Share this page!

Enter URL or ID to Unroll

You can paste full URL like: https://x.com/threadreaderapp/status/1644127596119195649
or just the ID like: 1644127596119195649

How to get URL link on X (Twitter) App

  1. On the Twitter thread, click on or icon on the bottom
  2. Click again on or Share Via icon
  3. Click on Copy Link to Tweet
  4. Paste it above and click "Unroll Thread"!
  5. More info at Twitter Help
Nixintel Profile picture
@nixintel
Oct 4, 2021 • 12 tweets • 6 min read • Read on X
Scrolly
Last week a key ransomware threat actor was arrested in Kiev, Ukraine.

I wondered if it was possible to do a little geolocation and find out where he was living the high life.

The source video is the official release from the Ukranian Police:

Using YouTube-dl to download the video and FFMPEG to split into a series of stills makes finding clues a little easier.

(Guide here: nixintel.info/osint-tools/us…)

You can also use Frame-by-Frame to do this in your browser (HT @salaheldinaz)

watchframebyframe.com/watch/yt/I20fa…
Here are the key images with exterior detail:

1) Yellow/Green pipe construction outside.
2) "Autograph" sign on the wall. ImageImage
So we know the building is in Kiev - but where?

A search for businesses called "Autograph" only brings one plausible match in Kiev - a beauty salon on Yevhena Konvaltsia Street.

g.page/autographfashi…

Verifying the location is not so easy though...
The Google Street View coverage is 6 years out of date. Here's where Autograph should appear.

We need to find an alternate image source. Image
Mapillary often has coverage where Street View does not. Here's the location in 2019.

The distinctive yellow pipe and tall background buildings are very similar the ones in the arrest video. ImageImage
Business Facebook pages can also be useful for localised images. This is from the Autograph salon Facebook page.

The sign from the police video is in the green square. The orange arrow is likely the door they entered through. ImageImage
There might be little Street View coverage, but photos uploaded to Google Maps help to fill the gaps with local detail.

Here's the perfect picture that explains the yellow/green pipes in the first frame of the video:

google.com/maps/@50.42719… ImageImage
Notice the green pipes/slide reflected in the window when the police enter the apartment block. Image
So all this means that the arrested ransomware suspect was living in the "Aristocrat" apartment complex in Kiev. Image
Apartments there currently selling for the equivalent of beween $170k and $220k.

(Avg UKR salary is approx $700 US per month)

blagovist.ua/eng/search/apa…

(There might be another one for sale very soon...)
The full story by @campuscodi is here:

• • •

Missing some Tweet in this thread? You can try to force a refresh
　

Keep Current with Nixintel

Nixintel Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @nixintel

Nixintel Profile picture
Nov 24, 2025
A few notes on X's new location feature:

Account locations default to the United States if they cannot be accurately resolved with IP or cell tower geolocation. 1/
X obtains location data from IP geolocation (which is usually accurate to country level) but also from cell tower/wireless network locations.

(One reason why switching to a VPN is often not enough to bypass geoblocking on some apps).

2/
Frequent travel confuses this process a little. I have accessed X in at least four countries in the past month, and this is currently reflected in the location uncertainty in my bio.

Will monitor to see how/when this changes by staying put for a bit.

3/
Read 9 tweets
Nixintel Profile picture
Oct 17, 2023
Despite the darkness and many fakes, I think it's possible to verify the hospital location in the #AlJazeera footage.

If correct, it tends to support the idea that the most likely cause of the explosion was a missile failure.

Here's what I've been able to verify so far: 1/n Image
The full footage can be found here, in a broadcast from @ajmubasher:



2/n
Working back from the end, it is possible to verify that the Al-Ahli hospital is the location seen burning after the blast.

Notice the distinctive sloping roofs with solar panels. Images are from Google Earth.

Image
Image
Image
Read 16 tweets
Nixintel Profile picture
Mar 9, 2023
Thread continued from here 👇
Second impact of OSINT is it's ability to shift public confidence. The OSINT community is quick to expose Russian lies e..g. re: troop movements.

26/n
Third: OSINT has been able to challenge and rebut Russian false flag and propaganda claims. It has limited the effectiveness of Russian info ops.

27/n
Read 10 tweets
Nixintel Profile picture
Mar 9, 2023
"There's No Such Thing As Open Source Intelligence"

Apart from the clickbait title, what are the key takeaways from this article by a serving US Navy Intel officer?

The tone is very different to other recent military takes on #OSINT.

A thread (1/n)

tandfonline.com/doi/abs/10.108…
The author argues that OSINT is distinct from other INT sources (SIGINT, HUMINT, IMINT etc) because it is defined by how accessible it is ("publicly available",) rather than the nature of the source (signals, human, images etc).

2/n
The impact of this confusing taxonomy is that OSINT becomes a "junk drawer" of ill-defined types of information.

Unlike other INTs, the source type is vague and unclear.

3/n
Read 26 tweets
Nixintel Profile picture
May 6, 2022
BULLSHINT is alive and well.

If you have gaps in your intelligence picture, it is ok to say "I don't know" or "I need more data to form a conclusion".

It is never acceptable to fill the gaps with speculation and call it intelligence. 🧵 1/
All forms of intelligence, including #OSINT, involve assessment, evaluation and analysis.

There are a few different models, but they mostly look somthing like this:

2/
You plan, collect raw information, process it, analyse it, and then finally disseminate it for action. Always with the overall mission in mind.

Good analysis and evaluation is what turns raw information into actionable intelligence. 3/
Read 21 tweets
Nixintel Profile picture
Mar 22, 2022
Another very different true story from intelligence history.

It's certainly the most disgusting act of intel gathering I've ever heard of.

Here's how poor opsec and the careless toilet habits of Soviet soldiers became a reliable source of intel for NATO in the Cold War... 1/
After WW2 Germany was divided into Allied and Russian occupation zones.

Mistrust and paranoia between the two sides was rife and each was afraid of the other side launching a surprise attack on the other... 2/
To counter this, each side agreed to allowing a military mission from the opposing side to be stationed on their territory and observe military exercises.

That way it would be impossible for NATO/Soviet forces to prepare for an attack without being observed by the other. 3/
Read 18 tweets

Did Thread Reader help you today?

Support us! We are indie developers!

This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Don't want to be a Premium member but still want to support us?

Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal

Or Donate anonymously using crypto!

Ethereum

0xfe58350B80634f60Fa6Dc149a72b4DFbc17D341E copy

Bitcoin

3ATGMxNzCUFzxpMCHL5sWSt4DVtS8UqXpi copy

Thank you for your support!

Follow Us!

Send Email!

:(