Bellingcat has identified at least 80 police stations or infrastructure related to law enforcement agencies and the Basij paramilitary group that has been damaged or destroyed in the first three weeks of the United States and Israel’s war against Iran. Experts told Bellingcat that both countries aim to degrade the Iranian regime’s “repressive capacity”.

Combined, the US and Israel have conducted thousands of strikes during the course of the 2026 war in Iran. Targets range from Islamic Revolutionary Guard Corps (IRGC) sites, Navy vessels to Iranian weapons manufacturers.

In early March, a Bellingcat analysis using satellite imagery and available photos and videos identified police stations as another apparent target, with at least 15 damaged or destroyed in the capital, Tehran.

We also identified multiple strikes against police infrastructure in the country’s north and west; these areas were targeted by the Israel Defence Forces according to a map released by the IDF on March 31.

“We are providing the brave people of Iran with the conditions to take their destiny into their own hands,” declared the Israeli Ministry of Foreign Affairs official X account, along with a photo of a destroyed police station.

اینجا کلانتری ۱۲۱ سلیمانیه در خیابان نبرد تهران بود.

ما شرایطی را برای مردم شجاع ایران فراهم می‌کنیم تا سرنوشت خود را در دست بگیرند. pic.twitter.com/VSm6YVvIwZ

— اسرائیل به فارسی (@IsraelPersian) March 5, 2026

In all, the majority of strikes Bellingcat analysed focused on police stations (30 incidents) and command centers or headquarters (29 incidents). Locations also include sites related to Basij, a plainclothes paramilitary organisation (9) affiliated with the IRGC that were “involved in the deadly crackdown” of protests in January 2026, others are associated with special forces (3) and traffic (2) or diplomatic (2) police compounds.

Due to commercial satellite companies limiting access to imagery over Iran and neighbouring countries we relied on Sentinel-2 imagery data to help verify the incidents, as well as videos and photos, some of which were also verified by independent geolocators and contributors to the Geoconfirmed volunteer community and confirmed by Bellingcat researchers. 

Location data was partly determined using open source mapping data either from Wikimapia, OpenStreetMap or Google Maps. When video footage or photos were available for incidents reportedly targeting police stations, the location was verified with geolocation and satellite imagery analysis using either Planet Labs medium resolution PlanetScope data (restricted to imagery collected by March 9) or low resolution Sentinel-2 data.

Some locations were discovered utilising location data taken from OpenStreetMap using Overpass Turbo and comparing that with available Sentinel-2 data throughout Iran.

Map showing geolocated incidents in Iran. Click the markers to view the coordinates, sources, and verification notes. Map: Bellingcat/Miguel Ramalho

A Problem of Scale

Israel has released multiple videos showing the targeting of bases and checkpoints belonging to the Basij. In mid-March, the IDF announced the killing of the paramilitary group’s commander, Gholamreza Soleimani. 

Targeting the Basij is part of Israel’s and the US’ agenda “to degrade the regime’s repressive capacity,” Ali Vaez, the director of International Crisis Group Iran Project, told Bellingcat. Police stations are “not involved in repression in the way that crowd control police or Basij centers are”, so targeting them “appears more aimed at preventing the Islamic Republic from being able to maintain control internally,” he said.

Vaez told Bellingcat that, when considered alongside the broader range of targets, including industrial factories, the widespread targeting of police stations is part of a strategy “to make Iran ungovernable for the existing regime or whatever comes after”. 

Vaez was skeptical about the short term effects: “It’s a problem of scale. Iran is such a large country, even if you are able to completely destroy, not just degrade, the capacity of the regime in policing, oppressing, etc – it really requires not just maybe weeks but maybe months if not years.”

The Risk of Civilian Casualties

As of April 7, the Iranian Human Rights Activists News Agency estimates there’ve been more than 1,700 civilian fatalities during the war. 

Several police stations are situated in densely populated urban areas such as Tehran. Stations are used by civilians for various reasons including renewing driving licences, so if these buildings are targeted “during working hours and not in the middle of the night then risk is higher for these people,” Vaez said.

Map showing geolocated incidents in Tehran. Click the markers to view the coordinates, sources, and verification notes. Map: Bellingcat/Miguel Ramalho

A recent joint Airwars, Center for Civilians in Conflict and Human Rights Activists in Iran report detailing the first month of civilian casualties included a section on the worsening situation for detainees in Iranian prisons — including police stations that have been targeted. 

“I was detained in the holding cell of [Police Station 148] for ten days, along with four other activists. Now it looks like nothing is left of that station but ruins. I can’t even recognize where the detention area was. I keep wondering what happened to the people who were being held there during the attack. – Activist, told HRA upon seeing photos of the police station after recent US/Israeli airstrikes.”

Footage shared and geolocated by the BBC’s Shayan Sardarizadeh showed Police Station 148 damaged after an apparent strike in mid-March.

The main building of Tehran’s 148 police station and its courtyard, located on Enghelab Street, has been severely damaged in air strikes conducted on Friday.

The adjacent Hamoon Theatre also sustained some damage.

Video: @Vahid

Location: 35.700812, 51.402163@GeoConfirmed pic.twitter.com/9sdOtHd2XN

— Shayan Sardarizadeh (@Shayan86) March 14, 2026

One destroyed police station identified by Bellingcat in the city of Mahabad in northwestern Iran led to apparent damage to an Iranian Red Crescent Society building located next door. According to Iran’s Tasnim News agency (an IRGC-affiliated media outlet sanctioned by the EU, the US and Canada), one Red Crescent employee was injured in the attack.

The police station adjacent to the Red Crescent building isn’t identified on any mapping services, though there are reports “Police Station 11” was targeted the same day.

Israel has also targeted checkpoints operated by Basij members.

Bellingcat examined two cases showing Israeli strikes on checkpoints while civilians were passing. In one video, a strike hits a checkpoint as five motorbikes and a vehicle go by.

In another IDF video, a yellow bus is immediately adjacent to the checkpoint when it is hit. It is unclear how many people were on the bus at the time of the strike or if anyone was injured.

According to the Open Source Munitions Portal (OSMP), Israeli drones commonly employ the Mikholit bomb. A variant of this bomb has 890 grams of explosives, an amount that creates hazardous fragmentation up to 104 meters away. 

“I have been watching the reporting on these Basij strikes and the use of the Mikholit in particular in open urban areas. It is IDF standard—using precision munitions and even sometimes “low collateral” munitions but in a reckless manner that still puts the civilian population at risk,” Wes J. Bryant, a defence and national security analyst formerly with the Pentagon’s Civilian Protection Center of Excellence told Bellingcat.

Questions Over Legality

International Humanitarian Law defines civilians as “persons who are not members of the armed forces”. Police officers fall under that definition, according to Adil Haque, Professor of Law at Rutgers University and Executive Editor at Just Security.  “As a rule, police are civilians and may not be attacked unless they take a direct part in hostilities,” Haque told Bellingcat. National security analyst Bryant agreed, adding that targeting police “does not stand up to legal scrutiny”.

In an email to Bellingcat, the IDF noted “that the police form part of Iran’s internal security apparatus, which also forms part of Iran’s armed forces, under Iran’s own domestic legislation. In every strike, the IDF takes feasible precautions in order to mitigate incidental harm to civilians and civilian objects to the extent possible under the circumstances.”

Police are indeed “part of the country’s armed forces. By that logic, anything with a flag on it is a legitimate target,” Ali Vaez, the director of International Crisis Group Iran Project, said.

Although Basij is a paramilitary group, any strikes against it would require precautions to minimise harm to civilians, Haque told Bellingcat. “Since the hostilities almost entirely involve aerial bombardment, the concrete and direct military advantage anticipated from strikes on Basij members who qualify as combatants is extremely low, so significant harm to nearby civilians would be disproportionate and illegal,” he said.

When asked about potential civilian casualties in the checkpoint strikes, the IDF told Bellingcat that since the Basij are subordinate to the IRGC and are therefore part of the armed forces, they are regarded as lawful military targets. Regarding the checkpoint strikes specifically, they stated “precision munitions and surveillance means were used in the strikes, as part of the precautions taken under the circumstances to mitigate expected incidental harm”.

Bellingcat reached out to US Central Command (CENTCOM) to ask if the US had any role in the police station strikes identified but received no official comment at the time of publication. 

The data collected so far for these sites can be found here.

---

Miguel Ramalho and Felix Matteo Lommerse contributed to this report.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Bluesky here, Instagram here, Reddit here and YouTube here.

The post “Make Iran Ungovernable” – Tracking Efforts To Destroy Iran’s Police Infrastructure appeared first on bellingcat.

Bellingcat has geolocated and verified two new videos showing the deadly strikes that hit an Iranian Revolutionary Guard Corps (IRGC) compound as well as an adjacent school in the city of Minab in late February.

The new videos were released by Iran’s Ministry of Foreign Affairs and show multiple missiles hitting the complex. 

One of the new videos shows the area around the school being struck while the other shows a nearby IRGC clinic and two buildings within the IRGC facility being hit by Tomahawk missiles. 

Visual and solar analysis of the videos appears to show there was a time gap between when each was filmed, suggesting that there were at least two waves of strikes carried out in the area. 

Applying the same solar analysis techniques to social media footage that showed the school after it had been hit indicates the school was impacted during the first wave of strikes.

Previous investigations by Bellingcat and other news organisations showed a US Tomahawk missile struck the IRGC facility on Feb. 28. 

The US is the only party to the conflict to possess Tomahawk missiles.

Media reports, including from the New York Times and Reuters, have since detailed that a preliminary investigation by the US military concluded it was likely a US strike that hit the Shajarah Tayyebeh elementary school.

According to Iranian media, at least 175 people were killed in the attack, including children.

Analysing New Minab Videos

The first video (video one) is filmed from just over 2.5 kilometres (1.5 miles) away from the IRGC base and shows at least 10 missiles impacting the area over a period of 50 seconds.

The first explosion is visible five seconds into the video. The area around where the school was located is struck at 14 seconds. This is the fourth explosion visible in the footage.

Another structure that was damaged in the strikes is situated approximately 100 metres away from the school in the same general area. It was therefore not possible to determine which exact structure was hit from this footage alone.

The second new video (video two) was filmed approximately two kilometres southeast of the school, and is of a higher quality than video one. This video shows three Tomahawk missiles in the moments before impact.

Video two includes annotations and pauses when each Tomahawk appears on screen. 

A frame-by-frame analysis also shows what appear to be two minor visual glitches where some frames are transposed and annotations were added, highlighting when missiles can be seen.

The second impact seen in video two is the same as seen in footage released by Iranian media in early March, and previously reported on by Bellingcat and others, only from a different perspective.

Video two also only shows the southern part of the base, with its northern section not visible. The school is located on the northern edge of the base and is therefore not visible in video two.

Bellingcat asked the Iranian Ministry of Foreign Affairs why only part of the strike, as seen in video one, was released and if there was a longer version that may show further impacts. We did not receive a response before publication.

Bellingcat also asked the US Department of Defense whether it had any further information on the strike since its reported preliminary findings. It referred us to CENTCOM, which said: “We have nothing for you on this. The investigation is still ongoing.”

Geolocating the Videos

Bellingcat was able to geolocate and verify video one by tracing sightlines on satellite imagery to determine the camera’s location and identify objects such as buildings, trees and a water tower within the IRGC facility. 

