By Henk van Ess
Bellingcat’s Henk van Ess explains how you can use
Instagram for verification. In 10 handy tips, you will learn more about the art of “chronolocating” a picture and find the exact location of a fugitive convict.
can be bigger than life.
The three pictures below are fake. The women on the
bed is simulating a
Disneyland trip, the view of the skyline of New York
can’t be true and the
third one is not taken with the advertised
faking your life on Instagram is easy, verification can be hard. Below are 10 tips to get a grip on
challenge is hard. A fugitive convict from the Netherlands is
taunting Dutch police and is playing a game of “catch me
if you can” on Instagram. Watch the two-minute video below of “Dutch Most Wanted”
convict, 35-year-old Shahin Gheiybe is on the Dutch “
Most Wanted” list. He
fled to Iran. But he still posts on Instagram about his whereabouts (here is
to his private account, and a
mostly about Iran.
problem with scrutinizing any of the Instagram posts is that the convict can
deceive the police by using bogus location tags in Instagram, backdating the
information or otherwise hiding his real whereabouts.
looked mostly at clues about where the convict is clearly visible and, at the same
time, is near a traceable object (near a car, in a club, holding a branded
knife). Using that method, we tried to reduce the risk of being deceived
1. Browse Instagram on desktop
We didn’t want to fiddle with a mobile or tablet, but work on a desktop computer. To do that, we downloaded Desktop for Instagram, a Chrome plug-in. With this, you can also save Stories — Instagram posts that have a very short life because they are not in the timeline of an user.
2. Download videos
Downloading over hundreds of Instagram videos and photos manually is time-consuming. We used a plug-in for Chrome called Downloader for Instagram. It’s fast, downloads all material in full resolution and supports Instagram story downloads.
3. Find hidden connections
To find the hidden connection between Instagram users, what our target liked and more, we used Helper Tools for Instagram, another plug-in for Chrome.
4. Cross-checking on Facebook
convict posted photos tagged with متل قو
Motelghoo — a motel in
Now look at the link of the
location. A part of that link says "locations/
531195156910169." That number is important to us. We can cross-check the same location in Facebook — a
rather unknown trick which I’m happy to share with you.
this strict formula: "facebook.com/search/number
." In our case: "531195156910169/photos-of."
The full URL is Facebook.com/search/531195156910169/photos-of . With
this, you will get pictures on Facebook of the same object in Instagram so
you can compare them.
Why do you want to do that? Maybe the person claims on
Instagram he took a picture in 2019, but on Facebook you see that the building was torn down in 2019. So the
Instagram post must be older.
5. Match the period
Nerd alert! Our convict posted photos of Motelghoo between January 2017 and now. How do we tell Facebook we only want to see that period?
By default, you can’t. You have to hack the link we just made: Facebook.com/search/531195156910169/photos-of. You will love this trick because it will allow you to search for any place in the world within a certain time range — all via Facebook.
How do we add a time period to the link? Below is the formula how to do that yourself. Everything you see in red is fixed and shouldn’t be altered. Everything in yellow is yours to decide.
531195156910169 can be any
place. If you can’t find a number for a place, use this
tool I made.
second section in yellow is a start date. You can use two date formats: either
jan/1/2017 or 1/jan/2017.
The third part in yellow is the end date. Again, you
can use two date formats: either mar/27/2017 or 27/mar/2017.
consists of an abbreviation of three digits:
jan,feb,mar,apr,may,jun,jul,aug,sep,oct,nov,dec. I used the same system for my Facebook post search tool
we can compare photos from others on Facebook with Instagram posts from our convict.
By doing this, we didn’t find any discrepancies.
6. Reverse image search: Use Yandex, not Google
picture, uploaded on Nov. 27, 2018, shows our target play-fighting a
statue, which perfectly suits our need to have an identifiable object and our
target in the same photo.
We did reverse image search in
Google and Yandex. And, as it is often the case, Yandex was the better choice.
is how we found
Kish Island, some 200
kilometers away from Dubai.
promotional story about this
island tells you what you can do there: “Women sit with cigarette in hand, wearing colorful headscarves pushed right
back to reveal plenty of make-up and expensive hair-dos.” Now you know.
7. When revers image search fails: Use Google, not Yandex
On the same day, Nov. 27, 2018, we found a video in which our target was near a car with a recognizable license plate. We can read "Kish" and "22389."
video shows the person is getting into a red car and is driving away in it. Reverse searching for the license plate didn’t
work at first. Sometimes Google and Yandex don’t recognize a blown-up detail
of a photo.
can, however, approach this problem by just typing in words you can see into
Google Images, without reverse searching the photo itself. This doesn’t work in
leads to images of tourists driving the same red Chevrolet Camaro with the same
license plate. Then, we found the company that rented the car to Shahin
Gheiybe which gave the police an answer to the question: “Who did he contact?”
8. Exclude what you know to find what you don’t know
Did our target reply to other Instagrammers? To find out, we used this formula in Google.
don’t want to see postings from the target’s own account, so we exclude "site:instagram.com/shahin.mzr." But are still interested if he (hence shahin.mzr)
posted comments on the Instagram posts of others (hence site:instagram.com).
Below is what we found.
is asking if he can buy a knife. We traced down the shop, another answer to the
question: “Who did he contact?”
Where is the target now? Our target posted his last video on March 9, 2019, but he may have filmed it months ago.
needed to find something in the video that helped with chronolocation: finding out exactly when it was shot without having any metadata.
the when, we needed more proof of the where: There is no hint of a location and
no geotag in the Instagram post itself. This is going to be hard.
you look to the left, you see a tree with white flowers. I ask experts via
Twitter: what is this? A former BBC reporter and garden specialist correctly
claimed it’s a
tree bears large, showy white flowers. These flowers don’t last long.
magnolia from the video probably blossomed at the end of February or in early
March, very near to the publication date of the video. It was probably shot in
the northern part of Iran, because
comfortable with the climate in the south of the country. We believed it to be
a wealthy neighborhood because of the well-maintained garden and the size of
garbage can in the video is orange and well-known in Iran. It’s produced by Razak
Plast in Tehran.
details from the balcony are typical of some buildings in the Iranian province
of Mazandaran, local people told us via Twitter.
10. Cross-checking on Instagram
We went back to the Instagram videos of Shahin Gheiybe looking for material that could be from Mazandaran.
In one video, published on Oct, 5, 2018, he is driving through the rain.
front of him is a car, to the left of him you can see a sign of some sort of
shop (1). The shop is a real estate firm in Abbasabad, Mazandaran. The
license plate (2) is also local. It starts with the number 82, which is
specific to the area, as Iranian journalist
from France 24 Observers
architectural style we previously honed in on is present in Abbasabad. At this
point, Twitter was going wild. Some Iranians started spontaneously hunting for
magnolias and orange garbage cans in the area, by car.
mystery, however, was solved in London by
, a reporter from ITV who had recently
attended a Bellingcat workshop.
“The Bellingcat course helped a lot. I did various Google image searches
of Abbasabad, Tonekabon, Amirdasht and went on the premise of it being a
rich/well to do area of Iran,” he wrote.
Just 15 kilometers from Abbasabad, in
Amirdasht Town, Nathan spotted the house of the convicted fugitive.
all of our findings, we went to the Dutch police. They were very happy with the
information and used it in their daily briefing, when they decided what to do
to read the full story? Check "
Locating The Netherlands’
Most Wanted Criminal By Scrutinising Instagram
."For more ways to fact-check images, check out van Ess' abbreviated list of tips. Have a tip that didn’t make either list? Send it to us at firstname.lastname@example.org.