iiinova — where your digital self keeps evolving

Reposted by Mathieu Gaucheler

Layer 8 Conference and Podcast @layer8conference.com · 23/03/2026

On today's Layer 8 Podcast, we have @shibasec.bsky.social from Maltego talking about CTFs and investigations, including one where he lifted the curtain on pig butchering scams. He found it to be a "scam as a service" offering with scripts, personas and more. open.spotify.com/episode/3fKd...

open.spotify.com

Episode 139: Mathieu Gaucheler of Maltego

021

Mathieu Gaucheler @shibasec.bsky.social · 18/02/2026

Since our CTF closed yesterday, I thought I would do a quick recap of the problems I encountered (and how to solve them) when writing challenges. medium.com/@shibaosint/...

medium.com

How to write an OSINT CTF

I helped organise and create several CTFs in the last two years both for professionals and amateurs. In this blogpost, I would like to go…

010

Mathieu Gaucheler @shibasec.bsky.social · 10/02/2026

Participants explored challenges with topics ranging from terrorist group, online casinos, WHOIS registries, PMCs operating in Africa to a Russian shadow fleet tanker. I had the pleasure to design the challenges along with the CIRAT team from @mercyhurst.bsky.social.

010

Mathieu Gaucheler @shibasec.bsky.social · 10/02/2026

Maltego community CTF happened last Saturday, it was a wild 4h ride. If you missed it do not worry: we are leaving the platform open until February 17! Go to maltego.ctfd.io and give it a shot. There is something for everyone, regardless of your experience level. No paid tools needed.

110

Mathieu Gaucheler @shibasec.bsky.social · 06/02/2026

Maltego is organizing an OSINT CTF. It will run tomorrow from 15:00 to 19:00 CET. Every level is welcome, no paid tools needed. Feel free to drop in and test the waters or to compete seriously and try to win a prize. Registration here: maltego.ctfd.io. You can also go to our Discord to find a team ⬇️

maltego.ctfd.io

Maltego Community OSINT CTF

111

Mathieu Gaucheler @shibasec.bsky.social · 24/10/2025

Ever wanted to explore the @icij.org Offshore Leaks Database in Maltego? You can now do so with this local integration. ➡️https://github.com/shibaOSINT/Offshore-Leaks-Database-Maltego-Integration⬅️

020

Mathieu Gaucheler @shibasec.bsky.social · 21/10/2025

Both the school and the temple are in the same region, 40 km apart. Let's begin by exploring the road linking them on Google Street View: road number 2006. After a few minute we find the challenge's location: 13.9159829,101.8389441 (5/5)

000

Mathieu Gaucheler @shibasec.bsky.social · 21/10/2025

The third sign will require a bit more work, OCR does not give us anything useful but both phone numbers give us a result for a web search: a school and a cattery. The cattery does not have an address listed on its page and has not posted since 2016, let's discard it. (4/5)

100

Mathieu Gaucheler @shibasec.bsky.social · 21/10/2025

The first sign gives us"วัดโคกขี้เหล็ก" which after a quick web search leads us to a Buddhist Temple in Thailand (3/5)

100

Mathieu Gaucheler @shibasec.bsky.social · 21/10/2025

First thing that we notice is the numerous signs in Thai script. After passing them through OCR and Google Translate we discover some useful information (2/5)

100

Mathieu Gaucheler @shibasec.bsky.social · 21/10/2025

A short thread about an interesting geolocation challenge from Hack.lu CTF by @fluxfingers.net 🧵⬇️(1/5) #geolocation #geoguessr #OSINT

110

Reposted by Mathieu Gaucheler

Conflict Research @conflictwatch.bsky.social · 19/08/2025

#BurkinaFaso Geolocations of the JNIM attack on Tanwalbougou (12.0554, 0.7805) by @chrisadayton.bsky.social & @ influhunter (on X)

073

Reposted by Mathieu Gaucheler

Conflict Research @conflictwatch.bsky.social · 14/06/2025

14.06 #Mali According to a government communique, while returning from a mission yesterday (presumably taking part in the airstrike against FLA fighters near Aguelhok) the Su-24 was forced to ditch in the Niger river near Gao due to "adverse atmospheric conditions"

26616

Reposted by Mathieu Gaucheler

Christiaan Triebert @trbrtc.bsky.social · 08/05/2025

Cool open-source investigative tool I just learned about: alltext.nyc. It lets you search any text found in Google Street View images from 2007 to 2024— graffiti, shop signs, street text, you name it. Just type in what you see, and see what pops up.

