OSINT Geolocation Workflow

OSINT geolocation uses publicly available information and images to determine geographic facts — no warrants, no classified databases, no hacking. Practitioners combine EXIF metadata, visual analysis, reverse image search, satellite imagery, and AI hypotheses into documented evidence chains.

The output is not just a coordinate — it is a verifiable claim with confidence level, supporting artifacts, and acknowledged limitations. 'This photo was taken on Khreshchatyk Street, Kyiv' plus Street View comparison screenshots beats 'AI said Ukraine' in every professional context.

Misinformation battles depend on this discipline. Viral photos reused with false location captions are routine. OSINT geolocation is how fact-checkers debunk them — and how bad actors are caught recycling old disaster footage for new narratives.

Before analyzing pixels, record what you know about the file. Source URL, account handle, claim being made, date received, and who forwarded it. Provenance gaps do not stop analysis but must be noted in final reporting.

Compute SHA-256 hash of the original file at intake. If the image changes during investigation (cropping for search), hash derivatives separately. Hashes prove you analyzed a specific artifact.

Request originals aggressively. Reply to sources asking for camera-roll export, not screenshot. Note when only degraded copies are available — this limits confidence ceiling regardless of findings.

Check acceptable use boundaries before starting. OSINT on public interest events differs ethically from tracking private individuals. whereisthis.place prohibits stalking and doxxing — see our acceptable use policy.

Run EXIF extraction client-side first. Document every field — even empty GPS is a finding ('GPS absent, consistent with social repost'). Camera model and capture time sometimes survive when GPS does not.

Parallel reverse image search: Google Lens, Yandex Images, TinEye. Record URLs of matches with capture dates. Earliest indexed version often carries original caption with place names.

Search unique strings if any text is visible. A shop name in Cyrillic plus a product category might surface a business directory listing with address.

Timebox this phase to 15–20 minutes. Diminishing returns set in quickly if all engines return empty. Move to visual analysis rather than repeating identical searches.

Apply the scan order from our visual clues guide: infrastructure, text, architecture, vegetation, shadows. Photograph or annotate the image — circle clues directly in your notes.

Transcribe all text exactly. Note script, language guesses, and partial characters. Even illegible fragments sometimes match via fuzzy search when combined with city hypotheses.

Eliminate regions actively. 'Not North America' because of metric road hardware and EU-style plates is progress. Document eliminations — they defend against confirmation bias later.

Estimate confidence after visual pass: country known, region plausible, city candidate, or insufficient data. This gates how much effort Phase 4 verification requires.

Upload to AI geolocation when visual clues suggest a climate or architecture zone but not an exact address. Treat output as ranked hypotheses, not conclusions.

Record all top predictions with confidence scores if provided. Note model and date — AI geolocation improves over time; document which tool version you used.

Compare AI suggestions against your visual eliminations. If AI says Brazil but you see Cyrillic script, reject and note the contradiction. AI fails on ambiguous global scenes.

whereisthis.place provides up to five ranked predictions after EXIF check. Use it mid-pipeline, not as first step — EXIF and reverse search are cheaper and sometimes definitive.

Pick your leading hypothesis and open Google Earth, Mapillary, or local equivalent. Match permanent features: building footprints, tree lines, road curvature, bridge profiles.

Street View when available gives ground-truth perspective. Align rooflines, sign positions, and shadow directions. Screenshot comparisons side-by-side for publication packages.

Shadow verification: if capture time is known, confirm sun angle at candidate location matches observed shadows. SunCalc at candidate coordinates eliminates mismatches.

Verification fails often — that is normal. Drop hypotheses that do not match satellite and promote the next candidate. Three failed verifications suggest you need more visual clues or better source file.

Professional OSINT products include: executive summary (one sentence finding), confidence level, evidence list, elimination notes, methodology, and artifacts (screenshots, URLs, hashes).

Use standardized confidence language. 'Confirmed' requires satellite or street-level match plus at least one independent clue. 'Probable' means strong visual stack without ground verification. 'Possible' means AI or weak clues only — not publishable as fact.

Bellingcat and similar organizations publish geolocation guides with annotation standards — numbered circles on image matching numbered evidence entries. Adopt this for team clarity.