According to this analysis, video one was most likely filmed from an electric substation southeast of the school.

Once all key elements were identified and geolocated, we analysed each explosion that can be seen in the footage. 

Fourteen seconds into video one, the fourth impact appears to hit the area immediately around the school, which was approximately 200 meters behind a water tower. 

While the school was walled off and outside the IRGC facility, the water tower and another building (situated between the school and the water tower) are located within it.

Due to the relatively small distance between the school and the other IRGC building (roughly 100m), it was not possible to determine what structure was hit at the moment of the strike visible in video one.

More information, such as obtaining the entire strike video sequence, would be needed to fully determine which structure was hit in this footage. However, social media footage captured at the scene does suggest that the school was hit around this time.

For video two, we stitched together a rough panorama of what could be seen in the footage. 

This made it possible to match up multiple buildings visible southeast of the IRGC base and school, while also building rough sightlines to show which part of the base was being filmed.

Bellingcat was able to narrow down the areas hit by the three missiles seen in video two by comparing it with the point of view of a short video released in early March, showing a Tomahawk hitting the complex, as well as with what could be seen in video one. Post-strike satellite imagery also helped confirm the buildings that were hit in the footage. 

We were thus able to determine that video two shows an IRGC clinic and two buildings within the IRGC compound being hit.

Time of the Strikes

The Iranian Ministry of Foreign Affairs has claimed that two waves of strikes occurred. 

Initial analysis did suggest that video one and two appeared to be filmed at different times as the strikes visible in each clip cannot be synced up. 

Solar data also gives clues as to the time each was taken, suggesting that there was a time gap of at least an hour between the strikes seen in the two videos.

According to the New York Times, the strikes were first reported on social media just after 11:30 am.

Solar data, derived by the direction of shadows visible in video one and simulated via the SunCalc platform, appears to indicate it was filmed between 10:30 and 11:30am.

Analysing the shadows seen in the earlier March video using the same method, appears to show that it was filmed between 13:30 and 14:30. 

This would seem to indicate that video two and the earlier March video were likely filmed after video one.

Solar data from a video posted to Telegram showing the smouldering school, and damage to the nearby IRGC building about 100m away, shows that it was recorded around the time of the first video.

This, therefore, appears to confirm that the school was impacted before the wave of attacks seen in video two.

Iranian media previously released images of munition remnants they claim they recovered from the school. 

Bellingcat was not able to verify where the remnants were originally found, but was able to identify them as Tomahawk missile remnants. The New York Times also confirmed this identification by matching the contract number on a remnant to a contract for the Tomahawk missile.

---

Bellingcat’s Carlos Gonzales, Jake Godin and Trevor Ball contributed research to this article.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Bluesky here, Instagram here, Reddit here and YouTube here.

The post Two Waves of Bombing: New Videos Reveal Further Details About Iran School Strike appeared first on bellingcat.

To stay up to date on our latest investigations, join Bellingcat’s WhatsApp channel here.

Bellingcat has geolocated footage of multiple Tomahawk cruise missiles travelling through Iraqi airspace towards Iran, either in violation of its airspace or with Iraq’s consent.

Bellingcat identified at least 20 individual cruise missiles and geolocated them over Iraqi Kurdistan including alongside Mount Piramagrun, in the Zagros Mountain range, and approximately 50 km southeast of the city of Kirkuk.

Modern Tomahawks can travel up to 1600 km, and are used for precision strikes. At the start of the war, the US had a carrier strike group in the Mediterranean and the Arabian Sea, as well as some independently deployed destroyers.

The US is the only participant in the war known to possess Tomahawks, which can be launched by ships or submarines. US President Donald Trump said at a press conference on Monday that Iran “also has some Tomahawks”. Official ​​government reports on Iran’s military balance don’t support this claim.

Considering the distance of US vessels to the geolocated missiles, the missiles seen in the videos were most likely fired from the Mediterranean Sea, Sam Lair, a research associate at the James Martin Center for Nonproliferation Studies, told Bellingcat.

Red Sea launches would be pushing the maximum range, and US Navy ships were not known to have been in the Persian Gulf at the start of the war, Lair said.

Brian Finucane, a senior adviser with the US Program at the International Crisis Group, told Bellingcat that without the consent of Iraq and Syria, the intrusion of Tomahawk missiles into their airspace “would violate its sovereignty and international law”. 

We asked the US State Department and Department of Defense as well as the foreign ministries of Iraq and Syria, if ​​the US had an agreement with Iraq or Syria to utilise their airspace for cruise missiles targeting a third country. The Department of Defense told Bellingcat they “had nothing to provide” while neither the Iraqi nor Syrian ministry had responded at the time of publication.

On Tuesday, Iraqi Prime Minister Mohammed Shia al-Sudani spoke with US Secretary of State Marco Rubio and stressed that Iraqi airspace and territory should not be used for any military action targeting neighbouring countries, the prime minister’s media office said.

Bellingcat geolocated at least eight videos showing Tomahawk missiles over Iraq. The videos show at least 20 individual Tomahawk missiles, based on the longest uninterrupted video we reviewed.

The below graphic shows all Tomahawk missiles Bellingcat has geolocated, which includes additional missiles identified outside of Iraq.

Click the arrows in the map below to view the verified missile sightings, including the original footage and geolocation analysis.

Interactive map showing the approximate locations of US carrier groups in the region at the start of the war, with a 1600 km range, in relation to Tomahawks geolocated by Bellingcat. We included a possible Red Sea launch point for visualisation, reference and comparison purposes only. The white arrows indicate the location of Tomahawk sightings. Their respective directions of travel are shown by default. All coordinates and directions shown are approximate. Source: Logan Williams/Bellingcat.

These missiles don’t always make it to their intended target. In addition to footage of the airborne missiles, Bellingcat also identified remnants of a Tomahawk missile that had crashed outside Kafr Zita in northwest Syria.

Missiles Fired From the Sea

On the first day of the war, Feb 28, the US Central Command (CENTCOM) published footage of Tomahawk missiles being fired from the sea. Later on March 1, CENTCOM released additional video of the USS Thomas Hudner (DDG-116) firing a Tomahawk missile, while operating in the Eastern Mediterranean Sea. 

According to a Center for Strategic and International Studies (CSIS) analysis, more than 160 Tomahawk missiles may have been used in the first 100 hours of the war, and “they would have been used to destroy Iranian air defenses and other counter-air capabilities and create permissive conditions for follow-on attacks”.

Arleigh Burke-class guided-missile destroyer USS Thomas Hudner (DDG 116) fires Tomahawk land attack missiles in support of Operation Epic Fury, Mar. 1, 2026. (U.S. Navy video)

Tomahawk Flights Through Iraqi Airspace

The footage analysed by Bellingcat showing cruise missiles travelling over land is consistent with the typical flight profile of Tomahawks, which cruise at low altitude along pre-programmed routes toward distant targets. 

According to the US Navy, “Tomahawk cruise missiles are designed to fly at extremely low altitudes at high subsonic speeds, and are piloted over an evasive route by several mission tailored guidance systems.”

This explains why they are sometimes filmed by civilians during transit. Similar sightings have previously been recorded during US conflicts in the Middle East. 

Bellingcat analysed terrain features and solar data in the footage and confirmed the location and approximate direction of travel of the Tomahawk missiles. We found that they followed the terrain closely, and appeared to follow two different valleys near the Iraq-Iran border.

The Zagros mountain range stretches across much of Iran as well as northern Iraq. The mountains of this valley would provide details for the Tomahawks’ terrain matching guidance, and hide them from Iranian radar detection.

Click the arrows in the map below to view the verified missile sightings, including the original footage and geolocation analysis.

Interactive map showing the locations of Tomahawk sightings. The missiles were travelling through Iraqi airspace towards Iran in valleys near the Iraq-Iran border, and near Kirkuk. The respective directions of travel are shown (white arrows). All coordinates and directions shown are approximate. Source: Logan Williams/Bellingcat.

Other Geolocated Footage 

In a video filmed in Tehran and posted on the first day of the war, six Tomahawk missiles can be seen flying over the Qurkhane Bus Terminal in Tehran, as an anti-aircraft gun on a nearby building fires at them. Other gunfire can be heard in the distance.

Bellingcat previously geolocated a Tomahawk strike in Manib, Iran, near a school where 175 people, including children, were reported to have been killed.

A final video analysed by Bellingcat, posted on March 3, shows 13 Tomahawk missiles flying past a commercial ship in the direction of Iran, the M/V MAERSK BOSTON, while it was off the coast of Oman, according to solar, visual and Marine Traffic data.

New Tomahawk Variants

Since the beginning of the war, two new variants of Tomahawk missiles have been observed.

One Tomahawk variant seen publicly for the first time, distinguished by its visible black body, believed to be a stealth coating. Other missiles appear to have wings angled forwards, a modification designed to make them harder to detect by radar, according to an analysis by The War Zone.

Clobbering

Sam Lair, a research associate at the James Martin Center for Nonproliferation Studies, told Bellingcat that Tomahawks have GPS guidance and use terrain matching to determine their location. When there is an error in guidance, some missiles can “clobber” and hit the ground.

The US stopped firing Tomahawk missiles over Saudi Arabia during the 2003 Iraq War after some crashed in the country while attempting to strike targets. About ten Tomahawk missiles crashed during that war, with some landing in Iran and Turkey as well.

---

Bellingcat’s Logan Williams and Felix Matteo Lommerse contributed research to this article. Livio Spani, Anisa Shabir, Afton Briones, Mathis Noizet, and Nicole Kiess from Bellingcat’s Volunteer Community also contributed to this piece.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Bluesky here, Instagram here, Reddit here and YouTube here.

The post Tracing Tomahawks: US Missiles Bound for Iran Spotted Over Iraq appeared first on bellingcat.

In the early hours of June 13, Israeli missiles slammed into apartment buildings across the Iranian capital, Tehran. 

By morning, it became apparent that nine men Israel said were closely associated with the country’s nuclear programme were dead. 

Videos posted to social media showed buildings in flames and rescue workers sifting through rubble as they looked for survivors.

Dozens of civilians who lived in the same apartment blocks as those targeted also died in the strikes. In one instance, a 14-storey residential tower completely collapsed.

But this was just the start, the opening shots of what Israel dubbed Operation Rising Lion – a 12-day operation targeting Iranian scientists, nuclear sites, security figures and military capabilities.

While Iran sought to fight back, launching missiles and drones at Israel, the damage and death toll inflicted by Israel was far greater.

On day 10 of the operation, the United States joined with Israel, carrying out strikes on nuclear sites at Fordow, Natanz and Isfahan.

Bellingcat worked with FRONTLINE (PBS), The Washington Post and Evident Media to piece together the events of the 12-day war to try and understand the true impact of the strikes on Iran’s nuclear programme. Iran maintains the programme is peaceful but Israel has long suspected that it is designed to develop nuclear weapons.

FRONTLINE filmmakers were given access to Iran, where they visited the sites of some of the strikes and spoke to neighbours and relatives of those who were killed as well as high-ranking Iranian officials.

The Washington Post also spoke to senior intelligence and military sources involved in Operation Rising Lion, and the filmmakers visited Vienna to speak with the International Atomic Energy Agency (IAEA), the organisation that has been responsible for monitoring Iran’s nuclear programme.

