Close Menu
  • Home
  • News
  • Security
  • Privacy
  • Cybercrime
    • Threat Groups
    • Ransomware
    • Explainers
    • Stealer Logs
  • AI
  • OSINT
  • Tools
    • Ransomtracker
    • Stealercheck
    • FortiBleed Checker
    • Site Check
  • Data
    • Ransomware statistics
    • Ransom payment rate
  • Newsletter
  • About Us
Facebook X (Twitter) Instagram Threads
Ransomnews
  • Home
  • News
  • Security
  • Privacy
  • Cybercrime
    • Threat Groups
    • Ransomware
    • Explainers
    • Stealer Logs
  • AI
  • OSINT
  • Tools
    • Ransomtracker
    • Stealercheck
    • FortiBleed Checker
    • Site Check
  • Data
    • Ransomware statistics
    • Ransom payment rate
  • Newsletter
  • About Us
Facebook X (Twitter) LinkedIn
Ransomnews
OSINT

The Bellingcat geolocation toolkit: 10 sources that always work

Jesse William McGrawBy Jesse William McGrawApril 30, 2026Updated:April 30, 2026No Comments3 Mins Read567 Views
Share Facebook Twitter Pinterest LinkedIn Tumblr Email Copy Link
A flat-lay arrangement of ten OSINT tool icons surrounding a central photograph in a circular pattern
Share
Facebook Twitter LinkedIn Pinterest Email Copy Link

Geolocation work used to be Google Earth and a lot of patience. In 2026, the toolkit has matured into a stable set of ten sources that, between them, crack most of the photo-geolocation problems an OSINT investigator runs into. Here they are, ranked roughly by how often I open them on a working investigation.

1. Google Earth Pro (still)

Free, desktop, and the historical-imagery slider remains uniquely valuable. If you can narrow the scene to a country or region, the historical-imagery view often pinpoints the time of construction of a building visible in your source photo, which itself dates the photo.

2. Mapillary and KartaView

Crowdsourced street-level imagery, free, and increasingly comprehensive outside Google Street View’s coverage areas. For Eastern Europe, parts of Africa, and rural areas of most countries, Mapillary often has imagery Google doesn’t.

3. Sentinel Hub Playground

Free access to Sentinel-2 imagery with a date slider going back years. For confirming whether a particular event was visible from space on a particular day, fires, military movements, construction, there’s no better free tool.

4. SunCalc

Date and approximate time verification by sun angle. Given the location, the date, and the sun direction visible in the photo (shadows, reflections), SunCalc tells you what time of day it must have been. The reverse, given the location and time, what direction is the sun, narrows compass orientation in seconds.

5. Wikimapia

Crowdsourced annotations on top of Google Maps. Buildings, factories, military bases, and obscure landmarks have descriptions and tags. For verification of “is this building what I think it is,” Wikimapia is often the fastest answer.

// Free tool

How does your own site score?

Run the same forty passive checks against your own domain — TLS and certificates, security headers, SPF and DMARC, cookies before consent, and what your stack quietly reveals. A grade out of 100 in about fifteen seconds.

No signup. Nothing installed. We only request what your site already serves publicly.

6. Yandex Maps and Yandex Images

For Russia, Belarus, Ukraine, and former Soviet states, Yandex provides better street-level coverage and reverse-image-search results than any Western tool. The reverse image search is also useful globally for identifying landmarks and faces, with the ethical caveats that apply to all face-search technology.

7. PeakVisor and PeakFinder

Mountain identification by silhouette. If your source photo has identifiable peaks, PeakVisor’s overlay narrows the camera location quickly. PeakFinder works on iOS and Android with the phone’s camera live.

8. OpenStreetMap with Overpass Turbo

OSM’s data layer is queryable through Overpass Turbo. “Show me every petrol station in this region with this brand” returns results in seconds. For matching identifiable infrastructure (specific brand of cell tower, particular road sign style), OSM beats Google because the data is queryable.

