Share this page!

Enter URL or ID to Unroll

You can paste full URL like: https://x.com/threadreaderapp/status/1644127596119195649
or just the ID like: 1644127596119195649

How to get URL link on X (Twitter) App

  1. On the Twitter thread, click on or icon on the bottom
  2. Click again on or Share Via icon
  3. Click on Copy Link to Tweet
  4. Paste it above and click "Unroll Thread"!
  5. More info at Twitter Help
Aric Toler Profile picture
@AricToler
Mar 7, 2023 • 46 tweets • 15 min read • Read on X
Scrolly
Intelligence Suggests Pro-Ukrainian Group Sabotaged Pipelines, U.S. Officials Say
nytimes.com/2023/03/07/us/…
I have no idea who blew up Nord Stream, but for what it's worth, semi-rogue, brazen operations are nothing new with GUR / special forces / friendly units. See: Bryansk raids, Dugina (apparently), and bellingcat.com/news/uk-and-eu…
Zeit has also published an investigation -- Germans also pointing to Ukraine. A Polish yacht rented by Ukrainianss allegedly used. The path of the vessel should be reconstructable through tracking data.
zeit.de/politik/auslan… Image
Just put in an info request from a naval tracking site for a list of Polish yachts at port in Rostock on September 6th. Will cross-reference with other locations on there. If anyone has premium access to historical data, please check this before I spend a few hundred dollars :)
Or: yachts that were in these places over consecutive days, not just Polish yachts. My request just got two or three times as expensive :(
Quickly learning about AIS requirements, thanks to Sara in our Discord. Apparently yachts below 300 GT (500 domestically) are not required to have AIS and may not have tracking data available. So this tracking process may be useless.
Linked to a video of Rostock port traffic on 6 September, but the site crashed after I did a direct link to it. Feels like the internet is back to 2004! Screen recorded most traffic of the day though, will upload the video later.
Here is a video showing 48 hours of footage of all incoming and outgoing ship traffic from the Rostock port, from sunrise Sept. 5 to sunrise Sept 7, 2022. The boat that the Zeit report claims was used in the Nord Stream operation left Rostock on Sept 6.

However, there are two docks not visible from this webcam, seen below. The red arrow shows the perspective of the camera at the Rostock port (near the cruise center: google.com/maps/place/Ros… ImageImageImage
There is historical webcam footage with partial coverage of one of these marinas, the Yachthafen Hohe Düne (yellow on my map). Here is webcam footage from Sept 5, and three on Sept 6. ImageImageImageImage
Amazing job from the folks over at the Bellingcat Discord (discord.gg/bellingcat) at digging this up, with efforts continuing.
Some more steps to dig into this:

Can you figure out what ships were docked in various harbors in Rostock on Sep. 6, and then see which are owned by Polish companies?

Any webcam/video footage of crossing points in the 3 locations mentioned in the Zeit piece?
AIS tracking was probably turned off if this boat was actually used as described by Zeit. But maybe it was flickd on at some point within a few days at one of these ports?

Satellite data showing a ship at these ports? (Not likely without 30/50cm imagery on specific dates)
Any harbor data from the three ports mentioned in the Zeit article (would have to request this).

Unlikely, but maybe some stray, geofenced AIS data from Vesselfinder/MarineTraffic would show something at one of these three ports. But I wouldn't count on it.
Find more archived webcam (photo or video) data from the three mentioned ports.

Find user-uploaded content from these three ports on Sept. 6-7 (random IG photos, TripAdvisor, drones, etc) -- not terribly likely, but possible.
I have a workshop to run all this week so I don't have as much time as I'd like to dig into this, but those are my free OSINT leads to anyone who is thinking about doing the legwork on this.
Two new bits of data recently: Germans searched the boat suspected of being involved, and a "Ukrainian sponsor" (e.g. oligarch?) is known in Western circles.

The boat didn't get to the Christiansø harbor until 16-18 September.