Bellingcat, alongside The Washington Post, analysed open source information such as satellite imagery, social media footage, local media coverage, death notices and cemetery records to understand how the attacks on Iranian scientists unfolded as well as analyse the civilian cost of the conflict.

US viewers can watch the full film below.

Full reporting reporting from The Washington Post on this topic can be found here and seen on FRONTLINE’s YouTube channel, at pbs.org/frontline, on PBS stations and in the PBS App.

---

Trevor Ball, Carlos Gonzales, Sebastian Vandermeersch and Eoghan Macguire reported for Bellingcat. Sebastian Walker and Adam Desiderio reported for PBS Frontline. Nilo Tabrizy and Jarrett Ley reported for The Washington Post.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Twitter here and Mastodon here.

The post Investigating the Impact of US-Israeli Strikes on Iran’s Nuclear Programme  appeared first on bellingcat.

Attacks by a jihadist group on fuel convoys bound for Bamako, the capital of Mali, have destroyed more than 130 tankers since September, a Bellingcat investigation has found. 

The systematic attacks by Jama’at Nusrat al-Islam wal-Muslimin (JNIM) have brought Bamako and other regions of the West African nation to a standstill as the Al Qaeda-affiliated militia uses economic warfare to pressure the military government.

Take me to the map

Landlocked Mali depends on fuel imports transported via tankers by road from neighbouring Senegal and Ivory Coast. Disrupting these convoys strikes directly at the country’s “economic core”, the independent global conflict monitor ACLED said.

Mali has struggled to contain Islamist insurgent groups since a rebellion in the country’s north in 2012. Large swathes of the country remain outside government control despite the junta’s pledges to root out jihadists. Since 2021, Bamako has relied heavily on a Russian security partnership, first with Wagner and now its Africa Corps successor created by the Russian Ministry of Defense, after cutting ties with French and UN peacekeeping missions.

JNIM, an Islamist coalition affiliated with Al Qaeda, has been designated as a terrorist organisation by several countries including the United States, United Kingdom, Australia and Canada. Mostly active in Mali, Burkina Faso and Niger, it has become one of Africa’s deadliest militant groups.

Bellingcat has used open source methods to track the JNIM blockade across key supply routes in Mali, verifying evidence of six separate attacks across three regions between mid-September and early November which destroyed more than 130 fuel tankers.

Héni Nsaibia, senior West Africa analyst at ACLED, said the campaign marked an escalation of JNIM’s economic warfare tactics, which are aimed at weakening the military regime by undermining its legitimacy. 

While the blockade has not caused a high death toll, Nsaibia said the economic and social repercussions were severe, with fuel shortages disrupting trade and transport across much of the country. It is “a humiliation for the military regime in Bamako, which has been unable to secure the country’s main trade and supply routes,” the analyst told Bellingcat.

A Communications War

Monitoring conflict in West Africa’s Sahel region is especially difficult due to limited digital connectivity, restricted access for journalists, and state controls on reporting. Yet the blockade has generated a large volume of verifiable online material, making it possible to track using open source methods. 

JNIM hosts its main media channel on ChirpWire, an encrypted social media application. The group set out its long-term ambitions on the platform on Nov. 20, Jacob Boswall, a senior journalist at BBC Monitoring who analyses jihadist propaganda in the Sahel, told Bellingcat. JNIM urged Malians, and Bamako residents in particular, to rise up and establish an Islamist government based on Sharia.

The group’s “communications are now predominantly in video format – a shift from the previous written statements,” Boswall said. Since September, videos posted to JNIM channels and circulated on social media show a series of attacks on fuel convoys in southern Mali. These posts, Nsaibia said, were intended to “directly undermine the centre of power, where the regime’s credibility is most at stake.”

In a televised address the night before Independence Day on Sep. 22, the country’s military leader, Colonel Assimi Goïta, urged people to “resist disinformation campaigns orchestrated by armed terrorist groups”. Nsaibia told Bellingcat that the launch of a new media channel highlighting operations by JNIM in the country’s south shows “a deliberate calibration of the group’s public messaging” toward southern audiences, including the junta’s core support base.

Mapping the Siege

Disruption of Daily Life

The fuel blockade has paralysed Mali. Food prices have soared, universities have suspended classes, and the US and the UK embassies have withdrawn non-essential staff. Social media videos verified by Bellingcat show people in Bamako queuing for fuel in lines stretching hundreds of meters and, in some cases, pushing their vehicles after pumps ran dry. A video verified from Oct. 23 shows a single fuel tanker in Bamako being followed by a large number of vehicles. The video’s caption suggests the motorists were hoping to obtain petrol.

The blockade’s broader effects can also be observed from space. NASA’s Black Marble nighttime imagery shows a noticeable dimming of Bamako’s lights when comparing May 29 and Oct. 25 – dates chosen outside of Mali’s rainy season to ensure clear skies for a reliable comparison. Mali relies on a “roughly equal mix of diesel and hydraulic sources”, meaning reduced fuel flows can cause diminished electricity availability and consumption, which is consistent with the dimming seen from space.

NASA Black Marble imagery from May 29 and Oct. 25 shows a difference between Bamako’s lights.

This investigation shows how open source information can help track a conflict that is often not possible with traditional reporting. Bellingcat has previously documented JNIM’s targeting of convoys in neighbouring Burkina Faso. By monitoring online content, geolocating footage and carrying out satellite analysis, it is possible to piece together a detailed view of a crisis that has left much of Mali in the dark.

---

Youri van der Weide and Miguel Ramalho contributed to this report.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Bluesky here and Mastodon here.

The post Mali Under Siege: Tracking the Fuel Blockade Crippling Bamako appeared first on bellingcat.

Warning: Contains written descriptions of extreme violence including murder. All graphic footage has been omitted.

A Bellingcat investigation has identified and verified the exact location of a mass killing of more than 80 people that took place near Al Fashir during the recent siege and takeover of the Sudanese city by the paramilitary Rapid Support Forces (RSF). More than a dozen videos which have emerged online since Oct. 27 were analysed, some filmed by fighters wearing what appears to be RSF insignia, showing the events and their aftermath.

Al Fashir, the capital of North Darfur, was the last major stronghold of the Sudanese military in the region and a refuge for people fleeing nearby villages and towns. The city, considered a strategic military location near the southwestern border leading to Chad and South Sudan, fell last week after more than 500 days under RSF siege. The RSF, which has been fighting Sudan’s military for control over the country, killed at least 1,500 people during the takeover, according to the Sudan Doctors Network.

A Mass Killing Outside the City

Open source evidence reviewed by Bellingcat showed that people attempting to flee Al Fashir were killed by men, some of whom appeared to be wearing RSF uniforms. The RSF had earlier pledged to remain “firmly committed to protect the civilians” and “not tolerate any attempts to exploit their lives or tamper with their security.”

Footage posted on social media showed a mass killing more than seven kilometres outside the city, where the fleeing convoy had encountered an earthen berm encircling Al Fashir. The berm and an accompanying trench were built by the RSF during the siege. Satellite imagery indicates that the section to the north-west of the city, where the mass killing took place, was constructed throughout August.

Bellingcat analysed more than a dozen videos. Given the extreme violence visible in much of the footage, only material that was not explicitly graphic has been included in this report. Some of the videos filmed at this location have also been geolocated by the Centre for Information Resilience and others.

Cross-referencing the different camera angles in the videos made it possible to map the exact location of the killings to a single location: 13.71340, 25.27854. In satellite imagery, clusters of dark shapes around the vehicles north of the berm correspond to the locations of bodies identified in verified videos from the scene.

In total, the video footage showed more than 80 bodies lying beside damaged and burning vehicles along the berm, inside the adjacent trench and across the surrounding area. More than two dozen destroyed vehicles were also identified.

In one video, filmed early on in the attack, fighters in what appear to be RSF uniforms are seen taking cover behind a vehicle as gunfire is heard. One fighter can be seen closing in on the burning convoy and aiming his weapon. 

However, in later videos filmed by the fighters showing the aftermath of the attack, none of the casualties visible appeared to be in possession of weapons; almost all appeared to be dressed in civilian clothing and several were women. Of the more than 80 casualties visible in various videos, a couple can be seen wearing what appears to be dark, military-style clothing, and one can be seen lying next to a belt of ammunition. Although, it is unclear who the belt belonged to.

The arrangement of destroyed vehicles and groups of bodies in the videos matched what was visible in satellite imagery. Moreover, tyre tracks visible in the sand appeared to link the mass killing site with the checkpoints along the sand berm. Fresh marks appeared on satellite images after Oct. 27., the day of the RSF’s complete takeover of Al Fashir.

A RSF commander known as Abu Lulu, identified in the videos by his distinctive white scarf, appeared in at least three videos from the scene. The commander has previously been featured in social media footage from the conflict. On Oct. 31, TikTok removed a profile believed to be linked to him.

In one video, geolocated by Bellingcat to the far side of the berm, the commander can be seen and heard taunting a group of 10 male captives sitting lined up on the ground, forcing them to praise the RSF and denigrate the military before they are shot.

In another video filmed to the west of the convoy, Abu Lulu can be heard questioning a wounded man lying on the ground, threatening sexual violence before shooting him at point-blank range. In a third video filmed meters away, the same commander can be seen standing among a number of motionless bodies as he repeatedly fires into them.

In several other videos, one fleeing vehicle appears to have crossed the berm before becoming stuck in the trench on the far side. In one of these videos, filmed from inside the trench, a fighter can be seen firing into a group of motionless bodies on the ground next to the car, while others film and celebrate.

UN Investigation Points to a Pattern

Morris Tidball-Binz, the UN Special Rapporteur on extrajudicial, summary or arbitrary executions, told Bellingcat that “if the images were genuine”, these were “unlawful killings under International Human Rights Law, International Humanitarian Law (IHL) and International Criminal Law.”

“Under the former they correspond to extrajudicial or arbitrary executions; under IHL they correspond to war crimes and under the latter they may amount to crimes against humanity in view of the number of victims and the seemingly planned and systematic nature of the killings,” he said.

Tidball-Binz added that he was not aware of any steps taken by RSF command or relevant authorities to investigate these incidents or hold those responsible accountable. “So far impunity has prevailed,” he stated via email.

Footage from Oct. 30. shows Abu Lulu in RSF custody, being transported under heavy guard and later incarcerated in Shala Prison on the western edge of the city. The RSF announced an investigation into “violations” committed by fighters following the capture of Al Fashir.

Other open source data also documented evidence of atrocities within the city itself. In a chapter of a detailed report entitled “evidence of mass killings”, satellite imagery analysis by Yale’s Humanitarian Research Lab from Oct. 27 found what it said were “objects consistent with the size of human bodies on the ground near RSF vehicles” and “instances of reddish earth discoloration”.

The UN Security Council condemned the assault by the RSF on Al Fashir and “its devastating impact on the civilian population.”

The UN Fact-Finding Mission on Sudan expressed “grave alarm at escalating atrocities” detailing “a devastating pattern of atrocities by both warring parties” that include “war crimes of violence to life and person”. The mission’s initial findings pointed to “a deliberate pattern of ethnically targeted executions of unarmed civilians, assaults, sexual violence, widespread looting and destruction of vital infrastructure, and mass forced displacement”.

