Welcome to edition eleven of OSINT Field Notes.

I’ve taken a bit of time off recently and finished some hobby projects. I set up an ADS-B receiver that captures raw flight data overhead. It’s helpful to understand how flight data we work with is actually collected. Setting it up was pretty straightforward and takes a bit of Raspberry Pi configuration which I’ll cover one day once I add a few other interesting features to the data collection station.

I also modded a $40 Casio into a NASA “Casio Royale”, inspired by one made for Adam Savage. NASA data appears quite a lot in my work, so it was nice to make this mod.

Both of those projects brought me back to one basic habit: understanding how things work and always looking at what sits under the surface.

And that applies in this month’s OSINT Field Notes: thinking about how a flight-tracking system (that we all use) really captures its data, what sits behind the glass of a watch? Who is behind a Facebook page? Who owns an aircraft flying through Sudan? All of these subjects are different, but the mentality is much the same: break them into parts and follow the traces.

So what’s in this edition?

• First we’ve got the Dispatches, which are a collection of investigations, findings and other bits that I found interesting over the past month.

• Then there’s the Toolkit, which I kept on theme with the rest of this edition looking at Meta.

• For the Technical Teardown, we look at my recent investigation, Fake Flags, where I found a network of Facebook pages and groups pretending to be Australian, British, French, Canadian, Mexican and American community outlets, but were ran from Sri Lanka and their content (primarily divisive political stuff) had signs it was being monetised.

• The Case File follows one Facebook page through its old names, group links, shared contact details and monetisation history.

Before we get into it, a personal note: I referenced my Fake Flags investigation throughout this edition because it is personal to me. I saw people in my own network interacting with these pages and groups, unaware that those operating them appeared to be somewhere far from where they claimed to be located. It annoyed me to see that the content those people are lured into was being used to make money through deception.

Nobody commissioned or paid me to do the investigation. I spent five days clicking through records and building a scaled system using automated processes because I wanted the network exposed and the pages stopped.

I’d like you to keep that in mind when you are reading the rest of this newsletter. That investigation took one person, a few days and a lot of clicks. Platforms have dedicated teams, a lot more resources and access to considerably more data.

Okay, now let’s get started.

Ben.

1. Dispatches

Google Earth could ‘imagine’ for less than 48 hours

Google briefly let users create synthetic edits to satellite imagery in its Google Earth platform. Researcher Henk van Ess gave an example, by producing sensitive scenarios such as putting a nuclear plant in Iran. Tal Hagin ran a generated image through Gemini’s AI-detection, which said “No reliable signals” were detected.

I also tried it on an ordinary satellite view of a town in north-east Nigeria, first adding a fire and then military vehicles. Nothing about the exported result made the alterations obvious and if I was to post it online without context, it’s likely many would have believed it. BBC Verify also found that the safeguards could be bypassed.

Thankfully, after some heavy reporting from the community, Google withdrew the feature less than 48 hours after launch. If anyone at Google is reading this, I’m happy to red-team any other future products you might be eager to launch, because this one wasn’t a great look.

ISD authoritarian interference tracker

ISD has published a dashboard and the data behind it, focussing on state-sponsored interference in Europe and North America. All of the incidents are compiled into one searchable tracker allowing users to filter the records, inspect relationships and export the results as CSV or XLSX. I can see this being an incredible launchpad for further analysis, investigations and stories that pull out the cases, along with the patterns.

Shadow Boeing Aircraft Support Sudan RSF Hubs

Reuters used a whole range of digital investigative techniques from satellite imagery, mobile-phone data and open-source footage to trace three Boeing 727s from Chad to RSF hubs in Sudan and Libya, despite their flights not appearing on independent trackers. A draft UN report later found that the aircraft carried RSF fighters, mercenaries, drones and weapons, and suspected they were deliberately avoiding detection. It’s a good reminder to never stop at the limitation of one source of data, in this case a flight tracker.

Finding a Starship in the Indian Ocean

After SpaceX’s Starship 40 splashed down, Ryan Caton used MarineTraffic data to estimate its position alongside the recovery ship GO Australis. Harry Stranger then tasked an Umbra SAR satellite. The resulting 50cm image found the spacecraft still floating 56 hours later, a cool example of using vessel tracking to guide SAR satellite collection.

Reconstructing the Minab School Strike

Sky News published a report and a YouTube video reconstructing the Minab school using archived videos, CCTV and satellite imagery. The images showed its transformation from part of a military compound in 2015 to a school with children visible in the playground in 2025.

The strike on the school killed 120 children. A US military source told Sky that its internal investigation has concluded "human error" was to blame but the report was still under review.

I recommend you take a look at both the report, and the video, there’s a whole range of techniques shown here to build the timeline of events, locations of strike vessels, reconstructing the facility, everything. A reminder that even after the dust settles, denial and accountability are held through the detailed reconstruction of facts, often led through visual elements.