So, the timeline would have been Rostock Sept 6, Wieck Sept 17, Christiansø Sept 16-18.

berlingske.dk/samfund/nordst…
Wieck Sept 7*, not 17, typo.
Chatted with a local, and was told that the boat would have almost certainly been docked at the northeastern harbor (Yachthafen Hohe Düne). This means the 48-hr video I recorded is probably worthless, as it would have not gone through that vantage point when entering/exiting.
So the next steps:

Check all of the charter yacht companies servicing this dock.

More analysis of webcam footage, though the boat may not have been in a vantage point. One boat does disappear overnight/early morning of Sept 6th.

Screenshot of an email on German TV from a prosecutor. Note the underscoring of "German company that rented out the ship" and that the boat allegedly had explosive devices on it.

(Thanks to "Miles" from our Discord for the screenshot & translation!) Image
I'm not sure where the German police searched the boat, but maybe it was the Rostock harbor?

I didn't see anything interesting in the webcam footage, check here:
bergfex.de/sommer/rostock…

Sadly, the vantage point of this webcam is quite limited for this marina, where the yacht would have most likely been docked. ImageImage
This cuts it down dramatically.

archive.ph/xNX61#selectio… Image
boataround.com/us/search?manu…

Bavaria Cruiser 50 or 51, based on the parameters in the Spiegel article. Narrow that down to Rostock, and you will have a very tiny pool of candidates.
Drone footage of the marina from a couple months before the incident. May be able to find a Bavaria Cruiser 50 or 51 here:
This company does have two of these yachts at dock in the marina we've been looking at, the Yachthafen Hohe Düne. See: boataround.com/us/boat/bavari…
boataround.com/us/boat/bavari…

Here's Oliver finding their listing on the Mola Yacht company's website as well:

Would need to look at images post-September 6 to see which one disappeared.
The mention of Wieck (where the yacht allegedly went on Sept. 7) was especially bizarre in the Zeit story, as it's a very shallow harbor used for emergencies. More on this apparent mistake or mix-up here.

Wiek, not Wieck.

Image
tl;dr for the day's progress:
Decent chance that the rented boat is one of two Bavaria Cruiser 50's operated by Mola Yacht in Rostock. Figured out the name of one of these -- not posting it yet -- but don't know the other. Also trying to determine the MMSIs for the two boats.
The yacht type determination is just from process of elimination of the details provided by Spiegel,. and of charter yacht companies in Rostock, plus online listings available.

Other annoying issue: can't find any webcam or other archival footage of Wiek's harbor from Sept 2022.
See: mola-yachtcharter-ostsee.de/Yacht/Yacht.ph…
Previous Wiek/Wieck mix-up speculation confirmed:
Word is out, so yes -- this is the Andromeda. Here's a view of it from years ago in an unrelated video.

Image
Spiegel named Andromeda here: spiegel.de/panorama/justi…
A magazine article here mentioning the Andromeda -- a Bavarian Cruiser 50, as we suspected -- from Mola Yacht, a charter company on Rostock.
sailpartner.de/wp-content/upl…
It is apparently this same Bavaria Cruiser 50 that we were pointing to yesterday:
ZDF confirmed the Bavaria Cruiser 50 detail as well: amp.zdf.de/nachrichten/po…
Jake found a picture of what is likely the same Andromeda in port in Wiek back in 2020:
Very nice -- better, clearer view of it here.
Another very good find from our Discord (discord.gg/bellingcat) -- 2018 photo of the Andromeda. This one has a great sense of scale of the actual size of the yacht.
ivent-sailing.com/?n=64 Image
Some speculation on the webcam feed I previously posted -- may be Andromeda disappearing from the harbor and then later returning, roughly fitting the dates in the German reporting. Some images have the departure from Rostock between 12-2p on Sept 7, not 6
(All this is being dug up by the Bellingcat Discord, for full credit -- check us out at discord.gg/bellingcat, excuse me for plugging it for like the 12th plug in this thread).
These webcam images are the first archived data I've seen anywhere that may actually show the movement of the Andromeda (which is now confirmed to be the vessel searched by German police) through September 2022. I haven't seen any available high-res satellite or AIS data.

