by trees can be seen. See the full picture here.

The amount of information in this picture can be overwhelming: the species of tree, the markings on the side of the road, the make and model of the car, its license plate, the pedestrian bridge, the water tank on the roof of the building, the English words on the side view mirror, the right handed driving and the large black object on the car’s roof.

All of these could be the start of a reasoning to understand where this picture was taken. But not all of them will lead us to the answer, and not in the same amount of time. Let’s focus on the clues that allow us to eliminate the widest area.

Driving on the right and speaking English

Because of the vegetation and architecture, we will assume that this was taken in Africa. To narrow down the list of possible countries, we can use the right handed driving and the use of the English language in the side mirror. Let us keep only the African countries that use English as an official language and drive on the right using these two Wikipedia article:

• Left- and right-hand traffic
• List of countries and territories where English is an official language

This leaves us with the eleven following countries: Burundi, Cameroon, Eswatini, The Gambia, Ghana, Liberia, Nigeria, Rwanda, Sierra Leone, South Sudan and Sudan.

Is this plate regulation size?

To remove countries from this list, we can use the license plate. Although it is too blurry to make out the exact country, we can use its white background and its dimensions to exclude countries.

Using the website WorldLicensePlates.com we can examine the format and colors used by the countries on our list. For example Cameroon and the Gambia can both be taken out, respectively because of the background color and the dimensions of the plate, too narrow to match the picture.

Press enter or click to view image in full size

Using this process, we can focus our efforts on three countries that best fit the license plate: Nigeria, Sudan and South Sudan.

We will cross that bridge when we get to it

We can use Overpass Turbo to look for features present in our picture. The first obvious feature is the road but we need a second one: the bridge in the side view mirror, likely designed for pedestrians judging by the size of its railings.

We need to design a query that will highlight the kind of road shown in the picture and a pedestrian bridge. To know what kind of road this would be tagged as, we can refer ourselves to this discussion on the topic. From this page, the suitable values for highway seem to be motorway, trunk and primary. Because we want to run this query over large areas, let’s not forget to add a higher timeout value.

This allows us to write the following query.

[out:json][timeout:250];  
  
// get roads matching the picture  
(nwr["highway"="motorway"]();  
 nwr["highway"="trunk"]();  
 nwr["highway"="primary"]();)->.main_highways;  
  
  
// get bridges that are also a footway  
(nwr["bridge"]["highway"="footway"]();)  
->.bridges;  
  
// get bridges that are next to our set of roads  
nwr.bridges(around.main_highways:1);  
  
out geom;

After running it on our three remaining countries, it appears that only Nigeria offers suitable locations. See a screenshot of the results below.

As the number of results is quite large and verifying them with Google Street View is more comfortable, a good way to review these results is to export them as KML files to visualize them in Google Earth Pro. The two main areas concentrating these results are Lagos and Abuja.

After reviewing several of these results, the exact model of LED streetlight shown in the picture (white pole with a flat top) seems to be mostly found in Abuja. This is where we will focus our research. This gives us a lot less results to verify.

After verifying the results of the OverpassTurbo query, we find the location where the picture was taken: 9.077139, 7.431690.

On Google Maps, this building is identified as the Daughters of Abraham Foundation. The video tab from this page has several entries, including this one showing a building featuring yellow letters spelling: Julie Useni.

Tools

Google Street View, Overpass Turbo, Google Maps, Google Earth Pro, OpenStreetMap Wiki, WorldLicensePlates.com.

4 — Foul Play

This is what it looks like to be on the receiving end of a foul ball at a baseball game.

Be careful out there! But who is responsible for this hit?

What is the name of the batter?

Puzzle by Giancarlo, Bellingcat

The accompanying video is eight seconds long. It is shot from the seats of a baseball arena. People seated in the foreground are wearing light blue jerseys. A match is being played on the field. Link to the video here.

Taking a good look

Several avenues could be explored here: finding the venue as well as the teams playing, then finding the match and checking which player hit a foul ball.

However, before proceeding with our investigation, it’s essential to ensure that we haven’t overlooked any important details. Here for example, the ribbon video board is displaying a name and a number: 31 DELOACH.

