Bellingcat’s december OSINT challenge, week 1

If you like OSINT puzzles (questions in the style of “Where was this photo taken?”) you’re going to love Bellingcat’s December OSINT challenge. They are releasing 5 challenges a week, each unlocking at a set date (or as soon as you solve the previous one)

In this post I’ll share the steps I took to solve the first 5 challenges. I encourage you give it a go yourself before reading further, as they are fun challenges and it’s a good skill set to hone: https://challenge.bellingcat.com

Consider this your final SPOILER WARNING

1 − A Sticky Situation

I actually haven’t solved this one. I know what you’re thinking, what a great way to start the blog post! 😁 Nevertheless, here’s how I tackled this problem:

I started by downloading the image file to check if it contained any metadata, maybe the lat & long of where the photo was taken? I figured the first challenge would have a simple solution, but no such luck unfortunately.

What’s in the photo? We see a nature view of a valley taken from a mountain, not much to go on there. Obviously the next clues are the stickers on the post, let’s see what we can learn from them.

the stickers

• blue circle “tiroler felsenfreunde normal kann jeder”
  Tiroler : Tyrol region
  Text in German, meaning “Tyrolean rock friends normally everyone can” (sorry for my Google translate, I don’t speak ein word of German)
• QR code “scan me”
  online store so no location, except for the .at extension, indicating Austria
• I love hiking
  It’s okay I guess
• muy bien
  Si
• Bellingcat
  lol.
• @dersteinbocklinz
  An indoor climbing gym in Linz (looking better for Austria and Tyrol)
  https://www.dersteinbock-linz.at/
• BERGBUDDYS Zillertal 2019
  Not sure about that one, BergBuddys seems to be an hotel in the Tyrol but probably unrelated). Zillertaler is the name of a valley in the Tyrol
• black circle “RAUM HAARD EST 1988”
  No idea.
• Blaskapelle Junger Schwung Tirol
  A blaskapelle (brass band) from the Tyrol,
  offical website: https://www.bk-jusch.at/über-uns/
• Jesus
  Jesus.

So it’s a mountain in the Austrian Tyrol; I looked around on Google Maps but nothing jumped at me.

I then turned my attention to the wooden post the stickers are on: The cable we see on the right makes me think of a “summit cross”. I found a few similar looking photos online but none of that one.

How do you identify a mountain?

I remembered a Bellingcat blog post about that, and reread it: https://www.bellingcat.com/resources/2023/07/13/more-than-mountaineering-using-peakvisor-for-geolocation/

I couldn’t figure out how to use Peakvisor to identify which mountains were visible in the photo, until I realized that the tool allows you to fine-tune the location of a photograph, but you need to give it either the coordinates or the name of the mountain where the picture was taken. 😐

I tried a bit more using Google Maps 3D and terrain views, in vain. I wondered if those are lakes in the background?

The author

I tried looking up information about the author of the challenge, Foeke Postma, thinking that he may have mentioned this mountain trip on his socials.

Unfortunately, nothing came up from a search on ex-Twitter during the relevant period (https://x.com/search?q=(from%3Afoekepostma)%20until%3A2022-09-01%20since%3A2022-08-01&src=typed_query) and his Instagram is set to private.

Summit crosses

I don’t know if a definitive list of all summit crosses in the Alps exists, all I found was the Wikimedia category “Summit crosses in Tyrol (state)” and a few websites listing places of interest and cool trails in the region.

I tried a few of those peaks as possible solutions, and made a last effort to search for the photo on Google Images, all in vain. Nothing looks more like a mountain than another mountain.

At that point I was feeling pretty frustrated and gave up, hoping to get better results on the other challenges. 😑

The solution

Searching for the photo on Google Images brought me to this reddit post with the answer: Wiedersberger Horn. 👍

Wondering how they figured it out, I translated the thread:

– Out of pure interest, do you know the area, or did you work your way to the result using the stickers and conspicuous points? (aus reinem interesse, kennst du die Gegend, oder hast dich mittels den Aufklebern und auffälligen Punkten zum Ergebnis gearbeitet ?)
 
– I know the area, recognized the Achensee in the background and then looked at the map (Ich kenn die Gegend, hab hinten den Achensee erkannt und dann auf die Karte geschaut)

Well that’s not fair. 😄

⚠ spoiler warning before the next challenge ⚠

2 − Flamin-Go Find It!

The first thing I noticed was that this picture gives almost nothing to go on, no discernable buildings, signs, or people. There’s also some sort of weird filter applied to the whole image, maybe to prevent people from doing an image search? I wondered if the author had shared this image on her Flickr or Instagram account, so I looked at her page on Bellingcat’s website: Kolina Koltai, from Seattle.

The wording of the challenge was the next clue: “When Kolina was out and about she snapped this shot”. I figured it meant that she shot it in her own city, a quick web search brought me to the “Woodland Park Zoo”, which does feature a flamingo exhibit:

The question being “What is the name of the area in which you'd find these flamingos?” I first tried “Flamingo Exhibit” 😅, then “Woodland Park Zoo” which is the correct answer. That was a relief, after my failed attempts the day before.

⚠ spoiler warning before the next challenge ⚠

3 − Pulling Focus

In this challenge we see a blurry shot of a sign written in a Cyrillic script. Once again, I started by looking at the author’s bio: “Aiganysh is a Bellingcat researcher from Kyrgyzstan”. Wikipedia informed me that the languages of Kyrgyzstan are Kyrgyz and Russian.

I sort of brute-forced this one by opening side by side Google Translate and the Wikipedia page “Russian alphabet”, and copying and pasting the characters I could see.