47827

Reposted by Mathieu Gaucheler

ryan fae @ryanfae.bsky.social · 30/04/2025

ICYMI: on Twitter, an OSINTer ('Vleckie') is being blamed for a US airstrike in Yemen that killed 8 civilians. in a thread, she'd marked a group of houses as an underground bunker — from satellite imagery alone. those houses (not a bunker) were subject to a US airstrike. 8 innocent people dead.

a post by Vleckie: "Allright, time for me to go through the mud.
Based on satellite imagery I'd marked this quarry as an underground base, and tweeted is out as such.
I'm fairly certain Centcom doesn't take their targeting data from Twitter, but this still is a very severe mistake."

11681152

Mathieu Gaucheler @shibasec.bsky.social · 04/05/2025

"These are the first two fighter jets in history to be downed by an uncrewed surface drone, but they are unlikely to be the last."

020

Mathieu Gaucheler @shibasec.bsky.social · 22/04/2025

As a bonus, we can also search for the picture of the rainbow flag they used: searching "гей-флаг" on Yandex yields the exact same flag withing the first page of results.

000

Mathieu Gaucheler @shibasec.bsky.social · 22/04/2025

By doing a reverse image search on the content of the Facebook post, we find this picture, showing which flag the people in our original photo are really holding. Several videos of the event have also been posted, not a single rainbow flag in sight.

100

Mathieu Gaucheler @shibasec.bsky.social · 22/04/2025

Searching the picture on Google Lens leads us to a Facebook post mentioning a demonstration in Tinzaouaten (Mali). It doesn't contain the original picture, but there is a similar one with some of the same people. An FLA (Azawad Liberation Front) flag can also be seen: cyan, yellow, red and white.

100

Mathieu Gaucheler @shibasec.bsky.social · 22/04/2025

Whenever you suspect that an image might have been altered, Error Level Analysis (ELA) can reveal areas likely to have been modified. For more information on how to use ELA, check out this Bellingcat article from @annique.bsky.social www.bellingcat.com/resources/20...

100

Mathieu Gaucheler @shibasec.bsky.social · 22/04/2025

🇲🇱🇷🇺 A Wagner affiliated Telegram channel posted this awkward photoshop yesterday, saying the people in the picture support LGBT rights, identifying them as "Azawad shepherds". Let's take this as an occasion to learn how to find the context of a doctored picture and prove the trickery 🧵⬇️ #Wagner #Mali

Caption:
🌴🇲🇱 Азавадские пастухи, как и их чубатые братишки, на самом деле стоят за западные ценности, чуждые здоровому человеку. Всë остальное, звучащее с их ротовых полостей, обман.
ЛГБТ, бача-бази, скотоложество, наркотрафик, контрабанда золота и оружия, работорговля, терроризм - неполный перечень их борьбы.

