One takeaway is that much of the content was AI-generated. From the groups & pages profile pictures, cover photos, to the content that was posted, including AI-generated videos and images. A lot of slop, but a lot that hit the right nerves in the current political climates.

The advertising records matter because they provide another attribution trail. I found advertiser and payer information associated with Sri Lankan locations or individuals on some of those ads.

Ads were ran to target Australian and UK audiences to build those pages.

Some of these audiences weren't just grown organically. Meta's Ad Library shows pages buying ads targeted at Australian, British and French users. Some used political or social-issue content while explicitly asking people to like or follow the page.

In the Facebook groups, not only were the Sri Lankan-ran pages (appearing as Australian, British, Canadian, US) posting these meme questions, but also a significant number of Indonesian individuals who were making money through Meta.

A lot of the content follows the same simple formula: - Flags and national symbols - Immigration, Islam or Sharia law - AI-generated or AI-labelled images - Votes for: "👍=Yes” & "😢=No” The aim is almost always to make people react.

Australia Life is even larger, with more than 26,000 members. On 4 August, Facebook showed the group had generated 12.1k posts in the last month

The groups add another layer. “British Lover” has more than 15,000 members. Among its administrators are British Life, UK Talks, Life in USA and AeroLens. All four display Sri Lankan managers in Meta's own transparency records.

This isn't an isolated rename. Ceylon Products → UK Pulse → Canada Pulse Nursing Life → British Life Lanka Astrology → J'aime la France Moments of Netherlands → Moments of Brazil → Moments of Australia

The page adopted the name “Life of Australia” in November 2025. Eight months later it had 42,000+ followers and was helping administer an Australian politics group with more than 26,000 members. Meta lists managers in Australia AND Sri Lanka.

Life of Australia posts heavily about Australian politics, immigration, religion and other posts that are largely driven to get engagement from real people, thinking it's a real page.

I started to first pick through pages like "British Life", a page with 20k followers and the group "Australia Life" with 27k members. I was pretty shocked to see 46 of these pages/groups were ran from Sri Lanka and a lot of AI content that was getting significant traction.

Facebook groups also have features to show who has admin/moderator/expert roles under the people tab.

First, Meta has page and group transparency features made for the purpose of keeping this stuff publicly accountable. By clicking on any Facebook page name, you can see the admin location, if it's public.

Australian and UK Facebook pages & groups are asking thousands of people about immigration, politics and national identity. But they aren't as local as they look. I found 42 pages and 4 groups whose records link them to Sri Lanka. Details 👇🧵

10. Investigation by FRANCE 24 on how Columbian armed groups recruit minors on TikTok. Accounts sold "dream" of money & power. "Hook" accounts work the comments to build trust & contact moves off-platform. Interesting if you're watching recruitment networks. youtube.com/watch?v=wsf4...

9. @osintjobs.bsky.social recently published their OSINT Jobs Assessment platform: with CTF-style scenarios instead of CVs, with ranked and verified results. A better signal of who can actually do the work. assessment.osint-jobs.com

8. After some chaotic weather over the past month in the UK, I spotted lightningmaps.org a free real-time lightning-strike map fusing multiple sensor networks, with a historical view for cross-referencing strikes against other events. Where there is data, there are maps.

7. An AI detector flagged a still of a Moscow refinery strike as generated. BBC Verify found three separate videos of the same strike, geolocated and synced them. The event was real, but images appear to flag as 'generated with OpenAI tools'.

4. Two sanctioned IRISL container ships, BARZIN and HAMOUNA, anchored off Bandar Abbas inside a de facto blockade. By 21 June both had cleared Hormuz with AIS on, bound for China. I broke down how to track them with four free tools.

3. A geolocation case study from Colesto pins the coordinates of a One Piece anime ocean scene using bathymetry, Copernicus wave data, Himawari cloud-matching, AIS and a Blender sun-angle reconstruction. Fictional subject, entirely real method. www.youtube.com/watch?v=eY-W...

2. After an acid attack on Indonesian rights defender Andrie Yunus ended in a military court and light sentences, journalist Aqwam Fiazmi Hanifan turned the CCTV trail into a public news game, so readers could reconstruct the routes the court didn't. jaring.id/interaktif-a...

1. NASA FIRMS showed heat at Russia's Orenburg gas plant after reported drone strikes. But gas plants flare around the clock, and the same pixel lights up every month. The five-minute baseline check that separates a strike from a flare stack is this month's technical teardown.

Hi! I run a monthly newsletter on digital investigations: techniques, developments in the field, and OSINT case studies. I've just published the 10th edition which I am stoked about, and it's a good one. Here are 10 links and helpful hints featured this month 👇🧵

In this tutorial I followed the BARZIN (IMO: 9820269) and HAMOUNA (IMO: 9820271), both under OFAC sanctions. In May they were anchored off the coast of Bandar Abbas. As of yesterday, they have exited the Strait of Hormuz and are in the Arabian Sea on their way to China

Some people have asked me about the basics of ship tracking, so in this open source investigations tutorial, we look at two sanctioned Iranian vessels in the Strait of Hormuz and find where they are and who owns them, all with the power of #OSINT at home. www.youtube.com/watch?v=4-xi...

A single Strava run once gave away the position of an aircraft carrier. With 195M+ users, Strava is one of the largest public location datasets online. So here's a new tutorial on how to find locations on Strava, and the settings that keep your own profile private. 👇

A device in Darfur connected to a Wi-Fi network named "DRONES". A map automates destruction detection across Iran. An investigation tracked stolen Ukrainian grain to Haifa. And: location data and how to shut it down. OSINT Field Notes 8. Out today. osintfieldnotes.substack.com/p/osint-fiel...

Colombian mercenaries were tracked by device data from Colombia to El Fasher, via a UAE base, a Somali compound, and Libya. One device was in El Fasher during the genocidal RSF takeover. It connected to a network named "ATACADOR." Spanish for "attacker." static1.squarespace.com/static/69673...

Honoured to have been on the “Have we reached peak verification?” panel at the @journalismfestival.com with Joanna Webster, @koltai.bsky.social & George Sargeant A technical conversation on where OSINT, deepfakes, disinfo and news verification are, and where they go next. Link 👇