The RSF now controls the entire Darfur region.

---

Carlos Gonzales, Jake Godin and Logan Williams contributed to this report.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Bluesky here and Mastodon here.

The post Geolocating Darfur Killings of Those Escaping Al Fashir appeared first on bellingcat.

To stay up to date on our latest investigations, join Bellingcat’s new WhatsApp channel here.

The organisers of an annual combat sports event allegedly told the venue owner that they were using the space to film an activewear commercial featuring a small “crowd” including women and children. 

In reality, the event hosted on Aug. 30 by SoCal Active Club was part of a movement that champions violent and racist ideas. It featured combat sports fights and performances from two neo-Nazi bands who each have had a member involved in lethal violence, including one for a 2012 mass murder described by the former US Attorney General as a “heinous act of hatred and terror”.

Bellingcat verified a tip-off from independent researcher Wiley D. Cope and researchers from SoCal Research Club (SCRC) that the event was held at a suburban San Diego professional wrestling venue based on images posted by SoCal Active Club as well as a teaser video posted by a far-right propaganda outlet, which Bellingcat is not naming to prevent amplification. The venue operates as a professional wrestling school on weekdays, and is available for rental for events on weekends. 

Charles Smith, co-founder and CEO of Rising Star Entertainment Group, which leases out the venue, confirmed the location after Bellingcat showed him images of the event. He told Bellingcat by email that he was not aware that the space was being used for an Active Club event, and had never heard of the group or “any sort of racial movement here in San Diego of that calibre” before he was contacted by journalists about it.

Smith said he was told by the event’s hosts via Peerspace, a third-party booking and rental website, that the booking was to shoot “an active fitness clothing brand prototype commercial”. 

“I was informed that there would be a small audience of people that would be being used as the ‘crowd’ for the filming and that it would include women and children,” Smith told Bellingcat, “so of course I thought nothing of it.” 

Upon verifying from the images that the event did indeed take place at his venue, Smith said that it was “disappointing that this is undeniable proof that this event occurred here with this audience”.

The international Active Club movement focuses on using fitness, fighting and fashion to recruit young men and boys into the far right, normalise fascist ideas and prepare them for physical violence. The Active Club movement was founded by American neo-Nazi Robert Rundo, who is currently on probation in the United States after having pleaded guilty in December 2024 to planning and engaging in riots at political rallies across California in 2017.

Since 2023, Bellingcat has been tracking and geolocating annual “fight nights” held in the US, where white nationalist groups that focus on training their members to fight against their purported enemies gather. 

“Collaborations with other Active Clubs and neo-fascist organisations, such as the Patriot Front, serve as important cultural events for the far-right to grow their sphere of influence,” Heidi Beirich from the US-based Global Project Against Hate and Extremism (GPAHE), told Bellingcat by email. 

“Exposing Active Club and neo-fascist activities associated with violence helps to inform the public, and authorities, about the beliefs that turn into violence,” Beirich added, “especially when these beliefs have become commonplace in mainstream politics.”

Smith, who told Bellingcat that he is of mixed African-American and Japanese ethnicity, said that he visited the venue late in the evening after the event, when the hosts were cleaning up.

“I was greeted with pats on the back, handshakes, and a couple [of] ‘thanks for letting us use the space, greatly appreciated,’” he told Bellingcat. “It’s hard to believe it’s the same group.” 

SoCal Active Club and the far-right propaganda outlet, which was founded by Rundo, did not respond to Bellingcat’s requests for comment.

Identifying Details: An Orange Wall

On Sept. 2, SoCal Active Club posted several photos on their Telegram channel from the event. Two of these photos show details of the venue, including an orange-coloured part of a wall in the background. 

The photos also show a banner for a support group of the Hammerskins, a violent international neo-Nazi gang that has links to the Active Club movement, particularly in the United States. Hammerskins members have been convicted of multiple crimes, including assault and murder.

A 12-second black-and-white teaser video released by the far-right propaganda outlet founded by Rundo gave a blurry idea of the shape of the building and the ceiling of the venue.

These images provided crucial clues for Cope and researchers from SCRC, a Southern California-based research collective that monitors and shares information on hate and extremist groups, including Active Clubs. Based on local knowledge of the area and their familiarity with the activities of members of the Active Club chapter in Southern California, they began searching for San Diego County gyms and warehouses with boxing rings for rent. They found the venue the same day the teaser video was released, Cope said.

Bellingcat was able to confirm that this was the location of the Active Club combat sports event, using videos and images from previous events held by the wrestling school (which we are choosing not to name as there is no evidence that they have any involvement in the event). 

In a video posted on the school’s YouTube channel on Aug. 17, 2025 – two weeks before the Active Club event – the same orange wall and black banners with orange trim that are only partially obscured at the Active Club event, are visible. Also visible in both the venue’s YouTube video and the photos posted from the Active Club event is a wooden ceiling beam, with wires on the left-hand side.

Another photo posted by the hosts further confirmed that the professional wrestling venue was the location of the Active Club combat sports event. In a photo taken of one of the neo-Nazi bands that performed at the event, brown beams and wires are visible on the ceiling; these same beams and wires, in the same positions, can be seen in photos posted by the venue on their Peerspace page advertising the venue for rent for events.

Bands ‘A Major Cause For Concern’

The Active Club event was more than just a “fight night”. In their post after the event, the SoCal Active Club hosts thanked two US-based neo-Nazi bands for their musical performances after the fights, praising the bands for “really topping the event off with incredible energy.” 

Bellingcat is not naming the bands to avoid amplification, who have been active for many years in US and international neo-Nazi music scenes.

Both bands have had members associated with violence, including mass murder. A former member of one of the bands, Wade Michael Page, murdered seven people at a Sikh temple in Wisconsin in 2012 before taking his own life in what US authorities called a hate crime and a terrorist act. Page was also a member of the Hammerskins. 

A current member of the other band that performed at the Active Club event pleaded guilty in 2012 to attempted involuntary manslaughter and served prison time for his crime. This band member punched a man outside a Michigan bar and ultimately caused the man’s death from a severe brain injury.

According to the GPAHE’s Beirich, the presence of these bands is “a major cause for concern, albeit unsurprising considering the purpose of the Active Club movement is based on beliefs in an impending, and unavoidable, race war”.

“The history of violence associated with Active Clubs is clear,” Beirich added.

Evening Vigil Turned Into Alleged Assault

Two weeks after the combat sports event on Sept. 13, members of one of the Active Clubs that organised it participated in an alleged assault in Huntington Beach, California. 

Members of Patriot Front, SoCal Active Club and other far-right and neo-Nazi groups took part in an evening vigil in Huntington Beach, in the Los Angeles metropolitan area, in honour of assassinated right-wing commentator Charlie Kirk.

According to reporting from the event by The LA Ten Four, a newsletter covering issues surrounding first responders in the Los Angeles area, the man who was attacked was a vigilgoer who confronted the far-right group along with several others, calling them “un-American” and “traitors” and following the group into a parking garage. 

Video footage of the assault taken by The LA Ten Four shows the man being punched, kicked and stomped on by several others. At least two of the attackers appear to be wearing SoCal Active Club t-shirts, identifiable as such by photos and videos posted from the vigil.

SoCal Active Club has not responded to Bellingcat’s request for comment on their apparent involvement in this assault as of publication.

---

Wiley D. Cope contributed research to this piece.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Instagram here, X here and Mastodon here. With the unpredictability of social media algorithms making it harder for news outlets to reach audiences consistently, we have also started a WhatsApp channel that you can join to stay updated on our stories.

The post Like Clockwork: An Orange Wall Exposes Yet Another Active Club ‘Fight Night’ appeared first on bellingcat.

In June, Bellingcat ran 500 geolocation tests, comparing LLMs from various companies against each other, as well as Google Lens – a staple tool for finding the location of photos.

At the time, ChatGPT o4-mini-high emerged as the clear winner, with Google Lens outperforming most other models. Just two months later, with new versions of these AI tools available, we re-ran the trial – this time including Google “AI Mode,” GPT-5, GPT-5 Thinking, and Grok 4 into the mix.

The original test used 25 of Bellingcat’s own holiday photos. From cities to remote countryside, the images included scenes both with and without recognisable features – such as roads, signage, mountains, or architecture. Images were sourced from every continent.

For the updated trial, five test photos were excluded, as they had appeared in a previous article, thus compromising the integrity of the results.

All 24 models’ responses were ranked on a scale from 0 to 10, with 10 indicating an accurate and specific identification (such as a neighbourhood, trail, or landmark) and 0 indicating no attempt to identify the location at all.

Google AI Mode was shown to be the most capable geolocation tool overall. 

Grok 4 gave both better and worse answers compared to Grok 3 but, on average, scored marginally higher. However, it was still less accurate than older versions of Gemini and GPT. 

GPT-5, even in ‘Thinking’ and ‘Pro’ modes, was a considerable downgrade when compared with the capabilities demonstrated by GPT o4-mini-high. In one example, of a city street with skyscrapers in the background, o4-mini-high correctly identified the street, while GPT-5 in Thinking mode pointed to the wrong country. 

Despite delivering faster answers, GPT-5 appeared to sacrifice accuracy. A surprising number of errors and a general sense of disappointment in the new model have also been reported by other users.

Bellingcat tested GPT-5 and its ‘Thinking’ mode via the Plus subscription, which costs roughly the same as access to 04-mini-high prior to its retirement. Five of the most difficult test images were also run through GPT-5 Pro. But even Pro, with a premium price tag of €200 per month, failed to geolocate the photos any more accurately than GPT 04-mini-high.

A Beach, a Hotel and a Ferris Wheel

The disparity between Google and the GPT models became even more apparent in Test 25 – a photo of a shoreline hotel in Noordwijk, the Netherlands, with a Ferris wheel rising just beyond the dunes.

In the previous trial, most older models – including those from GPT, Claude, Gemini and Grok – accurately identified the country as the Netherlands but failed to locate the town. Many latched onto the Ferris wheel but pointed instead to the seaside town of Scheveningen, which also has a Ferris wheel, though situated on a pier, not among the sand dunes.

However, the most recent models, GPT-5 Pro and Thinking, were even less accurate, identifying a beach in France – an entirely different country. 

Unfortunately for open source researchers, following the release of GPT-5, OpenAI removed the option to select older models such as o4-mini-high. After a wave of negative feedback, OpenAI reinstated GPT-4o as the default model for paid subscribers. However, the most capable geolocation models identified in Bellingcat’s testing remain inaccessible.

Google AI Mode, on the other hand, was the first, and only model so far, to correctly identify Noordwijk as the location in Test 25.  

Though AI Mode is powered by a version of Gemini 2.5, it outperformed Gemini 2.5 Pro Deep Research in these tests. Described by Google as its “most powerful AI search, with more advanced reasoning and multimodality,” AI Mode geolocated test images with greater accuracy than any GPT models, including our previous winner, o4-mini-high.

AI Mode is currently only available in India, United Kingdom and the United States.

The majority of models, at some point, returned a hallucination. Users should not rely solely on the answers provided by LLMs. Even the best options, including Google AI Mode, still, at times, confidently point to the wrong location. 

The difference in models’ capabilities compared with just two months ago shows how quickly this field is evolving. However, OpenAI’s recent changes also suggest that progress is not guaranteed, and that AI’s ability to geolocate may plateau or even worsen over time. As new models emerge, Bellingcat will continue to test them.

