Using #OSINT to investigate unsubstantiated claims on FB.
This image is spreading:
You know where this is going to go. But, let's do it anyway.
1/18
This image is spreading:
You know where this is going to go. But, let's do it anyway.
1/18
Two possibilities:
1. it's legit
2. It's not legit.
Let's "do the research"
I'm sure 'they' already did. But, let's verify.
We could search to see if it's already been verified, but, better to just start from scratch.
Off to Yandex for a reverse image search!
2/18
1. it's legit
2. It's not legit.
Let's "do the research"
I'm sure 'they' already did. But, let's verify.
We could search to see if it's already been verified, but, better to just start from scratch.
Off to Yandex for a reverse image search!
2/18
Open image in a new tab.
Get the URI
Plug that in to https://yandex[.]com/images
3/18
Get the URI
Plug that in to https://yandex[.]com/images
3/18
Hit done.
We get some results.
All looking similar. But, they should. You want the search engine to display similar images.
Let's try that first one. Top-left.
4/18
We get some results.
All looking similar. But, they should. You want the search engine to display similar images.
Let's try that first one. Top-left.
4/18
I think we've already got it.
The original image is within this one.
Let's try to crop this one, to compare against original.
5/18
The original image is within this one.
Let's try to crop this one, to compare against original.
5/18
Post on FB vs Image from Yandex:
I'm calling it. It's the same.
Let's go deeper on that image from Yandex
6/18
I'm calling it. It's the same.
Let's go deeper on that image from Yandex
6/18
Clicking through on that image in Yandex takes us to:
https://www[.]instagram[.]com/p/B9lnxOJoBQl/
That account (appears to be Russian) posted the image on March 11th 2020. So, we can call B.S. on this being a protest in Vienna.
7/18
https://www[.]instagram[.]com/p/B9lnxOJoBQl/
That account (appears to be Russian) posted the image on March 11th 2020. So, we can call B.S. on this being a protest in Vienna.
7/18
There's a date referenced in that IG post (previous image): 10.03.91
More research!
I'll google:
russia 10.03.91
lmgtfy.app/?q=russia+10.0…
8/18
More research!
I'll google:
russia 10.03.91
lmgtfy.app/?q=russia+10.0…
8/18
Again, could it be this easy?
Let's try that first link:
It's for:
https://meduza[.]io/en/feature/2021/03/10/march-10-1991
9/18
Let's try that first link:
It's for:
https://meduza[.]io/en/feature/2021/03/10/march-10-1991
9/18
Article on meduza[.]io/
We scroll down a little...
10/18
We scroll down a little...
10/18
Bing-pot!
11/18
11/18
That page says it was posted: 2:54 pm, March 10, 2021
Can we verify that?
Well, the WayBackMachine took a capture on 10th March 2021. That'll do:
web.archive.org/web/2021031014…
12/18
Can we verify that?
Well, the WayBackMachine took a capture on 10th March 2021. That'll do:
web.archive.org/web/2021031014…
12/18
Q: But, what if that image is being served by the 'live' site and only the HTML was archived?
A: Ah. I can see you're going to take some convincing
Time to put on hacker hoody, press F12 and decode the HTML.
We can see the image came from WBM.
13/18
A: Ah. I can see you're going to take some convincing
Time to put on hacker hoody, press F12 and decode the HTML.
We can see the image came from WBM.
13/18
Yes, all these things could be lying to us.
But, Occams Razor is making it seem that image was from a rally in Moscow, Russia on March 10th, 1991.
Still not buying it?
Ok, okay. A tough cookie. Let's dig more.
See this bit at the bottom of the photo from the article?
14/18
But, Occams Razor is making it seem that image was from a rally in Moscow, Russia on March 10th, 1991.
Still not buying it?
Ok, okay. A tough cookie. Let's dig more.
See this bit at the bottom of the photo from the article?
14/18
Google:
Dominique Mollard / AP / Scanpix / LETA
I can't be bothered to modify the text. Just searching as-is.
lmgtfy.app/?q=Dominique+M…
15/18
Dominique Mollard / AP / Scanpix / LETA
I can't be bothered to modify the text. Just searching as-is.
lmgtfy.app/?q=Dominique+M…
15/18
That first link..
No, it couldn't be this easy.
Could it?
Link is:
http://www[.]apimages[.]com/metadata/Index/Watchf-AP-I-RUS-APHS304320-Russia-Unrest-1991/9bfa615888274dceb512b623b637e716/
16/18
No, it couldn't be this easy.
Could it?