Justifying our answer

One could input that answer and go to the next challenge, but being able to argument a finding is as important as the finding itself. So let us verify that answer by finding the match. According to his MLB page, Zach DeLoach plays for the Chicago White Socks.
To find the opposing team, we can look at the jerseys some of the fans in the stadium are wearing, specifically the one with “Bichette” on its back. According to his MLB page, Bo Bichette plays for the Toronto Blue Jays. Moreover, there is a blue advertisement stating “official hot dog of the Toronto Blue Jays”. This leads us to believe the video has been taken at the Rogers Center, home of the Blue Jays.

We can use the information we just learned to find the match. The Google search white sox vs blue jay roger center play by play yields two recently played matches: the 21st and 23rd of May 2024; but only one of them mentions a play similar to the one in our video. In the match of the 23rd of May, ESPN Singapore reports that “Deloach flied out to left”. This confirms our answer, Zach DeLoach is the batter in this video.

Tools and Websites

MLB.com, ESPN.com.sg, Google.

5 — On The Metro

Watching the metro go past.

Where is the photographer, what is the line, and where is the train heading?

What is the destination station for this train?

Puzzle by Michael, Bellingcat

The accompanying picture shows a metro platform, from which a red and white train is departing (or arriving?). Someone is standing at the end of the platform, seemingly looking at the wall. See the full picture here.

Finding the metro lines

As suggested by the title and confirmed by the architecture of the station and the fact that it seems to be underground, this is a metro station. Our next step is determine the city in which this station is located. We can use the train livery to do so. Google Lens gives us several results, but this particular one matches both red lines and what seems to be horizontal folds in the metal underneath:

Similar photographies recommended by Shutterstock, identify this location as the Prague subway. According to its Wikipedia page, this particular subway system only has three lines, which will simplify our search. To narrow it down further, the same page details the rolling stock used: Metro M1 trains and 81–71M trains. The latter matches our picture and is used on lines A and B of the Prague subway.

Finding The Station

Fortunately, UrbanRail.net contains pictures of the metro stations on the lines we are interested in. To accelerate this process, let’s focus on the three following points: the square shape of the train tunnel, the black tiles on the wall and the rectangular light fixtures. After finding suitable stations, we can look at the vlogs from this YouTube channel to confirm which side of the platform is shown. Hůrka seems like the most likely place where this picture was taken. See below a comparison of the picture and this YouTube vlog.

The picture above shows the platform in the direction of Zličín.

Tools & Websites

Youtube, UrbanRail.net, Wikipedia, Google Lens.

I do hope this article shed some light on the methods and reasoning that could be used to solve these challenges. If you did not already, check out Bellingcat.com for exciting OSINT challenges.

As per Bellingcat’s wishes, the complete images are not included to avoid polluting the image reverse search results, however a description in italic has been added as well as a link to the image. The pictures and the challenges are available here.

1 — Fully Stocked

Container vessels are a common sight in ports around the world, but this one is particularly well-stocked. They’re a vital part of the global supply chain, but where is this one moored? In which city would you find this port?

Puzzle by Galen, Bellingcat

The accompanying picture shows the side of a ship with the letters “U A S C” on its starboard side. More than a dozen of container cranes can be seen. They are marked with a partly obscured word: “…RDKAI”. See the full picture here.

The lettering on the crane, could be there for several reason: a brand, name of the harbor, etc. To confirm this, let’s search RDKAI port crane in Google. This yields several links and images, including the image below.

The color of the upper part of the cranes in this image match the one in the exercise’s picture. The font of the lettering matches as well. The title of this picture mentions Hamburg and it is indeed the right answer. Note that the exercise picture is cropped version of another photography, which could help to verify that it is indeed the Burchardkai terminal.

Tools & Websites

Google

2 — Operation Fleet Finder

Here are a handful of naval ships moored together, but grey is the only colour in sight. They all look the same! Can you help identify them? What is the MMSI number for the left-most ship?

Puzzle by Bellingcat

The accompanying picture displays two large ships painted in grey with a smaller vessel on the right. Two docks, as well as a floating barrier hint that this is a harbor.

See the full picture here.

Finding the right-most ship

As always, zooming on the picture will help us to isolate useful details. There is an American flag and a 69 on the island of one of the ships.