Thanks to Nathan Patin for contributing to the original benchmark tests.

---

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Bluesky here and Instagram here.

The post LLMs Vs. Geolocation: GPT-5 Performs Worse Than Other AI Models appeared first on bellingcat.

Earlier this week, the Beijing authorities placed all 16 of its districts on high alert in anticipation of torrential rain. More than 40 people have since been confirmed dead, and 80,000 evacuated citywide due to the floods. 

But what can open source data tell us about the damage caused?

Satellite imagery has allowed us to track the impact on both urban and rural areas. On social media, however, a deluge of AI-generated fakes have continued to draw far more views than many genuine eyewitness videos.

“Gaps” in the city’s readiness

In northeast Beijing, near the largest reservoir in northern China, the highest death toll was recorded in the town of Taishitun. Thirty-one of the confirmed fatalities were from an elderly care home situated near the banks of the Qingshui River, which runs through the town.

Taishitun Village, Miyun District, Beijing. Compares 18/07/2025 to 30/07/2025. Credit: Planet.

Yu Weiguo, a Communist Party secretary for the Miyun District, which includes Taishitun, said at a press conference that there were “gaps” in the city’s readiness.

“Our knowledge of extreme weather was lacking. This tragic lesson has warned us that putting the people first, putting human life first, is more than a slogan,” Yu said.

A loss of food and farmland

Across Hebei Province, which neighbours Beijing, agricultural land was also heavily affected. In Jiuying Village, more than 1,300 hectares of farmland, much of it low-lying cornfields, was submerged, according to Reuters. Satellite data from the area north and east of Jiuying Village shows the scale of the flash floods.

Jiuying Village, Hebei Province. Compares 17/07/2025 to 30/07/2025. Credit: Planet.

Zooming out even further, Copernicus’ False Colour (Urban) band shows flooded areas in dark blue, highlighting the impact across Hebei Province.

A deluge of AI on Youtube

Yet on other open platforms, such as social media and video sharing sites, the picture became complicated by accounts posting mis-and-disinformation.

Searching in English, the results for #beijingflood on YouTube Shorts revealed multiple AI-generated thumbnails, one of which surpassed 18 million views. Meanwhile, shorts containing real footage struggled to climb past 1,000 views. 

All five of the top results carried the hallmarks of AI generated content: cars randomly appearing and disappearing, disproportionately sized objects, and overly dramatised scenes lasting only a few seconds.  

On Facebook, when searching for “Beijing flood,” multiple AI-generated fake posts claimed actor Jackie Chan had died in the floods. Using AI-generated photos of Chan lying in a hospital bed or a casket, these posts collectively gathered more than 150,000 likes.

By comparison, Chinese social media platforms, including Baidu’s Haokan Video, Weibo and Douyin appeared to display very few AI-generated videos. Instead, the vast majority appeared to be genuine posts documenting the real-world impact of the floods.

Montage of videos found on Haokan and geolocated by Bellingcat to several districts in Beijing.

In an attempt to verify a sample of what we were seeing, Bellingcat geolocated several videos. Note that Google and Baidu use different coordinate systems. We identified any landmarks in Baidu Maps, before finalising our geolocations in Google Earth Pro.

One video showed a series of clips, including one of a bulldozer driving along a flooded road with two rescue boats in tow. This footage was geolocated to the People’s Government office in Taishitun Town.

Later, in another clip from the same video, a bulldozer can be seen, again not far from the Taishitun government office. 

Another video, posted on Haokan, showing a destroyed bridge was geolocated east of Bulaotun Village. The collapsed bridge can also be seen in Planet imagery from 30 July.

Whilst searching Chinese social media platforms, some recycled footage from past floods could be seen. For example, on Douyin, the Chinese version of TikTok, one of the top results when searching for “Beijing flood” was a video from 2021 showing a mudslide in Japan where buildings and trees were engulfed.

Bellingcat reached out to the Beijing Municipal People’s Government for comment but did not receive a reply at the time of publication.

The post What Can Open Sources Reveal About Beijing’s Deadly Floods? appeared first on bellingcat.

An ambiguous city street, a freshly mown field, and a parked armoured vehicle were among the example photos we chose to challenge Large Language Models (LLMs) from OpenAI, Google, Anthropic, Mistral and xAI to geolocate. 

Back in July 2023, Bellingcat analysed the geolocation performance of OpenAI and Google’s models. Both chatbots struggled to identify images and were highly prone to hallucinations. However, since then, such models have rapidly evolved. 

To assess how LLMs from OpenAI, Google, Anthropic, Mistral and xAI compare today, we ran 500 geolocation tests, with 20 models each analysing the same set of 25 images. 

Our analysis included older and “deep research” versions of the models, to track how their geolocation capabilities have developed over time. We also included Google Lens to compare whether LLMs offer a genuine improvement over traditional reverse image search. While reverse image search tools work differently from LLMs, they remain one of the most effective ways to narrow down an image’s location when starting from scratch.

The Test

We used 25 of our own travel photos, to test a range of outdoor scenes, both rural and urban areas, with and without identifiable landmarks such as buildings, mountains, signs or roads. These images were sourced from every continent, including Antarctica. 

The vast majority have not been reproduced here, as we intend to continue using them to evaluate newer models as they are released. Publishing them here would compromise the integrity of future tests.

Each LLM was given a photo that had not been published online and contained no metadata. All models then received the same prompt: “Where was this photo taken?”, alongside the image. If an LLM asked for more information, the response was identical: “There is no supporting information. Use this photo alone.”

We tested the following models:

Developer	Model	Developer’s Description
Anthropic	Claude Haiku 3.5	“fastest model for daily tasks”
	Claude Sonnet 3.7	“our most intelligent model yet”
	Claude Sonnet 3.7 (extended thinking)	“enhanced reasoning capabilities for complex tasks”
	Claude Sonnet 4.0	“smart, efficient model for everyday use”
	Claude Opus 4.0	“powerful, large model for complex challenges”
Google	Gemini 2.0 Flash	“for everyday tasks plus more features”
	Gemini 2.5 Flash	“uses advanced reasoning”
	Gemini 2.5 Pro	“best for complex tasks”
	Gemini Deep Research	“get in-depth answers”
Mistral	Pixtral Large	“frontier-level image understanding”
OpenAI	ChatGPT 4o	“great for most tasks”
	ChatGPT Deep Research	“designed to perform in-depth, multi-step research using data on the public web”
	ChatGPT 4.5	“good for writing and exploring ideas”
	ChatGPT o3	“uses advanced reasoning”
	ChatGPT o4-mini	“fastest at advanced reasoning”
	ChatGPT o4-mini-high	“great at coding and visual reasoning”
xAI	Grok 3	“smartest”
	Grok 3 DeepSearch	“advanced search and reasoning”
	Grok 3 DeeperSearch	“extended search, more reasoning”

This was not a comprehensive review of all available models, partly due to the speed at which new models and versions are currently being released. For example, we did not assess DeepSeek, as it currently only extracts text from images. Note that in ChatGPT, regardless of what model you select, the “deep research” function is currently powered by a version of o4-mini. 

Gemini models have been released in “preview” and “experimental” formats, as well as dated versions like “03-25” and “05-06”. To keep the comparisons manageable, we grouped these variants under their respective base models, e.g. “Gemini 2.5 Pro”. 

We also compared every test with the first 10 results from Google Lens’s “visual match” feature, to assess the difficulty of the tests and the usefulness of LLMs in solving them. 

We ranked all responses on a scale from 0 to 10, with 10 indicating an accurate and specific identification, such as a neighbourhood, trail, or landmark, and 0 indicating no attempt to identify the location at all.

And the Winner is…

ChatGPT beat Google Lens.

In our tests, ChatGPT o3, o4-mini, and o4-mini-high were the only models to outperform Google Lens in identifying the correct location, though not by a large margin. All other models were less effective when it came to geolocating our test photos.

We scored 20 models against 25 photos, rating each from 0 (red) to 10 (dark green) for accuracy in geolocating the images.

Even Google’s own LLM, Gemini, fared worse than Google Lens. Surprisingly, it also scored lower than xAI’s Grok, despite Grok’s well-documented tendency to hallucinate. Gemini’s Deep Research mode scored roughly the same as the three Grok models we tested, with DeeperSearch proving the most effective of xAI’s LLMs.

The highest-scoring models from Anthropic and Mistral lagged well behind their current competitors from OpenAI, Google, and xAI. In several cases, even Claude’s most advanced models identified only the continent, while others were able to narrow their responses down to specific parts of a city. The latest Claude model, Opus 4, performed at a similar level to Gemini 2.5 Pro. 

Here are some of the highlights from five of our tests.

A Road in the Japanese Mountains

The photo below was taken on the road between Takayama and Shirakawa in Japan. As well as the road and mountains, signs and buildings are also visible.

Gemini 2.5 Pro’s response was not useful. It mentioned Japan, but also Europe, North and South America and Asia. It replied:

“Without any clear, identifiable landmarks, distinctive signage in a recognisable language, or unique architectural styles, it’s very difficult to determine the exact country or specific location.”

In contrast, o3 identified both the architectural style and signage, responding:

“Best guess: a snowy mountain stretch of central-Honshu, Japan—somewhere in the Nagano/Toyama area. (Japanese-style houses, kanji on the billboard, and typical expressway barriers give it away.)”

A Field on the Swiss Plateau

This photo was taken near Zurich. It showed no easily recognisable features apart from the mountains in the distance. A reverse image search using Google Lens didn’t immediately lead to Zurich. Without any context, identifying the location of this photo manually could take some time. So how did the LLMs fare?

Gemini 2.5 Pro stated that the photo showed scenery common to many parts of the world and that it couldn’t narrow it down without additional context. 

By contrast, ChatGPT excelled at this test. o4-mini identified the “Jura foothills in northern Switzerland”, while o4-mini-high placed the scene ”between Zürich and the Jura mountains”.

These answers stood in stark contrast to those from Grok Deep Research, which, despite the visible mountains, confidently stated the photo was taken in the Netherlands. This conclusion appeared to be based on the Dutch name of the account used, “Foeke Postma”, with the model assuming the photo must have been taken there and calling it a “reasonable and well-supported inference”.

An Inner-City Alley Full of Visual Clues in Singapore

This photo of a narrow alleyway on Circular Road in Singapore provoked a wide range of responses from the LLMs and Google Lens, with scores ranging from 3 (nearby country) to 10 (correct location).

The test served as a good example of how LLMs can outperform Google Lens by focusing on small details in a photo to identify the exact location. Those that answered correctly referenced the writing on the mailbox on the left in the foreground, which revealed the precise address.

While Google Lens returned results from all over Singapore and Malaysia, part of ChatGPT o4-mini’s response read: “This appears to be a classic Singapore shophouse arcade – in fact, if you look at the mailboxes on the left you can just make out the label ‘[correct address].’”  

Some of the other models noticed the mailbox but could not read the address visible in the image, falsely inferring that it pointed to other locations. Gemini 2.5 Flash responded, “The design of the mailboxes on the left, particularly the ‘G’ for Geylang, points strongly towards Singapore.” Another Gemini model, 2.5 Pro, spotted the mailbox but focused instead on what it interpreted as Thai script on a storefront, confidently answering: “The visual evidence strongly suggests the photo was taken in an alleyway in Thailand, likely in Bangkok.”  

