OSINT Tips: Filtering tweets by Geographical metadata

movq %rax,%rax
3 min readOct 12, 2020

--

When working with Tweet data, there are two classes of geographical metadata, you can use the following search to find any media-items tagged with a specific GPS location

  • Tweet location — Available when user shares location at time of Tweet.
  • Account Location — Based on the ‘home’ location provided by user in their public profile. This is a free-form character field and may or may not contain metadata that can be geo-referenced.

Important Notes: Geographical coordinates are provided in the [LONG, LAT] order. The one exception is the deprecated ‘geo’ attribute, which has the reverse [LAT, LONG] order. All PowerTrack Geo-Operators expect coordinates in the [LONG, LAT] order.

Usage examples:

  • Geo-tagged Tweets associated with abortion in a given region and possible Whatsapp numbers:

For example; if you want to search for tweets within a 10km radius , this is what the search would look like.

geocode:-23.555488,-46.600370,10km url:wa.me “Gravidez”

  • geocode = geolocation
  • radius = determine a radius based on the region
  • url = determine possible URL’s with this limitation

The result informs us of possible profiles associated with the sale of material and begging used to perform abortions during pregnancy. Checking in the posts of this profile, the individual reports a possible sale of medication to perform abortion in unwanted pregnancies, followed by a shortened url containing your Whatsapp

Select ‘Latest’ if you’re interested in the most recent tweets. Interested in a specific date? Click on the three-dot-menu right from the search bar and select ‘Advanced search’ to fill in an exacte date. Use Advanced Search to find the latest news and world events faster. Find popular people, hashtags and photos for any topic you can imagine.

Others related options:

  • geocode:-23.555488,-46.600370,10km url:wa.me filter:media
  • geocode:-23.555488,-46.600370,20km url:wa.me “Drogas”
  • geocode:-23.555488,-46.600370,40km url:fb.me “Gravidez”
  • geocode:-23.555488,-46.600370,50km (wa.me OR fb.me) “Hacked”
  • geocode:-23.555488,-46.600370,50km (wa.me OR fb.me) “Fake news”
  • geocode:-23.555488,-46.600370,50km url:wa.me until:2020–08–01
  • geocode:-23.555488,-46.600370,50km filter:links

Obs: filter types: url, image, links, media and more.

Reference:

--

--

movq %rax,%rax

reverse engineering and malware tales\\ Linkedin@isdebuggerpresent\\