100

Reposted by Mathieu Gaucheler

Global Investigative Journalism Network @gijn.org · 22/04/2025

In this upcoming GIJN webinar, we’ll explore how investigative journalists can document human rights abuses in war zones, with a focus on methods to ensure the info gathered can later be used by legal investigators or international courts. Register now: twp.ai/9PQx3o

twp.ai

gijn.org

GIJN Webinar: Gathering Evidence and Documents in Conflict and War Zones — A MENA Case Study

022

Reposted by Mathieu Gaucheler

Internet Archive @archive.org · 17/04/2025

📢 The Internet Archive needs your help. At a time when information is being rewritten or erased online, a $700 million lawsuit from major record labels threatens to destroy the Wayback Machine. Tell the labels to drop the 78s lawsuit. 👉 Sign our open letter: www.change.org/p/defend-the... 🧵⬇️

Defend the Internet Archive.
Protect the Wayback Machine.
Tell the music labels: Drop the 78s lawsuit.
Sign our open letter on change.org

1181942215536

Reposted by Mathieu Gaucheler

Tib3rius @tib3rius.bsky.social · 15/04/2025

BREAKING. From a reliable source. MITRE support for the CVE program is due to expire tomorrow. The attached letter was sent out to CVE Board Members.

35672409

Mathieu Gaucheler @shibasec.bsky.social · 01/04/2025

For more on that subject you can read this thread by @tatarigami.bsky.social in collaboration with @casusbelli.bsky.social on a similar convoy from earlier this year.

010

Mathieu Gaucheler @shibasec.bsky.social · 01/04/2025

The gas station in the background allows us to geolocate the footage easily. It was taken on a roundabout at 12.612658°, -8.044582°. Shown on the 3rd image is the position of the two video as well as the direction of the convoy.

100

Mathieu Gaucheler @shibasec.bsky.social · 01/04/2025

We can confirm that this is the same convoy shown in the first video thanks to the painted marks on the trucks as well as their license plates. Here are a few examples.

100

Mathieu Gaucheler @shibasec.bsky.social · 01/04/2025

104 trucks carrying a container, 3 tank trucks, 1 truck carrying a boat, 1 QY50KD crane from XCMG, 1 truck carrying a Lonking LG100DT diesel forklift, what appears to be towing and recovery unit Century 5230 from Miller Industries and 1 car bearing red crosses.

100

Mathieu Gaucheler @shibasec.bsky.social · 01/04/2025

Looking for other sightings of that convoy, we find a longer, unedited video published by the Bamako based media Cap Mali: www.youtube.com/watch?v=xeaq.... The 20 minute long video shows: 12 pickup trucks/ cars, 19 pickup trucks with mounted gun, more vehicles listed below ⬇️

youtube.com

26 mars 2025 arrivé des nouveaux équipements militaires, écouter Boubou Mabel pour les commentaires

YouTube video by Cap sur le Mali

100

Mathieu Gaucheler @shibasec.bsky.social · 01/04/2025

Thanks to the monument in the background, we can roughly geolocate that footage to the following coordinates: 12,637980°, -8,005060° (red area in the picture). Near the French Institute of Mali. I'll publish a detailed walk-through of the geolocation process on my Medium.

100

Mathieu Gaucheler @shibasec.bsky.social · 01/04/2025

This first insight we can gather is that this is a military convoy, as indicated by the license plates of the vehicles (white letters on a black background) as well as trucks loaded with personnel wearing military fatigue. Source and more examples: francoplaque.fr/af/rmm/5882-....

100

Mathieu Gaucheler @shibasec.bsky.social · 01/04/2025

The 27th of March, the Telegram channel White Uncles in Africa shared the following video of containers moving through Bamako. Let's take a look at what we can gather 🧵⬇️

131

Reposted by Mathieu Gaucheler

Marine Turchi @marineturchi.bsky.social · 31/03/2025

Affaire des assistants : Marine Le Pen condamnée et inéligible. Une affaire révélée dès 2013-2014 par @mediapart.fr. www.mediapart.fr/journal/fran...

Une de Mediapart ce lundi : Marine Le Pen au tribunal correctionnel de Paris avec son assistante Catherine Griset.

515139

Reposted by Mathieu Gaucheler

Michael Colborne @colborne.bsky.social · 21/03/2025

In Viktor Orbán's Hungary you're perfectly OK organizing neo-Nazi concerts over and over again, even if you're part of a group banned/designated as a terror group in multiple countries But Pride, let alone protesting a Pride crackdown as an opposition party, gets you banned.