Another information we can add, is that the two main ships in that picture seem to be aircraft carriers. This narrows down the field of research: we are searching for an aircraft carrier, likely American. Lucky for us, they are few and far between.

Identifying the ship with the number 69 could help us to get to our ship of interest. This is a hull number and can be used to identify a ship if we know its type. Here “aircraft carrier” will be enough. Looking through the list of the US Navy aircraft carriers, we find the USS Dwight D. Eisenhower bears this number.

Who is your friend?

Interestingly enough, the list also mentions where the USS Dwight D. Eisenhower is stationed: Naval Station Norfolk. At the time of writing, it remained here according to MarineTraffic. Considering the American flag, it is likely to be where the picture has been taken.

Using the same list mentioned below, we can see that there are four other aircraft carriers stationed at the same place:

• USS John C. Stennis
• USS George H.W. Bush
• USS Harry S. Truman
• USS Gerald R. Ford.

To find the correct ship amongst these four vessels, we can use the design of their island.

This allows us to conclude that the mysterious vessel is the USS George H.W. Bush. His wikipedia page lists his MMSI as 368962000.

Tools & Websites

Google and Wikipedia.

3 — Cyrillic Confusion

In November 2024, two underwater data cables in the Baltic Sea experienced faults, disrupting communications between European nations and igniting suspicions of sabotage. A Chinese cargo vessel, the YUI PENG 3, quickly became a focus for both investigators and the online open source research community. Some mistakenly suggested that this port log showed the vessel’s captain was a Russian citizen (they confused a temporary harbor pilot with the ship’s captain). But a key question emerged: could the authenticity of the log be verified?

What is the original URL for this log? (don’t include the “http://” or “https://”)

Puzzle by Tomi McCluskey, Bellingcat Volunteer Community

The accompanying pictures is a table listing the movement of a ship called YUI PENG 3. It mentions several operations with their nature and date. See the full picture here.

Searching for a known document across the Internet is usually an easy task. Thanks to search operators available on various search engines, we can orient our query to seek strings of characters or a type of file.

But, this case is not so simple. Googling “No 165759” YUI PENG does not yield any worthwhile results. This is where we have to take into account the differences between search engines. Although Google is the main tool to explore Internet in western countries, other regions use different solutions such as Baidu or Yandex. These can yield a different result for a similar input.

Running the same search on Yandex does indeed give us the correct link: skap.pasp.ru/Move/InOutMoveList/165759?harb=UL

Tools & Websites

Yandex.

4 — Clouded Perception

This serene lake is a beautiful sight, but something is off: this image has been manipulated. What should we do if an image is altered, either by hand or with AI? What is the 6 digit number hidden in the image?

Puzzle by Galen, Bellingcat

The accompanying pictures show a person standing on a pier set on a beautiful mountain lake. The clouds and the surrounding mountains are soaked in a bright orange, too flamboyant to be genuine. See the full picture here.

How can we answer a question in a field we know nothing about? A natural first step is to look at what other people have done. Bellingcat has verified the authenticity of images before like in this article from Annique Mossou or this one on the MH17 flight.

One technique used to identify altered pictures is ELA (Error Level Analysis). It highlights areas with different compression level which can indicate areas where a picture has been modified. You can find a detailed explanation and instruction on how to use it on its creator blog. See below a comparison of the ELA of an image and its modified version.

Use the slider below to progressively overlay an altered image and its ELA output.

Opacity Control

Forensically offers a web interface allowing users to perform ELA as well as other operations. By uploading the exercise image and tweaking the parameters in the ELA module, we obtain the picture below.

The digits 428309 are highlighted in the sky above the mountains.

Tools & Websites

Forensically, Bellingcat.com, fotoforensics.com

5 — Synoptic Code

This is a morse code transmission received on the 13th October 2024. The sender is thought to be the Yelnya, a Russian ship operating on the Black Sea.

.-. -.-. …- / -.. . / ..- -.-. — .- ….. / . — — … — . — — — -.. . — — / — — . — — . … — ….- ….. / . — — — — — … — ….- -…. / ….- . — — -…. — — . — -.. / … — .. — — ….- — — — ….. / . — — — — — .. — — — -.. — — — / ….- — — — . — — .. — — — — — / ….. ….- — — — — — — — — — / — … — — — .. — — — — — — — — / — -.. … — ….. — — — — — — / .. — — .. — — .. — — ….. .. — — / — — — — — — .. — — — -.. — — — / . — — … — — — — . — — .. — — / -… — / .- .-. / ..- -.-. — .- ….. / -.