This gave me a bunch of strange results:
кaздн кчигдн – Goosebumps (??)
кдздн кчигдн – from the sun
кAзAн кчигдн – from the eyes

After a few more tries, I discovered that КАЗАН could mean a cauldron: “Kazan (Turkish: kazan) is a traditional Eastern cast metal cauldron with a semicircular bottom for cooking food” (Wikipedia) and tried the solution “restaurant” (nope). At some point Translate gave me Казан кУйгАн АйЬФЫ “Kazan air conditioner” but that wasn’t it either.

I don’t know if such a tool exists, but ideally I needed a way to match the amount of blur visible on the letters I could read, and apply it to the letters I couldn’t in order to try them all until I got the same blurry result, akin to what ex-Twitter user @emnersonn did to unblur this example given by Captain Disillusion:

In any case I’m glad that challenge was in a script I could somewhat decipher, I can’t imagine doing that with a sign from China or Ethiopia.

Suddenly, I realized that the sign wasn’t describing the building but was the name of a town!

Kazan-Kuigan is a village in the Naryn district of the Naryn region of Kyrgyzstan. Kazan-Kuigan is included in the rural area.
–https://ky.wikipedia.org/wiki/Казан-Куйган

I could then look for that town in Google Maps: https://www.google.com/maps/place/Kazan-Kuygan,+Kyrgyzstan/@41.6218981,75.830678,15z, which even has Street View!

I took a Street View scenic drive through the main road but didn’t see the building I was looking for, but I did recognize the roads on Maps which gave me the answer: google.com/maps/place/Biblioteka/@41.6294939,75.8449151,114m

☝ The Biblioteka appears on Google Maps but not on Street View, it was still under construction at the time. The sign from the blurry photo was Казан-Куйган аймагы, “Kazan-Kuigan region”.

Solution: library.

⚠ spoiler warning before the next challenge ⚠

4 − The Rider's View

Like the previous challenges, I started by looking at the files metadata (nothing) and looked at the author’s bio, but that didn’t give me any clues.

The photo immediately screamed “SOUTH AMERICA!” at me, as I lived in Brazil for many years (and yet I found it unfair that someone looked at the photo from the 1st challenge and just knew it 😄).

What can we see in the photo? It’s a city, probably in South America, a Pride flag is flowing 🏳️‍🌈, the avenue features a large bike lane in the middle, and is the guy on the right using a bicycle-sharing system?

We can also see that both cars have the same style of license plates, black letters on yellow background, even though only part of the closest one is readable: 1NL 753.

Searching for “(country in South America) + license plate” I quickly find Columbia, where license plates for private vehicles are indeed on a yellow background, and feature the city of registration on the second line:

Las placas de color amarillo se utiliza para los vehículos de servicio particular, son de color reflectivo, con rebordes negros, tres letras y tres números (GGG345) separados por el logo símbolo del Ministerio de Transportes de Colombia. En la parte inferior viene grabado el nombre del municipio o ciudad donde se matriculó.
– https://www.pruebaderuta.com/tipos-de-placas-en-colombia.php

I can’t read the second line from the photo but it seems short, so it’s probably BOGOTA D.C. for Bogota.

Now where in Bogota are we? Knowing I was looking for a statue I did a quick search for “bogota Estatua”, but that didn’t give me much.

I then wondered if there’s a tool to search by type of road, e.g. “road with 2×2 lanes of car traffic with 2 lanes of bike path in the middle”? Writing this blog post I just remembered that yes, such a tool exists, and it’s made by Bellingcat themselves 😅: Finding Geolocation Leads with Bellingcat's OpenStreetMap Search Tool, May 8, 2023.

Not knowing about this tool I kept searching: Bogota seems to have a lot of avenues with bike lanes, which is good for them but doesn’t help me narrow it down. I started looking for large avenues on the satellite view, but since we are in the country’s capital city there are a lot of those as well.

Coming back to the photo, I gave another look at the shops visible on the right: The signs are pretty blurry, but let’s search for “Movet” in Bogota: Jackpot! “Clínica Veterinaria Movet”, a chain of veterinary clinics with the exact logo visible in the picture.

I then started looking at each of their locations in Bogota, one by one… And found the right in third place on the list 😎 (Google Maps link)

So what is the rider looking at?
In front of them is a statue of the Columbian poet Julio Flórez :

⚠ spoiler warning before the next challenge ⚠

5 − Lost in the Fog

Just like all the previous challenges I started by looking at the file’s metadata, not expecting much and… oh.

Converting those coordinates from DMS (Degree, Minute, Seconds) to decimal I got 51.1703,4.6667 which is near Anvers (Antwerp) in Belgium. Unfortunately, no Belgium airport code worked as the answer which confused me for a bit.

I rechecked the file metadata using imagemagick, which gave me the same coordinates albeit with more precision and with an important additional piece of information:

$ magick identify -verbose foggy_field-CVCShq-A.jpg
(…)
  Properties:
    date:create: 2024-12-05T10:28:11+00:00
    date:modify: 2024-12-05T10:28:12+00:00
    date:timestamp: 2024-12-05T09:59:10+00:00
    exif:GPSAltitude: 131/1
    exif:GPSAltitudeRef: .
    exif:GPSInfo: 90,
    exif:GPSLatitude: 51/1,10/1,327/25
    exif:GPSLatitudeRef: N
    exif:GPSLongitude: 4/1,40/1,3/25
    exif:GPSLongitudeRef: W
    exif:GPSVersionID: ....
(…)

It’s 4 degrees WEST! Hence it should be -4.6… in decimal.
Evidently, Windows omits this rather important detail from the file properties, the more you know 😐

The photo was taken at 51°10'13.1"N, 4°40'00.1"W (Google Maps link), and the closest airport is Lundy Island Airfield, whose ICAO code is EGZV.

Phew!