OSINT Photo Geolocation

Viral images circulate with false location captions — old footage recycled as breaking news, staged scenes misattributed to conflict zones, and manipulated narratives built on viewer assumptions. OSINT teams must determine where and when photos were actually captured.

Investigators work under time pressure with degraded files — screenshots, re-encoded social compressions, anonymous tips. They need fast hypothesis generation without uploading sensitive source material to untrusted servers.

Professional output requires more than a pin on a map. Evidence chains, confidence grades, and reproducible methodology separate credible OSINT from guesswork.

Intake: hash the file, log source and claim. Run client-side EXIF — document whether GPS is present, absent, or inconsistent with the alleged scene.

If EXIF is empty, enable AI analysis for ranked regional hypotheses. Record all top predictions without treating rank #1 as confirmed.

Cross-verify leading candidates on Google Earth, Yandex Maps, and Mapillary. Match permanent infrastructure — not snow cover or seasonal foliage alone.

Publish findings with confidence language, annotated screenshots, and hashes. Link to our OSINT geolocation workflow guide for full phase documentation.

Time-box each phase: intake and EXIF under five minutes, reverse search in parallel while AI runs, verification gets the bulk of clock time. Teams that skip documentation to hit deadline pay for it when findings face editorial or legal challenge.

Scenario: a Twitter account posts a photo captioned 'Artillery strike near City K, March 2026.' Your open-source team receives a JPEG screenshot — no original file, no EXIF. The claim is spreading across three languages within an hour.

Step 1 — Intake (3 min): Save the screenshot, compute SHA-256, log URL and timestamp of first sighting. Note the alleged location and date in your case spreadsheet. Flag that this is a re-encoded copy, not an original.

Step 2 — EXIF pass (1 min): Run client-side EXIF on whereisthis.place. Result: empty — expected for a screenshot. Document 'No metadata; source is social re-share.' Do not treat this as evidence of manipulation; most viral images lack EXIF.

Step 3 — Reverse search (8 min): Yandex reverse image search returns three prior appearances. Oldest indexed copy: a Flickr album from 2019 tagged 'industrial fire, City M.' TinEye confirms the same. You now have a provenance lead, not yet a coordinate.

Step 4 — AI hypotheses (2 min): Upload screenshot for ranked predictions. Top three: City M industrial district 71%, adjacent suburb 12%, similar European city 8%. Predictions align with Flickr tag — use as working hypothesis, not confirmation.

Step 5 — Satellite verification (20 min): Google Earth historical imagery at City M coordinates from Flickr geotag (visible in album, not in your file). Compare warehouse roofline, chimney stack, and adjacent rail siding. March 2019 imagery shows fire damage matching the photo. Current claim of 'March 2026 strike near City K' is debunked.

Step 6 — Publish (10 min): Draft finding with confidence grade 'Confirmed debunk.' Include side-by-side satellite comparison, hash of received file, links to 2019 Flickr source, and explicit note that AI ranked City M before you verified. Total elapsed: ~45 minutes.

Uploading unreleased source material to unknown servers creates operational security risk. Browser-side EXIF parsing keeps the first pass entirely local.

Ranked predictions beat single-coordinate outputs for investigation integrity. You document alternatives you considered and ruled out — critical when legal or editorial scrutiny follows.

Places-not-people focus aligns with ethical OSINT. The tool geolocates scenes, not identities — no facial recognition or person tracking that crosses into doxxing territory.

A Telegram channel posts flood photos labeled as today's event in Region A. Your team receives screenshots — no EXIF.

Reverse search on Yandex finds identical images in a forum thread from 2022 about Region B. Visual clues: license plate format matches Region B, not A.

AI analysis ranks Region B city in top two predictions. Satellite comparison of bridge profile in image matches Region B river crossing confirmed in 2022 news coverage.

Publish: 'Image depicts 2022 flooding in Region B, not current event in Region A.' Confidence: confirmed via multi-source match. Total analysis under 40 minutes.

No single product covers the full geolocation pipeline. Investigators assemble a stack where each tool handles one layer well. whereisthis.place sits at the intake and hypothesis layer — EXIF without upload, then ranked AI when metadata is stripped.

Reverse image search tools find copies and earlier publications; they do not return coordinates. Satellite platforms confirm or reject coordinate hypotheses but require a starting point. Spreadsheets and case managers preserve audit trails that browser tabs alone cannot.

The comparison below helps teams assign roles during onboarding. Train new analysts on when to escalate from free EXIF to credit-consuming AI, and when to leave the browser for Google Earth verification.

Use geolocation on public-interest imagery and verifiable claims — not to track private individuals, stalk ex-partners, or identify someone's home from vacation posts.

Read our acceptable use policy before investigative work. Violations result in account termination.

When publishing, avoid exposing sensitive coordinates (shelters, safe houses) even when technically geolocatable. City or neighborhood level may suffice.