Can you decode the message? What was the reported air temperature in degrees Celsius? (give your answer to one decimal place i.e. “12.3”)

Puzzle by Galen, Bellingcat

The accompanying picture shows a table matching the 26 letters of the latin alphabet with their associated morse translation. See the full picture here.

Understanding the format

After using one of the numerous morse translator available online, we are left with the following message:

RCV DE UCTA5 13181 99345 10346 41698 32405 10280 40120 54000 70200 83500 22252 00280 13012 BT AR UCTA5 N

To better understand this message, we need to understand what the subject of this exercise is, what is a synoptic code? According to this page from the US National Snow and Ice Data Center, it is “a code […] by which meteorological elements observed at the earth’s surface at synoptic times are encoded in groups of five figures”.

Thus, the information we seek is in the digits between RCV DE UCTA5 and BT AT UCTA5 N. To understand the message, we need to know the format used they use. After a quick google search, we find this blogpost suggesting that Russian meteorological reports in the Mediterranean use a code called FM-13-X-SHIP.

Decoding the message

This format seems to be widely used, this document from the Naval Postgraduate School of Monterey (CA) explains how to decode it. The Surface Air Temperature Group seems to contain the information we need.

We now need to identify the correct digit group in our message: 13181 99345 10346 41698 32405 10280 40120 54000 70200 83500 22252 00280 13012.

We know the group we are searching for begins by a 1, followed by a 0 or a 1. This leaves two possible group open: 10346 or 10280.

However, the first group (10346) is preceded by another group: 99345. According to the document mentioned above, it is the Ship Latitude Group which means that the following group (10346) is the Ship Longitude Group.

This only leaves us with the 10280 group which would indicate a positive temperature of 28.0°C.

Bonus

If we decode the longitude and latitude group, we obtain the following coordinate: 34.5°, 34.6° which is in the Mediterranean sea between Cyprus and Lebanon, not the Black sea as the exercise mentions. Where is the discrepancy coming from?

Well one explanation is that the synoptic codes did not originate from the Yelnya but were merely retransmitted, as suggested by the first part of the message: RCV DE UCTA5 which likely means that the following message has been received from UCTA5. UCTA5 is also a name that fits naming conventions of the Russian navy mentioned in the blogpost mentioning FM-13.

Because the message sent by UCTA5 also has a Observation Time and Wind Indicator Group (13181) we know that UCTA5 sent this message the 13th of the month at 18:00, which matches with the exercise’s instruction.

Tools & Websites

MorseCodeTranslator.com, i56578-swl.blogspot.com, met.nps.edu, nsidc.org

I do hope this article shed some light on the methods and reasoning that could be used to solve these challenges. If you did not already, check out Bellingcat.com for exciting OSINT challenges.

As per Bellingcat’s wishes, the complete images are not included to avoid polluting the image reverse search results, however a description in italic has been added. The pictures and the challenges are available here.

The answer to each challenge is highlighted at the end of its section.

1 — A Sticky Situation

In August of 2022, Bellingcat’s Foeke Postma found himself looking over this beautiful view, complete with a Bellingcat sticker! But where was this enviable mountaineering adventure taking place? What is the name of the mountain on which Foeke was standing?

Puzzle by Foeke, Bellingcat

The accompanying picture shows a green zigzag shaped valley, set between mountains. On the right side, close to the camera, is a wooden structure with several stickers on it.

Reducing the area of research

Zooming in on the stickers on the right of the image, we can see some text written in German as well as the Tyrol region being mentioned several times. Uploading the picture on Google Lens and focusing the tool on the mountains in the left part also leads us to the same area. The vegetation, mostly coniferous, also matches that part of the world.

The Tyrol is a large region spanning several countries, finding the valley in the picture seems like a safe way to find the mountain we are searching for. To do so, we need to list characteristics that will allow us to find it using satellite imagery.