The Costa Rican Coast

One of the harder tests we gave the models to geolocate was a photo taken from Playa Longosta on the Pacific Coast of Costa Rica near Tamarindo. 

Gemini and Claude performed the worst on this task, with most models either declining to guess or giving incorrect answers. Claude 3.7 Sonnet correctly identified Costa Rica but hedged with other locations, such as Southeast Asia. Grok was the only model to guess the exact location correctly, while several ChatGPT models (Deep Research, o3 and the o4-minis) guessed within 160km of the beach.

An Armoured Vehicle on the Streets of Beirut

This photo was taken on the streets of Beirut and features several details useful for geolocation, including an emblem on the side of the armored personnel carrier and a partially visible Lebanese flag in the background. 

Surprisingly, most models struggled with this test: Claude 4 Opus, billed as a “powerful, large model for complex challenges”, guessed “somewhere in Europe” owing to the “European-style street furniture and building design”, while Gemini and Grok could only narrow the location down to Lebanon. Half of the ChatGPT models responded with Beirut. Only two models, both ChatGPT, referenced the flag.  

So Have LLMs Finally Mastered Geolocation?

LLMs can certainly help researchers to spot the details that Google Lens or they themselves might miss.

One clear advantage of LLMs is their ability to search in multiple languages. They also
appear to make good use of small clues, such as vegetation, architectural styles or signage. In one test, a photo of a man wearing a life vest in front of a mountain range was correctly located because the model identified part of a company name on his vest and linked it to a nearby boat tour operator.

For touristic areas and scenic landscapes, Google Lens still outperformed most models. When shown a photo of Schluchsee lake in the Black Forest, Germany, Google Lens returned it as the top result, while ChatGPT was the only LLM to correctly identify the lake’s name. In contrast, in urban settings, LLMs excelled at cross-referencing subtle details, whereas Google Lens tended to fixate on larger, similar-looking structures, such as buildings or ferris wheels, which appear in many other locations.

Heat map to show how each model performed on all 25 tests

Enhanced Reasoning Modes

You’d assume turning on “deep research” or “extended thinking” functions would have resulted in higher scores. However, on average, Claude and ChatGPT performed worse. Only one Grok model, DeeperSearch, and one Gemini, Gemini Deep Research, showed improvement. For example, ChatGPT Deep Research was shown a photo of a coastline and took nearly 13 minutes to produce an answer that was about 50km north of the correct location. Meanwhile, o4-mini-high responded in just 39 seconds and gave an answer 15km closer.  

Overall, Gemini was more cautious than ChatGPT, but Claude was the most cautious of all. Claude’s “extended thinking” mode made Sonnet even more conservative than the standard version. In some cases, the regular model would hazard a guess, albeit hedged in probabilistic terms, whereas with “extended thinking” enabled for the same test, it either declined to guess or offered only vague, region-level responses.

LLMs Continue to Hallucinate

All the models, at some point, returned answers that were entirely wrong. ChatGPT was typically more confident than Gemini, often leading to better answers, but also more hallucinations. 

The risk of hallucinations increased when the scenery was temporary or had changed over time. In one test, for instance, a beach photo showed a large hotel and a temporary ferris wheel (installed in 2024 and dismantled during winter). Many of the models consistently pointed to a different, more frequently photographed beach with a similar ride, despite clear differences.

Final Tips

Your account and prompt history may bias results. In one case, when analysing a photo taken in the Coral Pink Sand Dunes State Park, Utah, ChatGPT o4-mini referenced previous conversations with the account holder: “The user mentioned Durango and Colorado earlier, so I suspect they might have posted a photo from a previous trip.” 

Similarly, Grok appeared to draw on a user’s Twitter profile, and past tweets, even without explicit prompts to do so. 

Video comprehension also remains limited. Most LLMs cannot search for or watch video content, cutting off a rich source of location data. They also struggle with coordinates, often returning rough or simply incorrect responses. 

Ultimately, LLMs are no silver bullet. They still hallucinate, and when a photo lacks detail, geolocating it will still be difficult. That said, unlike our controlled tests, real-world investigations typically involve additional context. While Google Lens accepts only keywords, LLMs can be supplied with far richer information, making them more adaptable.

There is little doubt, at the rate they are evolving, LLMs will continue to play an increasingly significant role in open source research. And as newer models emerge, we will continue to test them. 

Infographics by Logan Williams and Merel Zoet

The post Have LLMs Finally Mastered Geolocation? appeared first on bellingcat.

Bellingcat has identified at least 22 villages damaged by airstrikes in Myanmar, despite a temporary ceasefire declared by the State Administrative Control (SAC) or the military junta from April 2 to 22 following a 7.7 magnitude earthquake that hit the country on March 28. The ceasefire has been extended to April 30.

The earthquake’s epicentre was recorded just 16km northwest of Mandalay, the second-largest city in Myanmar, and it struck just before 1pm local time. More than 3,000 people died and aid groups report that over 17 million people living in earthquake-affected areas are in urgent need of food, water, shelter and healthcare.

The country, which has already been devastated by four years of civil war, continues to be hit with multiple aftershocks. The SAC, ruling Myanmar since seizing power from the democratically elected government in 2021, declared a temporary pause to fighting only after the main opposition coalition announced one – except in the case of defensive actions. 

Bellingcat has geolocated at least 19 villages damaged in military assaults during the first 20 days of the ceasefire. Two of them were identified from ground reporting. Three additional villages were damaged after the earthquake but before the ceasefire – bringing the total to 22 villages.

The airstrikes targeted civilian areas in territory held by rebel forces and territory where the junta is fighting to regain control. The villages damaged after the ceasefire were geolocated by cross-referencing our findings with NASA FIRMS or satellite imagery alongside local and other media sources.

Villages bombed since the earthquake on March 28; the epicentre is marked in black, yellow and red

“It’s quite clear that only the military can do airstrikes. The rebels don’t have aircrafts,” Aye Chan Naing, co-founder and editor-in-chief of Democratic Voice of Burma (DVB), one of Myanmar’s largest independent media organisations, told Bellingcat.

Lacking jets or fighter planes, resistance groups heavily rely on commercial drones “improvised into sort of military use,” Naing said.

Targeting and scaring civilians is part of the military’s strategy, he explained. “If you support the rebels, then you know we [the military] are going to burn the village.”

“At a moment when the sole focus should be on ensuring humanitarian aid gets to disaster zones, the military is instead launching attacks,” said UN Human Rights Office spokesperson Ravina Shamdasani on April 11.

“Since the earthquake, military forces have reportedly carried out over 120 attacks – more than half of them after their declared ceasefire was due to have gone into effect on 2 April,” she told journalists.

According to local media reports, the Myanmar military carried out an aerial attack just hours after the earthquake struck. Anti-junta armed group TNLA claimed that the military bombed Nawng Len village, approximately 120km from the earthquake’s epicentre in the eastern Shan State. Seven members of a TNLA-aligned ethnic armed organisation (EAO) were reportedly killed in the attack.

We were not able to independently confirm the airstrike, but we were able to geolocate images of several damaged buildings, to a location in the north of the village. The intact buildings can be seen on Google Earth imagery in late January.

The military junta did not respond to Bellingcat’s request for comment.

Attacks in Worst-Affected Earthquake Areas

Out of the 22 villages we identified, 14 of them are in either Sagaing or Mandalay, which were some of the worst affected areas by the earthquake. Large parts of both regions are located in central Myanmar, where a lot of townships are either contested or under junta control.

The military tries to cut the rebels’ survival pipeline, Naing told Bellingcat.

“They understand that the rebels cannot survive without civilians because that’s where they get food and maybe tax money,” he said.

Since the rebels don’t have permanent bases, members are difficult to locate. While drones might strike and kill a few individuals, it’s much easier for the army to identify and target areas where civilians live, Naing added.

On April 9, twenty people were reportedly killed in an airstrike in Nan Khan in Sagaing’s Wuntho Township. We were able to geolocate images of damaged buildings to the coordinates 23.9983922,95.8881422.

Just days before this attack, on April 6, Thone Pan Hla in Chaung-U Township was reportedly attacked in an airstrike, killing three members of a family. “The motivation for such an attack on a village of melon farmers is difficult to understand. It seems to be an effort to terrorise a civilian population that strongly supports the anti-regime National Unity Government (NUG) and its armed rebel PDF wing,” reported The Times newspaper. NUG is the country’s parallel government in exile, elected democratically and ousted in the 2021 coup.

About 25km northeast of Thone Pan Hla is the village of Ngar Shan also in Chaung-U Township. Local news outlets reported that the village was burned down by the junta, just days after the earthquake. While we weren’t able to geolocate specific images or independently confirm the cause of the fire, thermal hotspots were detected at the site on March 31. This lines up with the timeline and reports of 170 houses being burned in Ngar Shan on April 1 local time.

Images of the destruction shared on Facebook show the village in ruins. However, NASA’s Fire Information for Resource Management System, FIRMS, detects thermal hotspots in the entire village in the early hours of that day.

A false-colour infrared map from Sentinel Hub’s Copernicus platform also reveals signs of destruction in the village. Though commonly used to assess vegetation health, this type of imagery shows plant-covered areas in deep red, while cities and exposed ground are grey or tan, and water appears blue or black. Following the attack, exposed ground, indicative of possible damage, can be seen primarily in the northwest of the village.

Chaung-U Township is located in the southern Sagaing region, where the geography poses challenges for resistance armies.

“Unlike ethnic resistance groups along Myanmar’s borders, or those in northern Sagaing near India, the resistance forces in southern Sagaing do not have foreign borders across which they can attempt to retreat,” wrote Centre for Information Resilience’s Myanmar Witness in a December 2024 report. 

Sagaing remains an epicentre for violence with a strong resistance presence due to the region’s strategic importance. A state of emergency was declared in the state following the quake.

Repeated Bombings in Lost Territories

Another region of strategic importance is Mandalay where the Central Military Command is located in the Mandalay Palace, reported to have been damaged in the earthquake. Mandalay is also a logistical hub in Myanmar’s heartland, and since late last year, the SAC has been trying to retake townships it has lost there. 

Two of those townships are Thabeikkyin and Singu. Both were attacked during the ceasefire. 

On April 19, the Myanmar military reportedly carried out an airstrike on the village of Yae Htwet in Thabeikkyin Township. The attack killed at least 27 people, according to the BBC. The report added that pro-military Telegram channels claimed the attack targeted PDF camps, the armed wing of the anti-regime National Unity Government. 

Just a day earlier, 13 people were reportedly killed in an attack on Leik Kya village, located 3km north of Yae Htwet.

A separate aerial attack was reportedly carried out over a village in Thabeikkyin, killing two people. It took place on April 13 in Chaung Gyi along the highway running through the village. We were able to identify distinct features of the roof of buildings across the street from the attack and, along with the location of trees, match satellite images of the area.

Bellingcat also geolocated a school (here: 22.689505, 96.016978) in Singu Township, the site of a reported airstrike in Kyi Tauk Pau village that injured six people.

Destruction of Schools and Religious Sites

The junta has a track record of targeting schools. According to a tally by Radio Free Asia last November, nearly 200 schools were hit by airstrikes since the 2021 military coup in regions and states which have seen fighting by resistance forces opposing junta rule.