Link is:
http://www[.]apimages[.]com/metadata/Index/Watchf-AP-I-RUS-APHS304320-Russia-Unrest-1991/9bfa615888274dceb512b623b637e716/
16/18
Page is:
17/18
17/18
Summary:
Yes, the image *is* from an anti-government protest
No, it isn't from Vienna.
Yes, it is easy to "do the research"
No, it doesn't look like they did.
tl;dr:
Summary: Post on FB *is* disinformation.
18/18
End.
Yes, the image *is* from an anti-government protest
No, it isn't from Vienna.
Yes, it is easy to "do the research"
No, it doesn't look like they did.
tl;dr:
Summary: Post on FB *is* disinformation.
18/18
End.
Update:
The original posted on FB is challenged, and here is the problem.
OP: "[I] did some research"
Which we can surmise as:
There were protests in Vienna. This is a picture of *a* protest. It fits my needs. Job done.
That's what we call 'confirmation bias'.
The original posted on FB is challenged, and here is the problem.
OP: "[I] did some research"
Which we can surmise as:
There were protests in Vienna. This is a picture of *a* protest. It fits my needs. Job done.
That's what we call 'confirmation bias'.
Alright. I'm back for extra credit.
Q: Can we prove it's Moscow, Russia?
Also Q: Can we get a fix on where the picture was taken from?
Q: Can we prove it's Moscow, Russia?
Also Q: Can we get a fix on where the picture was taken from?
A: Yes.
This is the square where the photo was taken.
goo.gl/maps/4rKVacXbG…
It's Manege Sq, Moscow, Russia.
These are the buildings off to the right in the orig pic.
No. of floors, shapes of windows, taller building, then smaller building, colours of stone, all align.
This is the square where the photo was taken.
goo.gl/maps/4rKVacXbG…
It's Manege Sq, Moscow, Russia.
These are the buildings off to the right in the orig pic.
No. of floors, shapes of windows, taller building, then smaller building, colours of stone, all align.
Off in the distance (orig photo) is a white-ish building, stone pillars, peaked roof. Building extends backwards. We can see horizontal ridges running along the left side of the roof.
That's this building:
hxxps://en.wikipedia.org/wiki/Moscow_Manege
goo.gl/maps/zGn8Zmjtc…
That's this building:
hxxps://en.wikipedia.org/wiki/Moscow_Manege
goo.gl/maps/zGn8Zmjtc…
Time to call it - the disinfo image is 100% Moscow, Russia. Heck, you can see Russian flags in the original/non-disinfo photo.
Next up: Where was the photo taken from?
tl;dr: The Four Seasons Hotel
goo.gl/maps/taDUtG28g…
Next up: Where was the photo taken from?
tl;dr: The Four Seasons Hotel
goo.gl/maps/taDUtG28g…
Except. We need to go back in time.
Wikipedia (I know, I know) says it's been The Four Seasons since 2014, and we're talking about 1991.
Thankfully, Wikipedia says it was previously known as 'Hotel Moskva'. That'll do for name.
It was demolished in 2004, then re-built.
Wikipedia (I know, I know) says it's been The Four Seasons since 2014, and we're talking about 1991.
Thankfully, Wikipedia says it was previously known as 'Hotel Moskva'. That'll do for name.
It was demolished in 2004, then re-built.
This (should be) a link to how Hotel Moskva looked back then (ignore the preview image).
en.wikipedia.org/wiki/Four_Seas…
en.wikipedia.org/wiki/Four_Seas…
And based upon the Four Seasons, my guess is that the photographer, Dominique Mollard, took the photo from around 'x':
With more time/energy, we could map it out, make some calcs. But, that's a good enough estimate for a lunchtime guess.
End?
With more time/energy, we could map it out, make some calcs. But, that's a good enough estimate for a lunchtime guess.
End?
Sub-note:
Whilst re-searching this I found this article from 2012:
theatlantic.com/international/…
It seems that this photo has a history of disinfo.
Whilst re-searching this I found this article from 2012:
theatlantic.com/international/…
It seems that this photo has a history of disinfo.
You can view the original photo via:
hxxps://web.archive.org/web/20201112031956/http://cdn.theatlantic.com/static/infocus/moscow1991/AP9103100617.jpg
And more disinfo usage, which attributes back to Politicano (excellent image manipulation referencing):
mythdetector.ge/en/myth/politi…
hxxps://web.archive.org/web/20201112031956/http://cdn.theatlantic.com/static/infocus/moscow1991/AP9103100617.jpg
And more disinfo usage, which attributes back to Politicano (excellent image manipulation referencing):
mythdetector.ge/en/myth/politi…
• • •
Missing some Tweet in this thread? You can try to
force a refresh