• • •

Missing some Tweet in this thread? You can try to force a refresh
　

Keep Current with Aric Toler

Aric Toler Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @AricToler

Aric Toler Profile picture
Aug 26, 2025
Israel justified its strike on the Nasser Hospital, which killed six journalists and more than a dozen others, by claiming a "Hamas" camera was set up there.
The location they attacked is where Reuters and the AP livestream.
From @IKershner, me, @ckoettl, @sanjanamv, @aboxerman1
nytimes.com/2025/08/26/wor…
See @ytirawi's thread from earlier today:

Reuters streamed there back in July and all last week. The AP has also streamed there from the same staircase location overlooking Khan Younis.
Read 6 tweets
Aric Toler Profile picture
Jun 12, 2025
I can't believe this is still up and public. You can just click right on the profiles and see the full names and profile photos of the people asking these questions. Image
Image
It's just right on the homepage, what on earth is happeningmeta.ai
lmao Image
Image
Read 9 tweets
Aric Toler Profile picture
May 14, 2025
I can't stop reading the Grok reply page. It's going schizo and can't stop talking about white genocide in South Africa.
x.com/grok/with_repl…Image
Image
Image
Image
Post "@grok is this true" on any post and it'll start talking about "kill the boers" and white genocide
(At least it did for me -- I posted four times on a burner account and it talked about this stuff on each one)
Read 9 tweets
Aric Toler Profile picture
Mar 27, 2025
Be a bit wary of these claims of Hegseth having a secret Russian email. I've ran into ghost mail.ru and rambler.ru accounts made with usernames and passwords previously found in data leaks.

"He" also has a Rambler email with the same info. x.com/antii__dote/st…
I've also found a lot of "ghost" duplicate accounts with sequential numbers across mail and rambler services -- like imagine I have atoler1@mail.ru with a pw of istanbul3. or other services will show atoler2 atoler3, atoler4, etc with the same password.Intelx.io
That is all to say: be very wary of reading too much into the information on mail.ru and rambler.ru accounts in these data leak services!
Read 7 tweets
Aric Toler Profile picture
Feb 8, 2025
The Internet Archive has removed its archives of individual tweets from the account belonging to DOGE staffer Marko Elez.

The WSJ reported yesterday that this account belonged to Ekes, and that many of these tweets were racist and led to his resignation. Image
I went through my Internet history that accessed these tweets yesterday afternoon, and they're all now removed/inaccessible.

A few of them:
web.archive.org/web/2024120419…
web.archive.org/web/2024050405…
web.archive.org/web/2024122722…
web.archive.org/web/2024121023…
Lesson: save local backups, use @hunchly if you can afford it, and do matryoshksa style archiving-of-an-archive with or another servicearchive.today
Read 5 tweets
Aric Toler Profile picture
Dec 8, 2024
MSNBC is reporting that the backpack that the Midtown shooter ditched in Central Park was full of Monopoly money Image
(Or, to be conservative, it is a backpack "resembling" that of the shooter. But it wasn't some random cheap Jansport backpack, it was a bit specialized)
By specialized I mean it's a $250-300 photographer backpack. Definitely possible someone had one of these and left it out as a prank (or it was just randomly in Central Park filled with Monopoly money), but it's not a super common item.
Read 5 tweets

Did Thread Reader help you today?

Support us! We are indie developers!

This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Don't want to be a Premium member but still want to support us?

Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal

Or Donate anonymously using crypto!

Ethereum

0xfe58350B80634f60Fa6Dc149a72b4DFbc17D341E copy

Bitcoin

3ATGMxNzCUFzxpMCHL5sWSt4DVtS8UqXpi copy

Thank you for your support!

Follow Us!

Send Email!

:(