Hi everyone, good to see you back here! 

How did you find last month’s challenges? Ready to dive into more? We’re back with a brand-new series created by a guest contributor that will introduce you to the fascinating world of art crime investigations. 

We’re also looking back at last month’s challenges — highlighting the great blogs and write-ups we’ve received from community members, along with the video walkthroughs created by Sofia Santos. Last month’s contributor also joined our livestream to help Bellingcat researcher Giancarlo Fiorella tackle the challenges — make sure to check it out!

June Challenge - Cultural Confusion

This month the challenges were created by The Association for Research into Crimes against Art (ARCA), a research organisation dedicated to the study of art crime and promotes the protection of cultural heritage. They also develop training programmes and other materials to advance the field, including these challenges! They offer a great introduction to ARCA’s field of work, but please note these challenges are intended for educational purposes only. Want to learn more about their work? Check out their website: https://www.artcrimeresearch.org/ 

The challenges will help you hone open source skills while learning about art, history, and the illicit trade in cultural artefacts. Are you ready to dive in? You’ll find the challenges here. 

Don’t forget to join the #BellingcatChallenge channel on our Discord server — it’s the best place to ask questions and collaborate with others working on the challenge.

This month’s livestream will feature our researcher Carlos Gonzales. Tune in on Wednesday, May 14 at 5 PM CET, to see how a Bellingcat researcher holds up. The stream will be available on our Patreon.

May’s Journey ‘Back in Time’

SPOILER ALERT: From this point on, we’ll be discussing last month’s challenges. If you still plan to complete them, you may want to skip this section.

Final warning, do not read on if you still intend to partake in the previous challenges.

May was Sofia Santos’s month! The Senior OSINT Analyst at the Centre for Information Resilience, is known for creating OSINT challenges — and this time was no exception.

She took us on a trip down memory lane, through Bellingcat founder Eliot Higgins' first media appearances, the creation of our Discord server, and the launch of the original Bellingcat Open Source Toolkit. 

Here are the answers to the ‘Back in Time’ challenges:

1. k7qd4Y6QAfY

2. The Grand Ball Room

3. 68

4. record

5. Explosive

Now we know many of you cracked them, as we received an overwhelming number of write-ups. Thanks to everyone who sent us their blogs and walkthroughs, proving there are many ways to find the right answer.

In the opening challenge, ‘Fresh Faced’, you needed to find the original interview with Eliot Higgins using only an image from a newspaper article. After attempts at reverse image search proved unsuccessful. Blogger Mohamed H. Ahmed turned to some Google dorking, noticing the text in the photo was Croatian. He used keywords like "Eliot Higgins" and "blogger" along with a domain filter (site:.hr). GeoHooper joined Bellingcat’s server and copied its ID to determine the creation date. These steps led to a Croatian news site with a matching article. Both Mohamed and NotFoundSec identified the journalist’s name, Tomislav Krasnec, and used it alongside Eliot Higgins in a YouTube search — successfully locating the interview.

For ‘Training Time’, some key information could be found in the image caption according to Russ Makhauri on Medium. They used the instructor's name (Christiaan Triebert), the date (December 2017), and a mention of the ARIJ Network. These clues helped locate a matching workshop schedule. From there it wasn’t as straightforward as just taking the room from the schedule, as the photo was likely taken in a different room from where the workshop took place. LazyCSE explained in a Youtube walkthrough how they identified the correct room — The Grand Ballroom — by comparing geometric carpet patterns and green wall panels in the rooms listed on the hotel’s website.

In ‘Creating Community’ we asked for the time difference between the creation of Bellingcat’s Discord server and its announcement on Twitter. To find out when a Discord server was created you could follow GeoHooper’s approach of joining the Bellingcat server and copying the server ID. This number is visible when you enable ‘Developer Mode’ in your Discord settings. You can then insert the number on https://discord.id/ to find when the server was created. Marco Dalla Stella took a different route. He used an AI model to generate a script that uses discord.js.org to return a timestamp of the server creation date. Mohamed pointed out to pay attention to the timezones, and used ChatGPT to calculate that the server was created 68 minutes before the tweet was posted. 

For the fourth challenge, ‘Future Plans’, a good starting point was figuring out when Bellingcat registered in the Netherlands. To find the document outlining future plans around that time, Mohamed searched Google with the keyword "future" and restricted his search to the bellingcat website and for PDF files (“future” site:bellingcat.com filetype:pdf). This surfaced the ‘Policy Plan 2019-2021’. To find out who made the file, a metadata viewer (check our toolkit!) revealed the document was created by Aric Toler. GeoHooper then manually searched for articles by Aric around that date and picked out the final word of one such article — which turned out to be the answer.

The fifth and final challenge involved finding a specific 2020 version of the Bellingcat toolkit PDF. GeoHooper found the correct version by searching for ‘Bellingcat Online Investigation Toolkit’ with a custom date range of January 1 to December 31, 2020. A tweet posted by Bellingcat included an image with the exact filename of the 2020 version of the toolkit. 

Searching Google using that filename led them to the correct PDF where they found the missing file on page 39.  Marco Dalla Stella also noted that the file had since been taken down. They used the Wayback Machine to recover the original file — revealing the correct answer: ‘explosive’.

Curious to see how our researcher Giancarlo Fiorella tackled these challenges? Check out last month’s livestream here:

And don’t miss Sofia’s YouTube channel for even more walkthroughs. She creates amazing videos explaining her approach and highlighting many more creative methods.

Tips from Bellingcat’s Toolkit Team

Our Toolkit Volunteer Afton took a good look at last month’s challenge and came up with some useful tools. Many of the exercises in the series returned to the fundamentals of Google dorking. If you are new to Google dorking, the tool Search Whisperer is useful for helping you create targeted combinations of search terms. This tool also helps you refine and improve your search queries. And for the ‘Creating Community’ exercise, a tool like Vodact helps you identify a channel's Discord ID and find the creation date of a server. Make sure to check our toolkit to learn more.

That’s it for this month’s Bellingcat Challenge newsletter. We’d love to hear your feedback on the challenges. Join us on Discord and let us know what you thought — and feel free to share the newsletter with friends. 

If someone forwarded this to you and you’d like to subscribe, you can do that here.

Elsewhere on Bellingcat

Before we go, here are some links to other exciting projects from Bellingcat:

• Pigeon Shoots and Hitmen: New Leads in a Texas Oilman’s Cold Case

• India-Pakistan Conflict: How a Deepfake Video Made it Mainstream

• Unmasking MrDeepFakes: Canadian Pharmacist Linked to World’s Most Notorious Deepfake Porn Site

• Open Sources Show Myanmar Junta Airstrike Damages Despite Post-Earthquake Ceasefire

See you next month!