Orientation of the valley

We know that the picture was taken in August 2022 and looking at the picture, trees cast shadows longer than their own heights which indicate that this is likely toward the end of the day or early morning. Using suncalc.org, we can determine the approximative position of the sun in the picture. Which in turn allows us to determine the orientation of the valley: roughly North West to South East.

Is that a lake that I see?

Looking at the background of the picture, we can distinguish a uniform blue mass at the bottom of a valley, most likely a lake. The shape of the valley leading to it, forming a Z, should also be noted.

Take it to the sky

Using Google Earth Pro, let’s take a look at the Austrian part of the Tyrol. To make this easier, we have to reduce the amount of information on our screen, disable any layers except borders. After a bit of searching, a suitable location present itself.

This particular area does fit our criteria:

1. A lake in the background.
2. Z-shaped valley leading up to it.
3. The valley is roughly oriented NW-SE.

Let’s take a dive using the ground-level view feature of Google Earth Pro Please note that a better alternative might have been PeakVisor, which Bellingcat has used in the past. Regardless of the tool, we are able to obtain a picture that looks very much like the one from the exercise.

Use the slider below to progressively overlay a Google Earth screenshot with the challenge’s picture.

Opacity Control

According to PeakVisor, the name of the mountain from which the screenshot was taken is the Wiedersberger horn.

Tools used

Google Earth Pro, PeakVisor and SunCalc.

2 — Flamin-Go Find It!

When Kolina was out and about she snapped this shot of some friendly flamingos. These wading birds are known for their long legs and bright pink plumage, and can be found all around the world. Can you wade through this challenge to find them? What is the name of the area in which you’d find these flamingos?

Puzzle by Kolina, Bellingcat

The accompanying picture displays a group of flamingos. A shallow pond occupies the lower third of the image. In the background, a chain-link fence and a wooden shack blend with a hedge.

Analyzing the picture, we can notice a few things: there are man-made structures in the background, seemingly forming an enclosure. Moreover, a majority of the flamingos have one or two rings on their legs. This could indicate that the picture was taken in a zoo.

A vast number of zoos have flamingos amongst their residents, to narrow it down we can identify the exact species of flamingo on the picture.

Google Lens identifies these birds as Chilean flamingos (Phoenicopterus chilensis), we can corroborate this by looking at their white and black beak, grey legs, and the paler shade of pink of their plumage.

Interestingly enough, the author of this challenge is Kolina Koltai, who co-authored this compelling article about OSINT done wrong. A quick Google search leads us to her Twitter account, which bio indicates that she is located in Seattle, WA.

Searching for “chilean flamingo zoo seattle” on Google yields the following link from the Woodland Park Zoo, describing the animals they house in the Temperate Forest area of the zoo.

To confirm that we have the right place, let’s search for pictures of the enclosure in Flickr. Several picture such as this one, look similar to the challenge’s picture.

This confirms Woodland Park Zoo as the correct location.

Tools used

Google and Google Lens.

3 — Pulling Focus

When Aiganysh was travelling by car, she took this photograph of a building. Despite her best efforts, the building came out a little blurry. Can you figure out what the building is used for? What is the function of this building?

Puzzle by Aiganysh, Bellingcat

The accompanying picture shows a house with a two lines written in Cyrillic on its front. It is seemingly taken from a moving car, on account of the blurriness of the image and the road in the foreground. Hills with little vegetation can be seen in the background

When it comes to geolocation, a building name is often the quickest way to know where a picture was snapped. This is no exception. However, the picture is slightly blurry, making it difficult to read. Especially for people that do not know how to read Cyrillic.

Luckily, Google Lens has OCR capabilities:

This leads us to the village of Kazan-Kuygan in Kyrgyzstan. Fortunately for us, this hamlet has only one main road that would match the one from which the picture was taken. Traveling across it using Google Street View, we come across this location that seemingly matches the exercise (41.629530, 75.845130).

One small detail remain: the building that we are supposed to identify is missing from the Street View imagery. Luckily, this is explained by looking at the imagery date on Google Earth Pro: 10/2015. The same location, viewed with satellite images from March 2023 has the building from the challenge.

Google Maps does not have further information on this particular building, but fortunately, Open Street Map does: it is tagged as a library.