Kushner’s Albania Resort Groundwork Analysis

The New York Times compared satellite imagery from March and mid-June at a proposed luxury-resort site near Zvërnec, Albania. Around 20 acres of protected habitat had been flattened, a five-mile gravel road had appeared and a new bridge crossed a channel between the lagoon and the sea. Jared Kushner and his partners want to build the resort with the backing of Prime Minister Edi Rama. The developer says construction has not begun and an environmental assessment is still underway. Whatever label is placed on the work, the physical change is already visible via satellite imagery.

Ship changed name. IMO did not

South Korea seized the 10,730-ton Prada after an investigation confirmed violations of UN sanctions on North Korea. The same ship had sailed as Sophia when satellite imagery showed it loading coal at Nampho in 2024. Ten governments and the EU later listed it as SOPHIA/PRADA, IMO 1079345. Searching that number brings the two names, the Nampho imagery and the detention back onto the same timeline.

It’s a good reminder that when looking at vessels, colour, name, flags may change, but almost always the IMO will stay the same.

A line on Google Earth = a narco strip

A Reddit user noticed a long cleared line in Google Earth imagery of the Peruvian Amazon. Photographs shared in the discussion appeared to identify it as a clandestine landing strip used by narcotraffickers.

For those wanting to check it out yourself (only virtually please), here’s the coords: 11°17’28.7”S 72°45’28.1”W.

It’s another reminder, of what scratching around on Google Earth (my favorite activity) can lead to.

Shahed-type drones appear over Mali

Bellingcat and Jeune Afrique linked attacks in Mali to Shahed-136-type drones using geolocated footage, satellite imagery of the damage, engine components and expert review. Geolocating the footage only established where it had been filmed, but the further analysis is what built the story. Again, a reminder that looking under the surface and taking a deeper approach can reveal a wider and more impactful picture.

2. Toolkit

Meta Page Transparency and Ad Library: Page Transparency is where I start for old names, creation dates and manager locations. I then check the Ad Library for the creative, dates, target country, advertiser and payer. I keep the manager location and payer in separate fields because they describe different relationships.

Monetization.wtf: This tool checks where an account or page has been included in Meta’s monetisation program, for example, if it has had content revenue. All you need to do is paste in a Facebook or Instagram account to check whether it has appeared in Meta’s partner-publisher disclosures. The archive can be filtered by programme, language, follower count, date and primary admin location, and the results can be exported.

3. Technical Teardown: 3 Facebook checks for a network

When I started researching the pages and groups seen in the Fake Flags investigation, I didn’t just ‘happen’ upon them all in one clever search.

As with all things in the open source investigations world, it took time and a lot of meticulous clicking and searching. But there were some patterns I followed, and specific pages and tools within Meta helped me along the way, to discern what was at first a handful of pages, to a wide network of pages and groups, and sufficient evidence to attribute 46 of them to Sri Lankan management.

So below, in this technical teardown, I am going to walk you through those three tools and techniques that I used to discover this network, seen in the image below.

Page Transparency

First up is page transparency. And it’s a simple click away.

Open the Facebook page (yes it needs to be a page, not account) click the profile name and select Transparency and privacy policy.

Make sure you save the details on the page, such as the creation date, previous names, the dates of those changes and the manager locations shown by Meta. Some of those can be changed or removed.

In the investigation, one of the pages, English Hub, had more than 167,000 followers when I checked it. Its transparency panel showed four name changes and one manager in Sri Lanka. That does not tell me who owns the page, but it does tell me that Meta listed one account as the page manager in Sri Lanka, which is a useful entry in the log.

Take a screenshot while the record is open. Page names, managers and the page itself can all disappear later and we want to preserve that visual evidence, always.

Group panel

Next, groups. This is where the real fun starts as these are effectively communities.

For groups, open the People and About tabs. Record the administrators, moderators and group experts, along with the creation date, member count and recent activity.

In this example, UK News Today had more than 22,000 members. Its administrator list included pages that appeared elsewhere in the network, including pages whose transparency panels displayed managers in Sri Lanka.

Ad Library

Now for the cherry on the top.

Some pages do not display a useful manager location, and sometimes, if it’s an active network running a campaign, they might just be running ads as well. That is when I move to the Meta Ad Library and search for any ads the page might have run, or be running. Again, if you see an ad, save the ad ID, creative, dates, target country, advertiser and payer.

A good example is Australia Briefing. It’s another Facebook page that was pretending to be an Australian community. Although this time, it did not show an administrator location. But it did show a page name history, and had other names.

So I headed to the ads section, and when it was called Scandinavian Hub, it had run an advertisement targeting users in Sweden. The advertiser-and-payer record supplied a name I could check against other public sources, which led back to Sri Lanka.

I treated that name as another pivot rather than publishing it as the owner of every connected page.

There is no trick after that. Open the page, read what Facebook shows, save it and repeat. The pattern only appeared once the entries were sitting beside one another.

4. Case File: the page that became Australian

Life of Australia did not begin as an Australian page. Its earlier names were Thomas shelby, Motivate My Life and MindNug.