The OSINT Workflow interactive below walks through six checklist steps with expandable tips — use it as a template for consistent investigations.

Claim: Photo shows today's artillery strike in City A, shared by viral account at 09:00 UTC.

Intake: Screenshot only, hash logged, source account 48 hours old (red flag). EXIF: none. Reverse search: TinEye finds identical pixels on forum thread dated 18 months prior discussing City B.

Visual pass: Cyrillic shop sign, Soviet-era panel building, distinct yellow trolleybus wire configuration. Eliminates City A (no Cyrillic primary signage in claimed area). Matches City B infrastructure on forum thread.

Verification: Google Earth historical imagery at City B coordinates shows building damage consistent with photo. Street View (dated pre-conflict) shows matching facade and trolleybus lines.

Conclusion: Photo depicts City B, 18+ months old — not City A today. Confidence: Confirmed for location; confirmed for staleness via TinEye date. Published debunk with side-by-side Street View and forum URL. Total time: 45 minutes.

Claim: Video still shows protest at government building in Capital X.

Original file obtained via direct message. EXIF: GPS present — coordinates plot to side street 400m from claimed government plaza. GPS is hypothesis, not gospel — verify scene.

Visual: neoclassical column facade visible, unique statue plinth, red-white bollards matching Capital X municipal street furniture. Reverse search finds news wire photo from same angle dated same day.

AI: top prediction matches Capital X (consistent). Satellite: roofline and plaza geometry align. Shadow at EXIF timestamp matches SunCalc at coordinates.

Conclusion: Confirmed near government plaza; EXIF offset explained by photographer position on parallel street with line-of-sight to plaza. Confidence: Confirmed. Report includes EXIF map pin, Street View alignment, and wire photo URL.

Solo OSINT is error-prone. Teams split: one analyst on reverse search, one on visual clues, one on satellite verification. Peer reviewer challenges eliminations and tries to disprove the leading hypothesis.

Use shared spreadsheets: columns for clue, inference, confidence, source URL, analyst initials. Version control investigation notes alongside file hashes.

Set publication thresholds: single analyst 'probable' cannot publish as confirmed; requires second verifier sign-off for organizational accounts.

Debrief failures publicly when safe — missed Cyrillic text, wrong AI trust — to improve collective skill. OSINT communities run weekly challenges precisely for this.

Publishing exact coordinates of sensitive sites — shelters, military positions, private homes — can cause harm. Default to neighborhood or city level unless public interest clearly outweighs risk.

Credit upstream discoverers. OSINT builds on others' findings — link TinEye matches, prior researchers, and community contributions.

Acknowledge uncertainty. Headlines reading 'Photo geolocated to X' when confidence is 'probable' mislead audiences. Use calibrated language in titles and social posts.

Report platform abuse when bad-faith actors systematically mislocate images. Document patterns for researcher networks and platform trust teams.

Core: ExifTool, Google Earth Pro, Yandex Images, TinEye, SunCalc, SHA-256 hasher, screenshot annotation tool, secure note storage.

AI layer: whereisthis.place for EXIF-first ranked predictions; document model version in notes.

Collaboration: shared drives with hash-named files, Slack or Discord OSINT channels for peer review, spreadsheet templates from established fact-checking orgs.

Training: Bellingcat workshops, QuizTime geolocation games, GeoGuessr for pattern training, and our demo gallery interactive for practice on solved examples.

Not every photo is locatable to street level. Recognizing early when evidence is insufficient saves hours and prevents false publication.

If reverse search, visual pass, and AI all produce weak or contradictory signals, classify as 'unlocated' rather than forcing a guess. Document what you tried — negative results are findings.

Request better source material: original file, adjacent frames from video, companion photos from the same poster, or contextual thread comments with location hints.

Crowdsource with care — OSINT communities can help on obscure regional infrastructure but avoid posting sensitive imagery publicly. Redact faces and private details before asking for geographic help.

Temporal fallback: establishing when a photo was taken (even without where) sometimes debunks claims. Old footage recycled as breaking news fails even if exact street remains unknown.

Law enforcement and legal teams use geolocation differently from journalists — chain of custody requirements may exceed OSINT community norms. Consult legal counsel on admissibility standards in your jurisdiction.

