OSINT is about gathering technical and social elements to draw a narrative about a situation and communicate a clear thought. 

Sometimes, misinformation campaigns regain attention as they are shared a few years later, taking advantage of the mass of shared information to reuse old images when they are forgotten. It’s also worth pointing out that a tragic event appeals the emotions, making us less inclined to verify it.

So, I stumbled upon a tweet published in March 2022, which gained substantial exposure at that time:

It displays an explosion near a street, presumably in Yemen. Facing a civil war since 2014, the country has been prone to several bombings inside dense areas.

Here’s the summary of how I’ll investigate:

• Geolocate the place thanks to key elements;

- Find the exact location where the picture was taken;

- Correlate and date this event timeline to clarify the context.

From the original image shared on Twitter, I’ll focus on these elements:

1. License plate

2. Promotional billboard

3. Explosion

4. Window

5. Sidewalk

License plate

The license plate is too low resolution to see any details, but thanks to the color of the writing (black) and the background (yellow), we can compare it with actual Yemeni plates:

Based on the plate format, this vehicle can be a taxi, although no typical upper sign seems to be present.

However, from this source, taxis do not always have a sign on top and have a white/yellow combination (we can see a possible yellow stripe on the side).

Promotional billboard

Fortunately here, some text can be extracted from the billboard and let us gain key information.

It’s a promotion for a local university in Sanaa, the largest city in Yemen:

We can therefore proceed by exploring Sanaa to find the exact location.

Where is it exactly?

After a few researches, I discovered the same rocky corner on Google Earth, matching our first picture:

From there, it’s just a matter of going back to the angle at which the photo was taken:

An interesting junction is located next to the large road (shown in the previous image). A few shops are listed on Google Maps, with an Audi dealer at the corner:

Back in our first picture, we can now better understand this element that represents the brand logo:

Using the previous window and sidewalk elements (plus a picture posted on the dealer Facebook page), we have a final match for the location:

The location is around 15°19'41"N 44°11'17"E, and now on, Sanaa in Yemen is confirmed:

Explosion

I will now focus on the explosion based on Error Level Analysis, and determine if this element has been artificially added (or just tempered to make it larger and more impactful).

A strong demarcation of noise would be visible if the smoke was added in post, so the mass and size are real. The pattern here is uniform, but of course, a more in-depth analysis would be necessary for most cases.

In fact:

• The explosion is real;

• With what we have seen before, the explosion took place behind the rocky corner;

• A potential strike happened here, it’s now time to contextualize the picture.

Timeline and narrative

A few days later (06/03/2022), the same image as been shared with another caption, stating the location is in Palestine. This is a clear example of misinformation, as I was able to demonstrate the exact location:

But by reversing the image, another tweet dated from 2015 showcase the same image, meaning the event has definitely not taken place in 2022:

Actually, French newspaper Le Monde published an article on the same day as the last tweet (20/04/2015) about the strike:

The article links a picture from a Reuters photographer who captured the strike:

And a video of the strike picked up by numerous media outlets provides an effective comparison with our image:

Summary

A missile base located in Sanaa has been targeted on the 20/04/2015, resulting in a huge blast.

Thanks to open sources, and a bit of research, we could determine the main facts to avoid falling into the trap of social networking news.

Stay tuned for more #OSINT ! ✌️