Mathieu Gaucheler
@shibasec.bsky.social
OSINT and cybersecurity. SME at Maltego.
Maltego machines / custom Transform / Talks in my GitHub: github.com/shibaOSINT/MaltegoMachines
Medium: medium.com/@shibaosint
Maltego machines / custom Transform / Talks in my GitHub: github.com/shibaOSINT/MaltegoMachines
Medium: medium.com/@shibaosint
Ever wanted to explore the @icij.org Offshore Leaks Database in Maltego? You can now do so with this local integration.
➡️https://github.com/shibaOSINT/Offshore-Leaks-Database-Maltego-Integration⬅️
➡️https://github.com/shibaOSINT/Offshore-Leaks-Database-Maltego-Integration⬅️
October 24, 2025 at 12:08 PM
Ever wanted to explore the @icij.org Offshore Leaks Database in Maltego? You can now do so with this local integration.
➡️https://github.com/shibaOSINT/Offshore-Leaks-Database-Maltego-Integration⬅️
➡️https://github.com/shibaOSINT/Offshore-Leaks-Database-Maltego-Integration⬅️
Both the school and the temple are in the same region, 40 km apart. Let's begin by exploring the road linking them on Google Street View: road number 2006. After a few minute we find the challenge's location: 13.9159829,101.8389441 (5/5)
October 21, 2025 at 6:17 PM
Both the school and the temple are in the same region, 40 km apart. Let's begin by exploring the road linking them on Google Street View: road number 2006. After a few minute we find the challenge's location: 13.9159829,101.8389441 (5/5)
The third sign will require a bit more work, OCR does not give us anything useful but both phone numbers give us a result for a web search: a school and a cattery. The cattery does not have an address listed on its page and has not posted since 2016, let's discard it. (4/5)
October 21, 2025 at 6:17 PM
The third sign will require a bit more work, OCR does not give us anything useful but both phone numbers give us a result for a web search: a school and a cattery. The cattery does not have an address listed on its page and has not posted since 2016, let's discard it. (4/5)
The first sign gives us"วัดโคกขี้เหล็ก" which after a quick web search leads us to a Buddhist Temple in Thailand (3/5)
October 21, 2025 at 6:17 PM
The first sign gives us"วัดโคกขี้เหล็ก" which after a quick web search leads us to a Buddhist Temple in Thailand (3/5)
First thing that we notice is the numerous signs in Thai script. After passing them through OCR and Google Translate we discover some useful information (2/5)
October 21, 2025 at 6:17 PM
First thing that we notice is the numerous signs in Thai script. After passing them through OCR and Google Translate we discover some useful information (2/5)
A short thread about an interesting geolocation challenge from Hack.lu CTF by @fluxfingers.net 🧵⬇️(1/5) #geolocation #geoguessr #OSINT
October 21, 2025 at 6:17 PM
A short thread about an interesting geolocation challenge from Hack.lu CTF by @fluxfingers.net 🧵⬇️(1/5) #geolocation #geoguessr #OSINT
As a bonus, we can also search for the picture of the rainbow flag they used: searching "гей-флаг" on Yandex yields the exact same flag withing the first page of results.
April 22, 2025 at 6:11 PM
As a bonus, we can also search for the picture of the rainbow flag they used: searching "гей-флаг" on Yandex yields the exact same flag withing the first page of results.
By doing a reverse image search on the content of the Facebook post, we find this picture, showing which flag the people in our original photo are really holding. Several videos of the event have also been posted, not a single rainbow flag in sight.
April 22, 2025 at 6:11 PM
By doing a reverse image search on the content of the Facebook post, we find this picture, showing which flag the people in our original photo are really holding. Several videos of the event have also been posted, not a single rainbow flag in sight.
Searching the picture on Google Lens leads us to a Facebook post mentioning a demonstration in Tinzaouaten (Mali). It doesn't contain the original picture, but there is a similar one with some of the same people. An FLA (Azawad Liberation Front) flag can also be seen: cyan, yellow, red and white.