9. Planet Labs (paid, but cheap for journalism)

Daily imagery of the entire Earth at 3-5 metre resolution. Subscriptions are expensive at scale but cheap for a single investigation. When Sentinel’s revisit cycle isn’t fast enough, the event happened on Tuesday and you need imagery from Wednesday, Planet has it.

10. Reverse image search across multiple engines

Google Lens, Yandex Images, TinEye, and Bing Visual Search each return different results. Run all four. The right answer is often in only one of them.

The discipline behind the tools

Tools don’t geolocate photos, investigators do. The discipline that makes the tools work is methodical: identify the most distinctive feature, search for that feature, narrow the region, then triangulate with secondary features. Document each step so the chain of reasoning is reproducible. Skip the documentation step and you’ll publish wrong on the day it matters.

The Ransomnews Monthly

One email a month. Original leak-site data, victim census updates, and the findings that did not make the articles. No spam, unsubscribe any time.

Double opt-in. We store your email, signup time, and IP for consent records (GDPR Art. 7). See our privacy policy.

Share. Facebook Twitter Pinterest LinkedIn Tumblr Telegram Email Copy Link
Previous ArticleTelegram OSINT: how investigators trace channels and admins in 2026
Next Article Tracking ransomware infrastructure: a 2026 OSINT methodology
Jesse William McGraw

Jesse William McGraw, also known as GhostExodus, is a former insider threat and threat actor. He became the first person in recent U.S. history to be convicted of corrupting industrial control systems. Today he focuses on threat intelligence, OSINT, and public speaking, using his knowledge to bring awareness to the security risks that organisations and individuals face.

Related Posts

Best OSINT tools 2026: what analysts actually run

August 4, 2026

Maltego tutorial: OSINT link analysis in 2026

July 20, 2026

GraphSense tutorial: open-source crypto tracing in 2026

July 20, 2026

Comments are closed.

// The Ransomnews Monthly

What leaked, what held up

One email a month: the datasets we verified, and the ones that fell apart under scrutiny.

Double opt-in. We store your email, signup time, and IP for consent records (GDPR Art. 7). See our privacy policy.

// Free tool

How does your own site score?

Forty passive checks on TLS, security headers, email spoofing and privacy. A grade out of 100 in about fifteen seconds.

No signup. Nothing installed. We only request what your site already serves publicly.

// Free tool

Were you in a leak?

Check whether an email address has surfaced in infostealer logs. No signup, no data stored.

Run StealerCheck

// Live data

Ransomtracker

Victims as they are posted to ransomware leak sites, tracked continuously and checked against the claims.

Open the tracker

9,520 confirmed attacks tracked

Facebook X (Twitter) LinkedIn
© 2026 Ransomnews.com

Type above and press Enter to search. Press Esc to cancel.

Cookies on Ransomnews

We use strictly-necessary cookies to run the site and may use first-party analytics to understand which articles are read. Some pages contain affiliate links — when you click one, the affiliate network sets cookies on the merchant's domain to attribute the referral. See the Cookie Policy and Affiliate Disclosure for detail.

RANSOMNEWS.COM

Tracking the criminal infrastructure of the internet.

Independent coverage of ransomware, breach economics, threat actors, privacy, AI security, and the open-source investigation toolkit.

// Topics

  • News
  • Security
  • Privacy
  • Cybercrime
  • AI
  • OSINT
  • Threat Groups
  • Stealer Logs
  • Ransomtracker
  • Stealercheck
  • FortiBleed Checker
  • Site Check

// Site

  • About Us
  • Editorial Team
  • Contact
  • Tip Line
  • Editorial

// Legal

  • Privacy Policy
  • Terms of Service
  • Cookie Policy
  • Funding & Independence
  • RSS Feed
© 2026 Ransomnews.com · Tracking the criminal infrastructure of the internet.