A school in Sagaing’s Shwebo Township was reportedly bombed during the ceasefire on April 20, killing two people, including a pregnant woman. According to DVB, Shwebo Township People’s Administration, a local anti-junta governance body, said displaced people were taking shelter in the school.

Bellingcat found four schools and seven religious sites – monasteries and churches – damaged in recent attacks.

Peter Bouckaert of the human rights and advocacy group Fortify Rights called the attacks on churches and monasteries that could be hosting people displaced by the earthquake “a great violation of the laws of war”.

“These are protected sites under international humanitarian law. They are direct deliberate attacks on these protected institutions,” he told Bellingcat.

The junta has a history of attacking religious sites. During the ceasefire, a Baptist church was bombed in Mindat in the neighbouring Chin State, where several armed opposition groups have emerged since 2021. While there were no reported casualties at the church, six people were killed in the attack on the town.

Mindat was taken over by resistance forces last year amid reports of hundreds of homes destroyed by alleged junta shelling, arson, and airstrikes. A lot of this damage is now visible on Google Maps’ updated imagery from January 2025.

Several churches in Chin State have been damaged in the past few years, Myanmar Witness had found in 2023. It is the only Christian-majority state in Buddhist-majority Myanmar.

Battle for Control of Town Rages Amid Ceasefire

Indaw is a small town close to the border with Kachin, a state partly controlled by the Kachin Independence Army (KIA)-led resistance forces. Indaw was reportedly bombed on April 1 when it was still under the junta’s control. According to local accounts, two people were killed and eight others injured. A monastery was damaged in the attack. We were able to geolocate the images of the aftermath by comparing old pictures and satellite images of the monastery with structures still standing after the recent attack.

The destruction on April 1 was just one of the many assaults the town has witnessed since resistance forces launched an offensive in August last year. The junta’s reported airstrikes against the resistance displaced hundreds of people, and many others fled. 

Despite the ceasefire, on April 8, resistance forces captured Indaw after months of fighting. However, the junta has continued to carry out airstrikes in civilian areas, according to reports. As Richard Horsey, Senior Adviser on Myanmar at Crisis Group, previously told Bellingcat, the junta often bombs areas it has lost so people have nothing left to return to.

Images show that large parts of Indaw were destroyed last year. Source: Google Earth Pro Imagery

Attacks During Burmese New Year

The military regime reportedly carried out airstrikes on monasteries over the four-day Thingyan or Burmese New Year festival from April 13 to 16. According to data compiled by an independent news site, The Irrawaddy, at least 23 civilians were killed in these attacks.

In one of the monastery attacks, six people were reportedly killed and 20 others injured. Bellingcat geolocated the aftermath of the reported strike. This was in Kan Ni village in Kawkareik Township in Kayin, one of the southernmost states of the country.

Despite Widespread Violations, Junta Extends Ceasefire

The Myanmar military has now extended the ceasefire to April 30 in a move to “expedite relief and rebuilding efforts”, but reports say that aid is being restricted. “The SAC is weaponising humanitarian assistance,” Surachanee Sriyai, interim director at the Center for Sustainable Humanitarian Action to Displaced Ethnic Communities, told Bellingcat, explaining that aid is not reaching areas that aren’t under the SAC’s control. An analysis by the BBC in November last year reported that the military only has full control of 21% of Myanmar’s territory. 

Sriyai noted that while the earthquake has drawn some attention to Myanmar, the country has already been in critical need of aid due to the prolonged armed conflict. Meanwhile, bombings persist even during the extended ceasefire period.

---

Members of Bellingcat’s Global Authentication Project, including Afton Knox, Nicole Kiess, Stéphanie Ladel, Timothy B and Max F. Wan contributed research to this piece. Interactive map by Miguel Ramalho.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Bluesky here, Instagram here and YouTube here.

The post Open Sources Show Myanmar Junta Airstrike Damages Despite Post-Earthquake Ceasefire appeared first on bellingcat.

This article is the result of a collaboration with The Sunday Times. You can find their corresponding piece here.

On the last Friday in December, a German businessman in his mid-40s allegedly met a small aircraft on a dusty runway in remote Western Australia. The following evening in Perth, seven hours’ drive south, he and another man were arrested and charged with trafficking a commercial quantity of a controlled drug.

Police said a search of their hotel rooms uncovered 200kg of cocaine, packed in suitcases in single one-kilogram blocks, along with night vision goggles, aviation equipment and a hardware cryptocurrency wallet.

It was the culmination of a three-month Australian Federal Police (AFP) investigation codenamed “Operation Mirkwood”. Authorities estimated the street value of the drugs to be AUD $65 million and AFP Inspector Chris Colley said an “organised crime syndicate” was likely responsible for the scheme.

The German businessman was Oliver Andreas Herrmann, a 44-year-old champion marathon runner and the director of multiple companies with diverse interests spanning various jurisdictions.

Herrmann and the other man who was charged are due to face court again in May. They have not yet entered a plea and the presumption of innocence applies. Herrmann, who has no known convictions, had not responded to multiple requests for comment as of publication. 

The Sunday Times reported in January that Herrmann has “close financial ties” to Christy Kinahan, the 67-year-old founder of the eponymous international drug cartel who is wanted by authorities around the world. Last month it reported that Herrmann “acted as Kinahan’s representative on the ground” in Indonesia and quoted a source who said Herrmann once introduced him to the cartel leader.

“Kinahan was Oliver’s boss,” the source told The Sunday Times. “He was afraid of him. Kinahan was always shouting at him.” 

Bellingcat and The Sunday Times have previously reported on the US-sanctioned Kinahan Organised Crime Group, using Kinahan’s own Google Maps profile to plot his movements over five years and identify the cartel leader’s business associates.

That investigation revealed that the normally elusive crime boss – known as the “Dapper Don” – posted hundreds of reviews under the alias Christopher Vincent, disclosing his precise locations across three continents, including in Dubai where he lives in hiding. Bellingcat contacted Kinahan but did not receive a response.

We have now conducted an open source analysis of Herrmann’s online footprint to build a picture of the man Australian authorities accuse of trafficking drugs last Christmas. The findings paint a portrait of an avid runner and international businessman who is more accustomed to poolside video conferences than an alleged drug drop in the Australian desert.

This investigation has traced Herrmann to locations associated with the cartel. These include a building in South Africa that Kinahan reviewed on his Google Maps profile, and to the Zimbabwean capital of Harare the day before a conference that the Irish drug lord said he attended.

It also sheds light on the complex network of international firms linked to Herrmann, either directly or through his associates. One of these firms shares an address with a company that reportedly received payments ultimately destined for Christy Kinahan.

Racing Around The World

Oliver Herrmann is a German national who has referred to Munich as his “home city”. He is also a South African resident, according to the AFP, and reportedly travels on a Swiss passport. Herrmann gave his nationality as Swiss in company documents filed in Singapore, while in registration documents in the UK he said he was German. He has listed his country of residence as Indonesia and Singapore.

Corporate records indicate that Herrmann has been involved at senior levels with companies active in the fields of fintech, mining and consulting. Until recently Herrmann was on the executive board of a German “international raw materials company” whose parent company, according to its website, is to be listed on the Düsseldorf Stock Exchange. The company told Bellingcat in February that Herrmann was removed from his board position after it learned about the allegations in Australia and said he no longer had any role with the organisation.

Herrmann’s Instagram account is set to private but he has a public profile on Strava, a fitness app used for recording exercise that often includes GPS-tracked routes (see Bellingcat’s Strava activity map guide here).

An acclaimed runner who won the 2016 Munich Marathon, Herrmann regularly logged his runs on Strava. Photos posted to the account confirm he is the same person pictured in an Australian media report about his court appearance in January over the alleged drug bust.

Herrmann’s Strava account has logged more than 2,500 activities in 29 countries across Europe, Asia, Africa, South America and the Middle East between 2013 and 2023. He has also posted at least 130 photos documenting his extensive travels. They show a dedicated athlete who appears to enjoy a jet-setting lifestyle, with many featuring scenic and tropical locations.

Herrmann’s Strava account shows that, like Kinahan, he has frequently traveled to Zimbabwe. An analysis of Herrmann’s runs shows he logged almost 500 activities in Harare between February 2018 and May 2022. Meanwhile, Kinahan posted 25 Google reviews in Harare between June 2019 and September 2021.

In one of these reviews, the leader of the transnational organised crime syndicate said he spent four nights at the Amanzi Lodge hotel for a “business networking conference” that was hosted by two companies. The conference ran from October 8 to 11, 2019, according to one of the company’s social media accounts. In two photos posted online, an individual with similar features to Kinahan is seen at the event.

On October 7, the day before the conference began, Herrmann logged a run just 5.5 km from the venue where Kinahan said he stayed. Herrmann’s 2019 Strava activity in Harare suggests he spent time close to this location, near the city’s affluent suburb of Borrowdale, with dozens of runs starting and ending on the same residential road. After October 7, Herrmann’s next Strava run was recorded three days later in Dublin, Ireland.

Two of Herrmann’s runs from 2021 and 2022 take place in downtown Dubai, about 250 meters and 550 meters from the office of a sanctioned company that the US government said is owned or controlled by Christy Kinahan’s son, Daniel Kinahan.

The 2021 run starts and ends outside a five-star hotel where Daniel Kinahan was photographed. The photo in the since-deleted tweet, which was the subject of media coverage at the time, was posted three days after Herrmann’s Strava run and geotagged to Dubai. A reverse image search shows that the picture of Daniel Kinahan was taken inside the Dubai hotel.

Herrmann’s Strava profile also displays information about his business activities. A 2018 post, captioned “Office view in ZIM”, includes a photo of an open document on a laptop screen. Titled “Mining Project Teaser”, the document touts the attractiveness of Zimbabwe’s “open for business” policy for foreign investors.

On the header is “Gemini Global Pte Ltd”, a Singapore-based company of which Herrmann is the director and secretary, according to corporate records. Herrmann reportedly filed a police complaint after Gemini lent US $500,000 for an Indonesian mining project that failed in the early 2010s. More than two dozen runs logged by Herrmann begin and end at the registered address for the Singapore company.

Other locations logged on Strava appear to be linked to companies Herrmann is involved in, suggesting his frequent travel may be business-related. Some runs explicitly mention an office, including one in Singapore in 2015 and three in Dublin in 2016.

Herrmann is listed on Crunchbase as the chief financial officer of defunct Irish fintech, Leveris Limited, which reportedly collapsed in 2021 with debts of €38 million. Records from Ireland’s Companies Registration Office show he was also a director of the company. Herrmann has logged Strava runs in Minsk and Prague, other cities where Leveris had business connections.

Running Mate

A series of companies involved in trade, real estate and corporate finance appear to be linked to Herrmann’s domestic partner. This woman was identified through an analysis of social media posts. In the comments of an Instagram post about his Munich Marathon win, several users tagged the woman’s account. Herrmann’s Strava profile also follows a user by the same name, and includes a photo of him with an identical-looking woman during a run in France.

An analysis of the woman’s Strava account shows that multiple runs logged in different countries over six years match where Herrmann’s GPS-tracked routes start and finish. She is tagged as a companion in at least one run recorded on Herrmann’s profile.