April 22, 2025 at 6:11 PM
Searching the picture on Google Lens leads us to a Facebook post mentioning a demonstration in Tinzaouaten (Mali). It doesn't contain the original picture, but there is a similar one with some of the same people. An FLA (Azawad Liberation Front) flag can also be seen: cyan, yellow, red and white.
Whenever you suspect that an image might have been altered, Error Level Analysis (ELA) can reveal areas likely to have been modified. For more information on how to use ELA, check out this Bellingcat article from @annique.bsky.social
www.bellingcat.com/resources/20...
www.bellingcat.com/resources/20...
April 22, 2025 at 6:11 PM
Whenever you suspect that an image might have been altered, Error Level Analysis (ELA) can reveal areas likely to have been modified. For more information on how to use ELA, check out this Bellingcat article from @annique.bsky.social
www.bellingcat.com/resources/20...
www.bellingcat.com/resources/20...
🇲🇱🇷🇺 A Wagner affiliated Telegram channel posted this awkward photoshop yesterday, saying the people in the picture support LGBT rights, identifying them as "Azawad shepherds". Let's take this as an occasion to learn how to find the context of a doctored picture and prove the trickery 🧵⬇️ #Wagner #Mali
April 22, 2025 at 6:11 PM
🇲🇱🇷🇺 A Wagner affiliated Telegram channel posted this awkward photoshop yesterday, saying the people in the picture support LGBT rights, identifying them as "Azawad shepherds". Let's take this as an occasion to learn how to find the context of a doctored picture and prove the trickery 🧵⬇️ #Wagner #Mali
The gas station in the background allows us to geolocate the footage easily. It was taken on a roundabout at 12.612658°, -8.044582°. Shown on the 3rd image is the position of the two video as well as the direction of the convoy.
April 1, 2025 at 6:07 PM
The gas station in the background allows us to geolocate the footage easily. It was taken on a roundabout at 12.612658°, -8.044582°. Shown on the 3rd image is the position of the two video as well as the direction of the convoy.
We can confirm that this is the same convoy shown in the first video thanks to the painted marks on the trucks as well as their license plates. Here are a few examples.
April 1, 2025 at 6:07 PM
We can confirm that this is the same convoy shown in the first video thanks to the painted marks on the trucks as well as their license plates. Here are a few examples.
104 trucks carrying a container, 3 tank trucks, 1 truck carrying a boat, 1 QY50KD crane from XCMG, 1 truck carrying a Lonking LG100DT diesel forklift, what appears to be towing and recovery unit Century 5230 from Miller Industries and 1 car bearing red crosses.
April 1, 2025 at 6:07 PM
104 trucks carrying a container, 3 tank trucks, 1 truck carrying a boat, 1 QY50KD crane from XCMG, 1 truck carrying a Lonking LG100DT diesel forklift, what appears to be towing and recovery unit Century 5230 from Miller Industries and 1 car bearing red crosses.
Thanks to the monument in the background, we can roughly geolocate that footage to the following coordinates: 12,637980°, -8,005060° (red area in the picture). Near the French Institute of Mali. I'll publish a detailed walk-through of the geolocation process on my Medium.
April 1, 2025 at 6:07 PM
Thanks to the monument in the background, we can roughly geolocate that footage to the following coordinates: 12,637980°, -8,005060° (red area in the picture). Near the French Institute of Mali. I'll publish a detailed walk-through of the geolocation process on my Medium.
This first insight we can gather is that this is a military convoy, as indicated by the license plates of the vehicles (white letters on a black background) as well as trucks loaded with personnel wearing military fatigue. Source and more examples: francoplaque.fr/af/rmm/5882-....
April 1, 2025 at 6:07 PM
This first insight we can gather is that this is a military convoy, as indicated by the license plates of the vehicles (white letters on a black background) as well as trucks loaded with personnel wearing military fatigue. Source and more examples: francoplaque.fr/af/rmm/5882-....