0359

Reposted by Mathieu Gaucheler

Bellingcat @bellingcat.com · 03/03/2025

We’re back with the Bellingcat Open Source Research Challenge! Starting today, we’ll release a series of five brand new challenges to test your digital investigative skills every month. www.bellingcat.com/resources/20...

bellingcat.com

The Bellingcat Open Source Challenge is Back - bellingcat

Test your open source research skills with the Bellingcat Challenge – a new resource for all levels of online investigators.

2420118

Reposted by Mathieu Gaucheler

Catalin Cimpanu @campuscodi.risky.biz · 02/03/2025

French security firm LEXFO has published a report that analyzes the underground world of document forgers. Most of this ecosystem appears to have moved from the dark web to the clear web—for some reason blog.lexfo.fr/the-business...

Screenshot of a clear web website selling forged US ID cards and driver's licenses

093

Mathieu Gaucheler @shibasec.bsky.social · 14/02/2025

Too few of these unfortunately.

000

Mathieu Gaucheler @shibasec.bsky.social · 12/02/2025

With amounts ranging from 1,105,000₽ in Nizhny Novgorod to 2,400,000₽ plus a 20,000₽ bonus per underage children in Kazan.

010

Mathieu Gaucheler @shibasec.bsky.social · 12/02/2025

According to their Telegram channel, Africa Corps (Африканский Корпус) is opening new "selection points" (forgive the dodgy Google Translate output) in Kazan, Naberezhnye Chelny, Nizhny Novgorod and Krasnodar. Interestingly enough, the amount of money promised for signing up depends on the place.

Screenshot of a video attached to the post. Translation from Google Translate: Africa Corps Russian Ministry of Defense

Screenshot of a video attached to the post. Translation from Google Translate: Africa Corps continues recruitment. From 25 to 45 years old. Specialists up to 55 years old.

110

Reposted by Mathieu Gaucheler

Christiaan Triebert @trbrtc.bsky.social · 09/02/2025

Incredible referencing guide for Google StreetView, and therefore for geolocation in general: license plates, sign posts, types of bollards, roof tiles, etc. Thanks @aric.bsky.social for sharing. plonkit.net/guide

713141

Mathieu Gaucheler @shibasec.bsky.social · 09/02/2025

Hello there, that might be due to the browser you are using. I just tested it with Chrome, Brave and Firefox. The two first brother give a similar results but Firefox differs. I'm not exactly sure what causes this 😅

110

Reposted by Mathieu Gaucheler

Bellingcat @bellingcat.com · 20/01/2025

Adverts selling an opioid up to 500 times stronger than heroin are all over the internet, from social media platforms to trade sites. Bellingcat and partner Postimees investigate how this deadly drug is infiltrating Europe and beyond… www.bellingcat.com/news/2025/01...

bellingcat.com

Chinese Suppliers Behind Ads Deadly For Nitazenes Targeting Europe

Investigation finds more than 1,000 online ads for nitazenes, including from Chinese companies, and links European shipments of the deadly drugs to China.

16431198

Reposted by Mathieu Gaucheler

Mathieu Gaucheler @shibasec.bsky.social · 17/01/2025

Time for an small OSINT investigation before the weekend. Click on this thread for a walkthrough. Spoilers ahead 🧵⬇️🦒

211

Mathieu Gaucheler @shibasec.bsky.social · 17/01/2025

That's fair 😅. Hopefully this Flickr picture will make up for it: flic.kr/p/25gcsC6. Exact query in the alt text to avoid spoilers.

Three giraffes in the Kilimanjaro Safari park. Willow is in the middle. By FigmentJedi on Flickr.
Found among the results of this query: "giraffe kilimanjaro safaris disney"

010

Mathieu Gaucheler @shibasec.bsky.social · 17/01/2025

As a bonus: apparently it's possible to deadlift giraffe calf to weight it. Photo/Virginia Zoo, Craig Pelke.

A man standing on a scale, casually holding a giraffe calf.

000