Tools used

Open Street Map, Google Earth Pro and Google Lens.

4 — The Rider’s View

This street scene was captured by Giancarlo, but perhaps he left out an historic detail. What nearby monument can the rider see from their vantage point? The monument is to a person, what is their name?

Puzzle by Giancarlo, Bellingcat

The accompanying pictures shows a busy street. White and yellow markings can be seen on the ground as well as a few cars and a motorcycle. Mid-rise buildings are spread alongside the road.

Using Google Lens on the picture yields several results linked with Colombia. To verify this, we can take a look at several details in our picture:

1. Traffic light: matches the ones that can be found in Colombia. As shown in this article.
2. Bancolombia logo: This bank is present in 4 latin American countries according to their website: Colombia, Panama, Guatemala and El Salvador.
3. License plate: This plate matches the format of Colombian license plate for a private car as per Wikipedia. Unfortunately, the quality of the image does not allow us to see the city which issued it.

This picture has very likely been taken in Colombia, but to determine where exactly, we will have to continue using Google Lens.

Focusing on the peculiar looking buildings on the left yields a link to a video posted on a Colombian realtor page. The selected building can be seen at the 0:15 second timestamp, thus proving that it is the same street captured by our picture. The video begins by panning on some giant multicolored letters spelling “BOGOTÁ” which is a strong clue as to where the picture was taken. We will use them to search that specific street.

Searching for the words “letras bogota” in Google Images produces the following link from the city official website, linking the letters with el parque de Los Hippies.

By searching “parque de los hippies bogota” on Google, we find this TikTok post which tells us the park used to be called Julio Flórez and that a bust of the poet is located in the park. This is the monument mentioned in this challenge.

Tool used

Google Lens

5 — Lost in the Fog

For this photo Nick was stood in a field shrouded in a thick fog. At least it looks like there’s an airport nearby. But what airport is it? It’s not complex if you know how to look! What is the ICAO code for the airport?

Puzzle by Nick, Bellingcat

The accompanying picture displays a foggy field. There is grass on the grounds as well as a few shrubs. A biplane lurks in the background.

Several things could help in this image: the vegetation, the weather, the biplane in the background, the fact that there is an airport nearby, etc. This challenge is much simpler than that. Using the EXIF Viewer Pro extension or ExifTool, we can take a look at the metadata data linked with this image. Coordinates are attached, linking to the Lundy Island Airfield (EGZV).

Most social media platform remove metadata, but it can be worth checking if you do not know the platform’s policy. Some websites choose to display them such as Flickr, as they can contain information on the type of camera used to take the picture, if the flash was used and sometimes geolocation data.

Tool used

EXIF Viewer Pro Google Chrome extension

I do hope this article shed some light on the methods and reasoning that could be used to solve these challenges. If you did not already, check out Bellingcat.com for exciting OSINT articles.

• At which train stations did the person board and alight?
• What is the mode of transportation in each image?
• What is the type of train they rode?
• What is the speed at which the train was traveling when the footage was recorded?
• Approximately how far did the person travel overall?

This goal of this article is to show you how to geolocate the places shown in each file, using different tools and methods. The files are sorted by difficulty, with each methods and locations listed in bold. After locating the files, we will focus on answering the questions.

Starting material

Helva Art Café Shop — Easy

Method: Google Maps

The first thing that jumps out in this picture is the wooden sign with the word “HALVA” written on it. After zooming on the sign, we can see that it reads “HALVA Art café shop”.

A quick search on Google Maps gives us only one results: a store in Tashkent (Uzbekistan). A white Ferris wheel can be spotted a 100m south of it, matching the one in the picture’s background.

Given the location where that picture was taken (pedestrian area) and the type of street in the picture, we can assume that this picture was taken by someone walking.

Location of the picture: 41.326065, 69.265462.

Chorsu Bazaar — Easy

Method: Reverse Image Search

After loading the picture in Chrome, Google Lens matches it to the Chorsu Bazaar in the same city as the first picture: Tashkent (Uzbekistan). Unfortunately Google Street Views is not available there, to confirm that this is the correct location, we can search for social media post of the place: this YouTube vlog shows the same ads and white arches as seen on the picture.