The 27th of March, the Telegram channel White Uncles in Africa shared the following video of containers moving through Bamako. Let's take a look at what we can gather 🧵⬇️
April 1, 2025 at 6:07 PM
The 27th of March, the Telegram channel White Uncles in Africa shared the following video of containers moving through Bamako. Let's take a look at what we can gather 🧵⬇️
According to their Telegram channel, Africa Corps (Африканский Корпус) is opening new "selection points" (forgive the dodgy Google Translate output) in Kazan, Naberezhnye Chelny, Nizhny Novgorod and Krasnodar.
Interestingly enough, the amount of money promised for signing up depends on the place.
Interestingly enough, the amount of money promised for signing up depends on the place.
February 12, 2025 at 3:12 PM
According to their Telegram channel, Africa Corps (Африканский Корпус) is opening new "selection points" (forgive the dodgy Google Translate output) in Kazan, Naberezhnye Chelny, Nizhny Novgorod and Krasnodar.
Interestingly enough, the amount of money promised for signing up depends on the place.
Interestingly enough, the amount of money promised for signing up depends on the place.
Hello there, that might be due to the browser you are using. I just tested it with Chrome, Brave and Firefox. The two first brother give a similar results but Firefox differs. I'm not exactly sure what causes this 😅
February 9, 2025 at 11:32 AM
Hello there, that might be due to the browser you are using. I just tested it with Chrome, Brave and Firefox. The two first brother give a similar results but Firefox differs. I'm not exactly sure what causes this 😅
That's fair 😅. Hopefully this Flickr picture will make up for it:
flic.kr/p/25gcsC6. Exact query in the alt text to avoid spoilers.
flic.kr/p/25gcsC6. Exact query in the alt text to avoid spoilers.
January 17, 2025 at 4:14 PM
That's fair 😅. Hopefully this Flickr picture will make up for it:
flic.kr/p/25gcsC6. Exact query in the alt text to avoid spoilers.
flic.kr/p/25gcsC6. Exact query in the alt text to avoid spoilers.
As a bonus: apparently it's possible to deadlift giraffe calf to weight it. Photo/Virginia Zoo, Craig Pelke.
January 17, 2025 at 2:57 PM
As a bonus: apparently it's possible to deadlift giraffe calf to weight it. Photo/Virginia Zoo, Craig Pelke.
Our last task is to find a photo in its current habitat. The same Google search that gave us the previous link also leads us to this Youtube short: www.youtube.com/shorts/DZ4A3... posted on 2020-07-14. It points out the heart shaped spot on her neck, which is also present in the exercise's picture.
January 17, 2025 at 2:57 PM
Our last task is to find a photo in its current habitat. The same Google search that gave us the previous link also leads us to this Youtube short: www.youtube.com/shorts/DZ4A3... posted on 2020-07-14. It points out the heart shaped spot on her neck, which is also present in the exercise's picture.
Now to find its current residence and date of arrival. We lack one crucial information: the name of the giraffe. Even though the zoo's blog is no longer accessible, their Facebook posts linking the articles are still up. The following post from 2010-04-08 mentions a baby giraffe: Willow.
January 17, 2025 at 2:57 PM
Now to find its current residence and date of arrival. We lack one crucial information: the name of the giraffe. Even though the zoo's blog is no longer accessible, their Facebook posts linking the articles are still up. The following post from 2010-04-08 mentions a baby giraffe: Willow.
Challenges from @bellingcat.com going well so far! I'll do a writeup later this week (after verifying it's allowed). Thanks to @nitishchandan.bsky.social for the help! Try it for yourself at challenge.bellingcat.com
December 11, 2024 at 7:25 PM
Challenges from @bellingcat.com going well so far! I'll do a writeup later this week (after verifying it's allowed). Thanks to @nitishchandan.bsky.social for the help! Try it for yourself at challenge.bellingcat.com