Three videos posted to the woman’s now-deleted Instagram account show a man strongly resembling Herrmann during a hike at Cape Town’s Table Mountain, visiting Mapungubwe National Park, and on a game drive with two boys near Lake Kariba. Photos also show a boat trip and a beach outing with several children in which a man with similar features to Herrmann is seen with his back to the camera. A photo posted to the woman’s Twitter account a decade ago also shows a man who resembles Herrmann.

The woman is also tagged in an Instagram post by a Thai mining magnate whose company is listed as a shareholder of the German company that recently removed Herrmann from its board. The Thai woman’s Instagram includes photos of Herrmann and his partner going back years, including during a 2022 “business trip” in Dubai.

The Corporate Web

An open source search identified a person with the same first and last name as Herrmann’s partner involved in three companies. Corporate records show she was listed as the owner of defunct Indonesian firm PT. Gemini Nusa Land, which was involved in real estate, and previously the director of another company, also headquartered in Indonesia.

The third company is South Africa-registered 247 Capital Group, where business data provider b2bhint.com lists her as a director. These details were verified through South Africa’s official registry. A generic-looking website for the firm says it is a leading “corporate finance group” staffed by “specialist capital raising managers”. The website’s contact section lists two addresses: one is a small house on Long Island, New York; the other is a high-rise building in Johannesburg called The Leonardo.

Herrmann’s Strava profile shows he has logged two morning runs ending directly outside The Leonardo, in April and May 2022. Kinahan has also been to The Leonardo: he wrote about visiting the building and posted photos of the interior in Google reviews from September 2021.

An analysis of 247 Capital’s website using ViewDNS, a tool that examines websites, determined that it shares an IP address with three other sites. There are multiple reasons why websites can share IP addresses and it does not necessarily mean they are related. In this case, however, there is evidence that 247 Capital may be linked to the other sites.

The first is for a US-based company called Ryba LLC; the second is for an Indonesia company called PT. Sukses Dagang Bersama (abbreviated to “SDB Trading” online); and the third is a placeholder for a web developer that designed the sites for 247 Capital, Ryba LLC, and PT. Sukses Dagang Bersama.

Herrmann’s partner had not responded to requests for comment as of publication. There is no suggestion that she is involved in illegal activity.

Ryba LLC

Last year, The Sunday Times reported that a company with a mailing address at the Trump Building was the recipient of two payments totalling US $850,000. It said the funds were lodged to a company account in South Dakota and the beneficiary was listed as Adam Wood, a known associate of Kinahan who attended a 2019 aviation conference in Egypt with the cartel leader. The newspaper said these payments were part of a series of international wire transfers totalling US $1.25 million of which Kinahan was the ultimate beneficiary.

Today, The Sunday Times reveals that the payments of US $850,000 were made to Ryba LLC.

Ryba LLC’s website lists its address as the Trump Building on Wall Street in New York. Companies with this name are registered in the US, but corporate records show that none are located in New York.

The phone number on Ryba LLC’s website was linked to a New York law firm via the crowd-sourced contact book app, TrueCaller. An online search for the firm shows it has an office in the Trump Building, and searches for the Long Island address listed on 247 Capital’s website returned a hit for a lawyer who works at this firm.

The Long Island address also appeared in a small-claims court record, which named the home owner as the lawyer who works in the Trump Building. A digital copy of the deed from the Nassau County Clerk shows the lawyer bought the house 25 years ago. Bellingcat called the Clerk’s office to confirm the deed was still current.

According to the lawyer’s bio, they are an “Anti Money Laundering Specialist” who works in wealth and tax planning, trust and estate administration, and asset protection. The lawyer and the firm had not responded to requests for comment as of publication. There is no suggestion that the lawyer or firm are involved in illegal activity.

Searches on LinkedIn for staff who work for Ryba LLC returned a result for an employee who lists their current role as a senior project finance manager at the company. Their previous position, according to the profile, was head of accounting at Leveris, the Irish company where Herrmann previously served as chief financial officer.

In the photo on Herrmann’s Strava account showing the mining proposal document, a meeting notification for the employee is visible in the top right of the laptop screen. The employee’s LinkedIn account is no longer online, but their details have been saved on RocketReach, a site that aggregates professional data from online platforms.

The employee had not responded to requests for comment as of publication. There is no suggestion that they are involved in illegal activity.

PT. Sukses Dagang Bersama

Bellingcat purchased the Indonesian corporate record for PT. Sukses Dagang Bersama. Its “commissioner” is listed as Conor Fennelly, Herrmann’s former business partner and one-time chief executive of Leveris.

However, Fennelly told Bellingcat that he had “never heard of” the Indonesian company and had “no knowledge” of its operations. He also said he had no business connection to Herrmann outside of Leveris and had not been in contact with him since the Irish tech firm collapsed in 2021.

After providing a copy of the Indonesian business documents showing his listing as commissioner, Fennelly said he “didn’t authorise this” or sign paperwork taking on any role at the company. He confirmed that his name, address and passport information on the document was accurate.

“Oliver and several others at Leveris would have had that,” he said. “The company was founded [in] 2021 and interestingly this is months after Leveris went under and months after my last contact with Oliver, assuming he is the reason my name appears here.”

Fennelly said he met Herrmann through an associate at Leveris in 2016, and that Herrmann subsequently invested in the company and became its chief financial officer. Fennelly found Herrmann to be “reliable, calm, competent and trustworthy”, he said, adding that news of his arrest in Australia came as a “complete shock”. Fennelly said he believed Herrmann had been living in Zimbabwe and training as a runner.

Corporate records also show that PT. Sukses Dagang Bersama was originally established in 2013 under a different name, Maksimum Jaya Segar. A person with the same first and last names to Herrmann’s partner is listed as a director of the company from December 2017 to November 2021. Her listed address is in a residential neighbourhood west of Jakarta, where Herrmann and his partner have logged dozens of runs.

Aircraft and International Trade

PT. Sukses Dagang Bersama was involved in the sale of an aircraft that was exported from the US to Africa last year, Federal Aviation Administration (FAA) records show. The FAA documents say the company bought the plane – a Beechcraft King Air 350 – in early 2024.

Flight tracking website ADS-B Exchange shows that the twin-turboprop aircraft arrived in Harare after the last leg of its journey on February 23, 2024. The ferry pilot who transported the aircraft posted images of the trip to Facebook, which were tagged in Harare on the same date. The plane has been active since its delivery, travelling to airports in Zimbabwe, South Africa and Botswana. Images from plane spotters in South Africa in April and May 2024 show the aircraft with Malawi registration number 7Q-YAO on its side.

Two days after the plane was delivered to Harare the pilot posted a photo of himself with three other men in front of the aircraft, captioned “Acceptance demo flight”. The pilot and one of these men have previously flown a different aircraft, a Pilatus PC-12, that has been associated with a Kinahan-linked company.

The US $850,000 payment to Ryba was linked to a dispute over the purchase of this aircraft, according to The Sunday Times.

The pilot posted a photo to Facebook before transporting the Pilatus PC-12 from South Africa to the US in 2022 after it was sold to an unrelated buyer. But three years earlier, the Pilatus PC-12 was pictured in a Twitter post by CVK Investments LLC, a company that Irish police said was associated with Kinahan.

The July 2019 post said CVK was investing in the aircraft for an “air ambulance joint-venture business in Africa”. The aircraft pictured in the post shows its serial number “342”, matching the plane in the pilot’s Facebook post. While an aircraft’s registration number can change, the serial number is assigned by the manufacturer and remains the same (see Bellingcat’s flight-tracking guide here).

The second man is an employee at Malawi’s aviation authority who is referenced in a Facebook photo as being one of the pilots during an August 2021 flight in the Kinahan-linked Pilatus PC-12.

The identity of the Malawi-registered plane was confirmed by its registration number at the time, “7Q-XRP”, visible on the control panel in the photo. The cockpit is identical to one pictured in a Google review posted by Kinahan a month later in September 2021.

The pilots had not responded to requests for comment as of publication. There is no suggestion that they are involved in illegal activity or that either of the planes has traveled to Australia.

PT. Sukses Dagang Bersama is also listed in publicly available import/export records for mining-related and narcotic products between countries including India, Nigeria, Peru, Turkey and Russia.

Records from import/export data provider 52wmb show that in one 2023 shipment from India to Nigeria, PT. Sukses Dagang Bersama is listed in the product description for a delivery of the narcotic “Pentazocine Injection”, an opioid used in medicine that is also reportedly misused and sold on the underground market in Nigeria.

Also listed in the product description field is another company, Turkoca Import Export Transit Co Ltd. This Korean-based company was sanctioned by the US in May 2022 for being part of an Iran-linked oil smuggling and money laundering network.

The product description usually contains information about the items being exported. A potential explanation for company names appearing in this section is that they are “notify parties”, which are entities such as buyers, suppliers and brokers who should be informed when the cargo arrives. PT. Sukses Dagang Bersama appears as a “notify party” in the product description for another shipment to Nigeria from a different Indian pharmaceutical company.

PT. Sukses Dagang Bersama is also listed in 2024 import records for shipments of accessories for heavy machinery to Turkey from a Peruvian company that makes mining equipment. In records from Dataontrade.com it also appears as an exporter of “spare parts” for similar machinery, this time from Turkey to Russia.

Oliver Herrmann had not responded to requests for comment as of publication. Herrmann’s lawyer said: “I am not instructed to comment on these matters.”

Emails to 247 Capital Group, Ryba LLC and PT. Sukses Dagang Bersama were not returned.

Australian Cocaine Charges

Oliver Herrmann and his co-accused, Australian man Hamish Scott Falconer, 48, appeared in Perth Magistrates Court in January. Both men have been charged with one count of trafficking a commercial quantity of cocaine.

Herrmann also faces four counts of failing to comply with an order, according to a report in The West Australian, while Falconer is also facing one count of possessing a controlled drug and one count of failing to comply with an order.

Local media reported that neither of the men applied for bail and no pleas were entered.

The Australian Federal Police said the men were arrested in Perth’s central business district on December 28 as part of an operation that began in October.

The AFP alleges that the men met at Perth Airport in November and drove to Kojonup Airport, about 250km south of Perth. Investigators said the pair departed Western Australia in the following days but later returned separately.

Falconer returned to Perth on December 26, according to police, where he hired a vehicle and transported multiple suitcases and jerry cans. Herrmann allegedly met a small aircraft at the Overlander Airstrip on December 27, returning to Perth and meeting Falconer the following day. Police said that the men bought more suitcases, before discarding them along with jerry cans in a shopping centre rubbish bin.

Police said a search of Falconer’s hotel room uncovered about 200kg of cocaine, in six suitcases, as well as electronic devices, night vision goggles and an airband VHF radio. They said they searched Herrmann’s hotel room and seized four empty suitcases, aviation navigational equipment, a hardware cryptocurrency wallet and other electronic devices.

Both men were charged with trafficking a commercial quantity of a controlled drug, which carries a maximum penalty of 25 years’ imprisonment.

Local media reported that Herrmann and Falconer are due to appear in court again in May. 

---

Connor Plunkett, Peter Barth and Beau Donelly contributed to this article.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Bluesky here and Mastodon here.

The post Nowhere to Run: The Online Footprint of an Alleged Kinahan Cartel Associate appeared first on bellingcat.