Given that the exercise’s picture is taken from an elevated point of view, we can assume that the photograph was standing on the stairs entering the main building of the bazaar. This also aligns nicely with the building in the background behind the lamppost. The person was walking when taking the picture.

Location of the picture: 41.326295, 69.235048.

Subway entrance — Medium

Method: Overpass Turbo

This is the first picture in this exercise which is not trivial to geolocate: reverse image search did not give any useful results and neither did googling elements of the pictures such as the Samsung Galaxy sign.

Looking at the picture we can isolate two useful features for geolocation: two bus stops and a metro station. After a quick google search, it appears that the red sign adorned with a white “M” matches the logo of Tashkent’s metro. This narrows it down but there are more than 50 metro stations in Tashkent, we have to reduce the number of places to check.

This is where Open Street Maps comes in: we can use it to query places in Tashkent that fit the following description: a metro entrance near a bus stop. If. you want to learn more about OSM and Overpass-tubo.eu, read this great three part tutorial from Nixintel.

After positioning our bbox over Tashkent, we can run the following query on overpass-turbo.eu:

[out:json][timeout:25];
// store all subway entrances in subway
(nwr["railway"="subway_entrance"]();)->.subway;
// store all bus stops in busstop
(nwr["highway"="bus_stop"]();)->.busstop;
// keep only subway entrances that are 30m or closer to a bus stop
nwr.subway(around.busstop:30);
out geom;

This gives us the following 13 results:

After inspecting them, only one location matches our picture. Using Google Street View, we can confirm the location:

The same railing, the same partial red sign in the top left corner and of course our bus stops with the nearby subway entrance.

Given that the picture was taken on a road, we can assume that the photograph was in a car or a bus.

Location of the picture: 41.299362, 69.272522.

View from the train — Hard

Method: Overpass Turbo + Suncalc

For this video, we need to think about the context: the images we are analyzing seem to be from someone’s camera roll. They are titled like a digital camera would name images: incrementally. Thus, this video, IMG_2677, has been taken after the three images we already localised: IMG_2597 (Chorsu Bazaar), IMG_2626 (Halva Café) and IMG_2658 (Subway entrance). It would stand to reason that the train this person took departed from Tashkent.

If we take a look at a map of the railways in Uzbekistan, there are 4 railways leaving Tashkent:

Now, let’s consider the following screenshots from the video:

Two crucial piece of information are on this picture:

• The sun is on the left of the screen, behind the train.
• There are mountains in the background.

While keeping the position of the sun in mind, let’s go to suncalc.org:

This shows that the train was likely traveling southwest, thus using railway number four on our map. The next major city along that railway is Samarkand. Looking at this region on Google Earth, only the last third of the itinerary (circled in red below) seems to have the kind of mountainous landscape seen on the video.

We now have narrowed it down to an area small enough to use overpass-turbo.eu, we just need to find distinctive features. Still using the same screenshot, we can make out what looks like a gas station (could also be a filling station for natural gas). Let’s use Overpass turbo to search for a railway that has a gas/filling station nearby.

[out:json][timeout:25];
// store fueling amenities in fuel
(nwr["amenity"="fuel"]();)->.fuel;
// store railway ways in railw
(nwr["railway"]();)->.railw;
// keep elements in fuel that are 50m or closer to a railway
nwr.fuel(around.railw:50);
out geom;

This leaves us with 3 possible location near Jizzax (the Samarkand results are too close to the city to match). After a quick inspection with Google Earth, we find the location. Unfortunately, there are no Google Street View to confirm this. Here are some element that are easy to spot from a satellite view that match the video:

Location of the picture: 40.097460, 67.803247.

Overpass — Hard

Method: Overpass Turbo

So far here is what we know: this person visited Tashkent then took the train towards Samarkand. They might have disembarked there or might have gone further. Given the fact that there is a taxi in the image and a large overpass, we will assume they are in a large city. We can then use overpass-turbo.eu in the same manner: identify specific features and build a query to isolate them on the map.