Eight months after taking on its current identity, it displayed 42,778 followers.

Page Transparency showed one manager in Australia and another in Sri Lanka. The page also administered Australia Life, a group with more than 26,000 members.

Other administrator pages displayed Sri Lankan manager locations. The same set of pages administered the groups Australia Life and Aussie Life.

The pages Life of Australia and Everyday Australia also shared the public email address australiaeverydaylife@gmail.com.

Monetization.wtf added one more record. Both of those pages seen above had appeared in Meta’s partner-publisher disclosures, placing them in a content-monetisation programme at particular points in time.

Seen separately, each of those records is fairly limited, but they show pages presenting as Australian community outlets, linked through administrators and contact information, displaying managers in Sri Lanka and having had their content monetised in the past.

And we’ve visually evidenced that with just a few clicks.

5. Closing Note

Setting up the ADS-B receiver during my break reminded me that the dot moving across a map is only the finished product. Beneath it is an aircraft broadcasting a signal, an antenna receiving it and a system decoding the raw data.

Taking apart the Casio to mod it into a NASA watch was much the same: you have to look behind the face to understand how it works and rebuild it in your own style.

This is what led me through the Facebook network, and I nearly missed parts of it while looking at each page separately. The patterns appeared once I put the page histories, group admins, ad records and contact details into the same database.

What stays with me is how little special access this required to do this investigation. The only tool was time, motivation and curiosity. I spent a few days following public records and clicking through Facebook because I was motivated to stop what was happening. Especially because people I know were interacting with these pages without realising who appeared to be operating them or why the content was being posted.

I could only see what the rest of the world can see, but platforms can see much more.

That is why I published Fake Flags, and why it runs through this edition. I want the network exposed, investigated and stopped.

Stay tuned to see if that happens.

Ben.

Welcome to edition ten of OSINT Field Notes.

I can’t believe we’re at edition number 10 already and what a community this newsletter has grown with. We’re now at just over 5,300 fellow pixel-gazing subscribers and I cannot thank you all enough for the amazing messages, shares and appreciation for these monthly words.

In a personal update, earlier this mon…

Read more

Welcome to edition nine of OSINT Field Notes.

This month has been about discovery, both through genuinely useful vibe-coded tools and through the old-fashioned curiosity of researchers willing to scroll Street View for hours or pull apart a video’s metadata.

I was fortunate enough to share some of these techniques I write about in person this month, speak…

Read more

Welcome to edition eight of OSINT Field Notes.

It’s been a busy month for movement data.

Conflict Insights Group used phone-location data, Wi-Fi network names, satellite imagery, flight tracking, and open-source reporting to follow Colombian mercenaries from Bogota through Bosaso, Abu Dhabi, and Kufra into El Fasher during the RSF takeover in October. Av…

Read more

Welcome to edition seven of OSINT Field Notes.

The past month has been active. A French sailor’s morning jog around an aircraft carrier deck handed researchers the exact position of the Charles de Gaulle in the eastern Mediterranean. Within weeks, the i Paper had found 519 British service personnel, including nuclear submarine crews, publicly logging run…

Read more

Welcome to edition six of OSINT Field Notes.

The Iran conflict has produced a volume of verifiable material that would have been unthinkable a decade ago: satellite imagery, geolocated videos, munitions analysis, strike timelines. With it came a serious test of whether open-source verification can substitute for the extremely limited on-ground access. On…

Read more

Welcome to the fifth edition of OSINT Field Notes, a special edition for those seeking images from above.

Satellites have dominated this month. Shadow fleets caught from space despite killing their transponders, war and conflict captured from orbit, users’ traffic data resurfacing as geospatial products, and whale migration highways mapped through satell…

Read more

Welcome to the fourth edition of OSINT Field Notes and the first one for 2026.

Over the holidays, between trying to switch off and still doomscrolling the news, I’ve been thinking about how quickly “evidence” turns into “story”. A PDF gets shared and people assume the black boxes mean the sensitive bits are gone. A map appears and suddenly it’s framed a…

Read more

Welcome to the third edition of OSINT Field Notes.

Lately I’ve been buried in gaussian splatting, a technique that turns photos into 3D scenes. Skyfall-GS is the latest example, rebuilding terrain from angled satellite shots. It’s still rough, but you can already see the impact for understanding what has happened in an area, hard-to-reach incidents and e…

Read more

Welcome to the second edition of OSINT Field Notes.

Over the past month, I’ve been down a rabbit hole looking at the world after dark, using night-lights data to trace the scars of war, disasters, and power outages. Satellites see more than we realise, and those nightly patterns are quietly documenting how the world shifts.

Read more

Welcome to the very first edition of OSINT Field Notes.

Over the past month, I’ve often been reminded that the most crucial evidence often hides in plain sight. Whether it’s the unseen geometry of a shadow to solve a geolocation puzzle or the precise weave of a shawl identifying a militia group, the clues are always there if you use the right lens.

This …

Read more