Preserve original binary files read-only. Hash at receipt. Log every derivative crop with parent hash reference. Store investigation notes in tamper-evident systems when organizational policy requires.

GDPR and privacy law may restrict publishing geolocation results that identify private individuals' habitual locations even when technically derived from public photos.

whereisthis.place provides technical hypotheses — legal sufficiency for warrants, insurance claims, or court submission requires professional legal review beyond any automated tool output.

Resist fully automated pipelines that publish AI coordinates without human verification. Automation scales volume; humans scale accuracy and accountability.

Script EXIF batch extraction and hash logging — good automation. Auto-posting AI rank-1 to social media — dangerous automation.

Integrate whereisthis.place as hypothesis generation in semi-automated workflows: script invokes API or manual upload, human reviewer confirms on satellite before CRM or CMS update.

Measure team quality by debunk correction rate and peer review catch rate — not images processed per hour. Professional OSINT optimizes for false positive reduction under deadline pressure.

Breaking news compresses phases but does not eliminate them. Under 30-minute deadline: EXIF (2 min), dual reverse search (8 min), visual text scan (10 min), AI hypothesis (2 min), single satellite verify (8 min). Skip only peer review if publishing as 'unverified' with explicit caveat.

Pre-assign roles before crisis hits — one analyst on reverse search, one on visual, one on satellite — rather than improvising per incident.

Maintain a living doc of recurring misinformation templates for your beat — recycled flood photos, stock disaster imagery, game screenshots passed as real — to recognize patterns before full analysis.

Publish corrections prominently when early geolocation proves wrong. Credibility compounds from transparent correction, not from never erring.

AI-generated images may depict plausible but nonexistent places — geolocation confirms inconsistency with real geography rather than finding a real location.

Signs of synthetic scenes: incoherent text on storefronts, impossible shadow geometry, repeating texture tiles in foliage, and architectural elements that fail satellite cross-check.

Deepfake video faces do not change geolocation approach — analyze background infrastructure from unmodified frames. Face swap does not alter pole types or road markings.

Document synthetic determination separately from 'unlocated' — 'likely AI-generated background' is a valid investigative outcome with its own publication standards.

Onboard new analysts with three supervised cases: one EXIF instant win, one reverse-search provenance match, one full visual-satellite verification without AI. Graduation requires solo debunk published with peer sign-off.

Weekly team QuizTime or GeoGuessr sessions maintain pattern libraries without burnout. Rotate who presents solved case walkthroughs.

Maintain internal style guide for confidence language, screenshot annotation colors, and hash naming conventions. Consistency matters when multiple analysts contribute to one organizational account.

Review external Bellingcat and Gijn publications quarterly — methodology evolves with platform changes and new misinformation tactics.

Use a consistent handoff when passing cases between shifts or to legal review: File hash, source URL, claim summary, EXIF result, reverse search URLs, visual clue list, AI predictions with date, verification screenshots, confidence grade, analyst initials.

Template reduces dropped steps during shift changes on breaking news. Store in shared drive with filename matching image hash prefix.

Include negative findings explicitly — 'Yandex empty 2026-07-14' prevents next analyst repeating identical search.

Link to acceptable use review flag when source imagery involves minors, private residences, or active conflict zones requiring editorial/legal sign-off before publication.

Public geolocation communities on Discord, Reddit, and Twitter accelerate learning but require operational discipline. Redact faces, license plates of private vehicles, and home addresses before asking for help.

Credit community contributors in published threads — geolocation is collaborative. Link to prior solver when building on their infrastructure identification.

Avoid crowdsourcing live conflict coordinates that could aid targeting — many communities ban real-time artillery or troop position geolocation. Know group rules before posting.

Use community solved cases as training material internally. Archive annotations and compare new analyst attempts against published expert solutions.

Track false positive rate on published geolocations — how often satellite verification fails after initial hypothesis. Target downward trend as team skill improves.

Log time-to-confidence by case type: EXIF wins should cluster under five minutes; full visual-satellite cases under 90 minutes for newsroom SLA planning.

Post-mortem debunked publications without blame — identify which phase failed (skipped reverse search, trusted AI without verify) and update checklist.