Close Menu
  • Home
  • News
  • Security
  • Privacy
  • Cybercrime
    • Threat Groups
    • Ransomware
    • Explainers
    • Stealer Logs
  • AI
  • OSINT
  • Tools
    • Ransomtracker
    • Stealercheck
  • Reviews
    • Best antivirus software for 2026: independent picks from Ransomnews
    • Best ransomware-resistant backup for 2026: cloud, hybrid, and immutable picks reviewed
    • Best ransomware protection for business 2026: ESET PROTECT and 5 alternatives reviewed
  • About Us
Facebook X (Twitter) Instagram Threads
Ransomnews
  • Home
  • News
  • Security
  • Privacy
  • Cybercrime
    • Threat Groups
    • Ransomware
    • Explainers
    • Stealer Logs
  • AI
  • OSINT
  • Tools
    • Ransomtracker
    • Stealercheck
  • Reviews
    • Best antivirus software for 2026: independent picks from Ransomnews
    • Best ransomware-resistant backup for 2026: cloud, hybrid, and immutable picks reviewed
    • Best ransomware protection for business 2026: ESET PROTECT and 5 alternatives reviewed
  • About Us
Facebook X (Twitter) LinkedIn
Ransomnews
OSINT

The Bellingcat geolocation toolkit: 10 sources that always work

Jesse William McGrawBy Jesse William McGrawApril 30, 2026Updated:April 30, 2026No Comments3 Mins Read42 Views
Share Facebook Twitter Pinterest LinkedIn Tumblr Email Copy Link
A flat-lay arrangement of ten OSINT tool icons surrounding a central photograph in a circular pattern
Share
Facebook Twitter LinkedIn Pinterest Email Copy Link

Geolocation work used to be Google Earth and a lot of patience. In 2026, the toolkit has matured into a stable set of ten sources that, between them, crack most of the photo-geolocation problems an OSINT investigator runs into. Here they are, ranked roughly by how often I open them on a working investigation.

1. Google Earth Pro (still)

Free, desktop, and the historical-imagery slider remains uniquely valuable. If you can narrow the scene to a country or region, the historical-imagery view often pinpoints the time of construction of a building visible in your source photo, which itself dates the photo.

2. Mapillary and KartaView

Crowdsourced street-level imagery, free, and increasingly comprehensive outside Google Street View’s coverage areas. For Eastern Europe, parts of Africa, and rural areas of most countries, Mapillary often has imagery Google doesn’t.

3. Sentinel Hub Playground

Free access to Sentinel-2 imagery with a date slider going back years. For confirming whether a particular event was visible from space on a particular day, fires, military movements, construction, there’s no better free tool.

4. SunCalc

Date and approximate time verification by sun angle. Given the location, the date, and the sun direction visible in the photo (shadows, reflections), SunCalc tells you what time of day it must have been. The reverse, given the location and time, what direction is the sun, narrows compass orientation in seconds.

5. Wikimapia

Crowdsourced annotations on top of Google Maps. Buildings, factories, military bases, and obscure landmarks have descriptions and tags. For verification of “is this building what I think it is,” Wikimapia is often the fastest answer.

6. Yandex Maps and Yandex Images

For Russia, Belarus, Ukraine, and former Soviet states, Yandex provides better street-level coverage and reverse-image-search results than any Western tool. The reverse image search is also useful globally for identifying landmarks and faces, with the ethical caveats that apply to all face-search technology.

7. PeakVisor and PeakFinder

Mountain identification by silhouette. If your source photo has identifiable peaks, PeakVisor’s overlay narrows the camera location quickly. PeakFinder works on iOS and Android with the phone’s camera live.

8. OpenStreetMap with Overpass Turbo

OSM’s data layer is queryable through Overpass Turbo. “Show me every petrol station in this region with this brand” returns results in seconds. For matching identifiable infrastructure (specific brand of cell tower, particular road sign style), OSM beats Google because the data is queryable.

9. Planet Labs (paid, but cheap for journalism)

Daily imagery of the entire Earth at 3-5 metre resolution. Subscriptions are expensive at scale but cheap for a single investigation. When Sentinel’s revisit cycle isn’t fast enough, the event happened on Tuesday and you need imagery from Wednesday, Planet has it.

10. Reverse image search across multiple engines

Google Lens, Yandex Images, TinEye, and Bing Visual Search each return different results. Run all four. The right answer is often in only one of them.

The discipline behind the tools

Tools don’t geolocate photos, investigators do. The discipline that makes the tools work is methodical: identify the most distinctive feature, search for that feature, narrow the region, then triangulate with secondary features. Document each step so the chain of reasoning is reproducible. Skip the documentation step and you’ll publish wrong on the day it matters.

Share. Facebook Twitter Pinterest LinkedIn Tumblr Telegram Email Copy Link
Previous ArticleTelegram OSINT: how investigators trace channels and admins in 2026
Next Article Tracking ransomware infrastructure: a 2026 OSINT methodology
Jesse William McGraw

Jesse William McGraw, also known as GhostExodus, is a former insider threat and threat actor. He became the first person in recent U.S. history to be convicted of corrupting industrial control systems. Today he focuses on threat intelligence, OSINT, and public speaking, using his knowledge to bring awareness to the security risks that organisations and individuals face.

Related Posts

Ransomware leak-site OSINT: 2026 investigation walkthrough

May 16, 2026

Audit your digital footprint 2026: Sherlock, Holehe, Whoxy

May 10, 2026

Attack-surface mapping 2026: Shodan, Censys, FOFA, Nuclei

May 10, 2026

Comments are closed.

Facebook X (Twitter) LinkedIn
© 2026 Ransomnews.com

Type above and press Enter to search. Press Esc to cancel.

Cookies on Ransomnews

We use strictly-necessary cookies to run the site and may use first-party analytics to understand which articles are read. Some pages contain affiliate links — when you click one, the affiliate network sets cookies on the merchant's domain to attribute the referral. See the Cookie Policy and Affiliate Disclosure for detail.

RANSOMNEWS.COM

Tracking the criminal infrastructure of the internet.

Independent coverage of ransomware, breach economics, threat actors, privacy, AI security, and the open-source investigation toolkit.

// Topics

  • News
  • Security
  • Privacy
  • Cybercrime
  • AI
  • OSINT
  • Reviews
  • Threat Groups
  • Stealer Logs
  • Ransomtracker
  • Stealercheck

// Site

  • About Us
  • Editorial Team
  • Contact
  • Tip Line
  • Editorial

// Legal

  • Privacy Policy
  • Terms of Service
  • Cookie Policy
  • Affiliate Disclosure
  • RSS Feed
© 2026 Ransomnews.com · Tracking the criminal infrastructure of the internet.