Bellingcat’s december OSINT challenge, week 2 (WIP)

New week, new set of challenges!

I didn't have time to work on the puzzles during the holidays, so I started when all 15 remaining challenges were already unlocked.

« Pas le temps de niaiser » (no time to waste) as the poet says, I started by downloading every challenge's photo (and a video) and running them all through ImageMagick's magick identify -verbose.

06 — Fully stocked

This first one was easier than I expected. I started by looking at every piece of text I could read, figuring I could see a brand name or reference that's tell me which port I was in or at least which ships those were.

The photo looks a bit old, maybe taken with an analog camera. The vessel is obviously a UASC container ship, the cranes have “-RDKAI” written on them, and that bridge in the far background looks distinctive.

I also took a look at the file's metadata, but that didn't give me anything.

I then searched for that bridge on Google Images, and was surprised to find the whole photo on multiple sites, as if the “Fully Stocked” puzzle used some kind of stock photo —oh I get it 😀

Know we know that this “Shallow Focus Photography of Black Ship” is free to use (nice), and taken in Hamburg. Solution: Hamburg.

⚠ spoiler warning before the next challenge ⚠

07 — Operation Fleet Finder

I started by looking at the file's metadata but alas, there were no latitude/longitude pairs to be found.

A reverse image search didn't give me much except confirming that those were indeed military aircraft carriers. 😀

It did bring me to the Wikipedia page for the USS Abraham Lincoln (CVN-72), where I learned that its callsign “NABE” was represented as 4 flags flown near the top. I tried identifying the flags visible on the puzzle's photo but didn't manage to read them. The middle one seems to be a P (PAPA) but the rest… 🤷

I then figured I could look at the list of US aircraft carriers on Wikipedia to match those flags, and found that they all have numbered hull number in the form CVN-XX.

The middle ship is CVN-69: USS Dwight D. Eisenhower, stationed at Naval Station Norfolk in Virginia. She's still active, I don't know why but I thought the photo was from some sort of maritime museum, like the Intrepid in New-York.

I then searched for the Norfolk Naval Station online and on Google Maps, and started worrying I was being put on some watchlist for seeming to be very interested in the location of US military vessels 😅

In any case, satellite imagery is not clear enough to identify any vessel (at least not with what's available on Google Maps 👀), and I certainly would not be able to see any hull numbers since the satellite only looks straight down 😀 (insert gif ot that scene from Enemy of the State)

What's the other aircraft carrier then? Going back to the Wikipedia list, I find that there are 5 aircraft carriers at Norfolk:

• CVN-69, class Nimitz
• CVN-74 idem
• CVN-75 idem
• CVN-77 idem
• CVN-78 class Gerald R. Ford

I thought the second ship looked like a different “model” (class) from CVN-69 so I tried CVN-78's MMSI number, but that wasn't it.

At second glance the ship looks a bit more rusty that the new USS Gerald R Ford, so it probably is an older model. (I have no idea of how rusty an aircraft carrier is supposed to be, after all those things are in salt water all the the time).

Coming back to the list I search for all their MMSI numbers:

• CVN-74 MMSI 110060487
• CVN-75 MMSI 368800000
• CVN-77 MMSI 369970663
• CVN-78 MMSI ¯\_(ツ)_/¯

I then tried every MMSI starting from the bottom of the list and got lucky, the correct answer is the USS George H.W. Bush (CVN 77).

I'm not completely satisfied with my answer, I wish I could've identified the correct ship without ressorting to guessing, but I still had 3 weeks worth of challenges to finish 🤞 Solution: 369970663

⚠ spoiler warning before the next challenge ⚠

08 — Cyrillic Confusion

This challenge is a bit different than the previous ones: we're not looking for a where a picture was taken but for where some data is from.

As always I started by taking a look at the image file's metadata, but that didn't give me much. Oddly, ImageMagick returned much more data than any other file, including a color histogram 🤔

basic web searches

A simple web search quickly gave me that ship's various identification numbers (YI PENG 3: IMO 9224984, MMSI 414270000) and a few news articles about the cable cutting events: https://www.marinetraffic.com/en/maritime-news/15/maritime-security/2024/11670/baltic-sea-cable-damage-linked-to-yi-peng-3-sabotage-suspect

Sites like MarineTraffic allow you to track ships all around the globe, but if you're looking for past movements or port logs you have to pay: https://www.marinetraffic.com/en/ais/details/ships/shipid:213234/mmsi:414270000/imo:9224984/vessel:YI_PENG_3#portCallLog

(Even though I couldn't see the content of that page, I did try that URL as the challenge's solution 😅)

back to the image

I tried searching for a few word and phrases from the table: “Movements of the vessel”, “call No. 165759" but didn't find anything (Well, anything relevant. Google is happy to provide a lots of useless results by ignoring parts of the query 🙄). I then considered that the logs are probably from a specific port instead of a generic maritime-tracking website, and wondered where that ship was coming from. Again, most historical ship data is behind paywalls, but luckily its last trip was recent enough for MarineOptima to tell me (for free) that it had come from the Russian port Ust-Luga:

Ust-Luga (ru), Sunday 10th November - Friday 15th November

Ust-Luga

I searched for official logs from that port but only found commercial or passenger information: https://lugaport.com/en/

The 1998s website looked promising but all the links were either dead or for sites like marinetraffic.

news

Trying a different angle I looked for news articles about the recent cable cutting incident and found what this challenge's introduction mentioned: a tweet from someone confusing the harbor pilot, a Russian citizen, with the ship's captain:

That tweet even includes the same table! The one time I don't do a reverse image search 😅

Unfortunately they don't say where they got that table from, but they cite another tweet correcting them about the role of that Russian pilot:

That tweet shows a similar looking table in German (they were both using automated translation tools, which explains why I couldn't find any of those titles and words)

More importantly, one of @MackjackMaier's screenshots included the actual URL: skap.pasp.ru!!

And so the logs for the ship ЮИ ПЕНГ 3 (№ 165759) passing through Ust-Luga (UL) are available at: http://skap.pasp.ru/Move/InOutMoveList/165759?harb=UL

Solution: that URL Phew!

09 — Clouded Perception

(I haven't finished that one yet)

10 — Synoptic code

(I haven't finished that one yet)