The bridge is an obvious feature that we should include, something more subtle would be the crowd in the background: lots of people waiting, some of them carrying large bags. This hints at public transport. After a bit of research Samarkand seems to have two main public transport: tram and bus. With that said, we can build the following query:

[out:json][timeout:25];
// gather all bridges in the bridges set
(nwr[bridge]();)->.bridges;
// gather all bus stops and tram railways in public_transport
(
  nwr["highway" = "bus_stop"]();
  nwr["railway"="tram"]();
)->.public_transport;
// get all bridges that are 50m or less from an element of public_transport
nwr.bridges(around.public_transport:50);
out geom;

We only have 3 results on the entire city. Using Google Street View, we can identify the correct location. Please note that this picture was captured in May 2024 according to Google Maps, which would explain the railings on the median (absent in the exercise’s picture).

To determine which vehicle was used is a bit more tricky, there is a window reflection in the top right corner, thus this person is not walking. Although there are tram tracks nearby, they stop before getting close enough to the bridge. This leaves us with two possibilities: car or bus. Given the shape of the seat seen in the reflection, a bus seems more likely. As the picture was taken closer to the ground, maybe a minibus.

Location of the picture: 39.665003, 66.979783.

At which train stations did the person board and alight?

We know that this person visited Tashkent then took the train to Samarkand. According to Uzbek Railways’ schedule, there are two train stations that could be the start of a journey to Samarkand (САМАРКАНД): ТАШКЕНТ Ц or ТАШКЕНТ ЮЖ. One key difference separates them: all the earliest train to depart from ТАШКЕНТ ЮЖ leaves the station at 14:20.

Let’s remember what we know from the video: the sun was behind the train. If we use suncalc.org, and carefully select the date and time, we see a train passing at 14:20 would have had the sun in front of it.

This means that the train from which the video was taken, left the station before 14:20, thus it left from ТАШКЕНТ Ц (41.291364, 69.286933). As for where they alighted: there is only one train station in Samarkand according to Google Maps and Uzbek Railways’ schedule (39.685484, 66.929131).

The person boarded their train at ТАШКЕНТ Ц and disembarked at the Samarkand train station.

What is the speed at which the train was travelling when the footage was recorded?

Now that we know where the video was taken, we can easily determine where it begins. The first image shows this location: 40.097428, 67.806656.

While the last image shows this location: 40.097675, 67.793114. Using Google Earth, we can measure the distance between the two locations which gives us 1.16 kilometer.

Since we know the video is 31 seconds long, we can proceed with the formula: speed = distance / time, we can determine the speed to be approximately 37.41 m/s (134.7 km/h or 83.7 mph).

What is the type of train they rode?

Fortunately for us, the Wikipedia page for Uzbek Railways lists the different model of passenger trains currently operated by the company: ER9E, ER2 and Talgo 250 (also named Afrosiyob). According to its Wikipedia page, ER2 maximum speed is 100 km/h which disqualifies it. We are left with the older ER9E or the modern high-speed Talgo 250. Several other pages also mention a third type of train: Sharq trains (rome2rio.com and this travel agency), to complicate things, it also has a suitable speed: 160 km/h.

The speed of the train from the video would match the ER9E, which has a speed of 130 km/h, roughly the same as what we deduced. However, this is not a definitive proof, since a high speed train like the Afrosiyob would likely have decelerated near a residential area like Jizzax, which is located near the area where the footage was taken.

I did not manage to find a definitive answer to that question.

Approximately how far did the person travel overall?

Now that we have the location and order of all the different places we know this person has visited, we can simply add the distances between all of them:

• Chorsu Bazaar to Halva Art café shop: 3.5 km on foot according to Google Maps.
• Halva Art café shop to Tashkent train station: 5.3 km by car. The itinerary proposed by Google Maps passes by the location of the subway entrance picture.
• Tashkent train station to Samarkand train station: 328 km. I could not find any information online about the length of that journey. Fortunately, Google Earth allowed us to manually create a path following the train tracks from Tashkent to Samarkand then calculate the length of this path.
• Samarkand train station to the overpass: 5.2 km. Using Moovit to list the bus lines going from the train station to that bridge, we find four lines doing the same segment (ignoring the other lines as they take a detour). According to Google Earth, this segment is 5.2 km long.

This gives us an approximate traveled distance of 342 km.

I hope you enjoyed this article, it’s the first piece of content focusing on geolocation I ever wrote; given how much fun I had, I hope it will not be the last.