YouTube OSINT Deep Dive: Extracting Geolocation, Metadata & Intelligence from Video Platforms + Video

By /

Listen to this Post

Featured Image

Introduction:

YouTube has evolved far beyond a simple video-sharing platform—it is now one of the richest open-source intelligence (OSINT) repositories available to security analysts, threat researchers, and digital investigators. Every video upload carries a wealth of metadata, including view counts, timestamps, channel information, tags, and—crucially for SOCMINT operations—optional geolocation data that can pinpoint where content was recorded. However, YouTube strips most EXIF metadata upon upload, making manual extraction a tedious and often fruitless exercise. This is where dedicated OSINT tools like YouTube Lookup and MW Metadata come into play, leveraging the YouTube Data API v3 to systematically pull and interpret available metadata for investigative purposes.

Learning Objectives:

  • Master the use of YouTube OSINT tools to extract video statistics, channel information, and geolocation data for threat intelligence and SOCMINT investigations.
  • Understand the technical limitations of YouTube’s geotagging system and how to distinguish between user-supplied location data and derived intelligence.
  • Learn practical command-line and web-based techniques to automate metadata collection, perform bulk analysis, and integrate YouTube OSINT into broader cybersecurity workflows.

1. YouTube Lookup: Extracting Metadata and Geolocation Data

YouTube Lookup is a lightweight web-based tool designed to pull metadata from any YouTube video using the platform’s public API. The tool retrieves video statistics (viewCount, likeCount, commentCount), content details (duration, definition, caption availability), and—if the uploader has enabled it—geolocation data including latitude, longitude, and a direct Google Maps link.

Step-by-Step Guide:

  1. Access the Tool: Navigate to `https://youtube-lookup.vercel.app/`. The interface is optimized for Chrome, Edge, and Safari browsers.

  2. Input the Video URL or ID: Paste the full YouTube video URL (e.g., `https://www.youtube.com/watch?v=VIDEO_ID`) or the video ID itself into the input field.

  3. Trigger the Lookup: The tool processes the request and retrieves metadata from the YouTube API. Note that it may take up to five seconds to return results.

  4. Analyze the Output: The tool displays results across several categories:

– Snippet Details: Video title, published date, channel name, channel ID, and video tags.
– Statistics Details: View count, like count, favorite count, and comment count.
– Status Details: Embeddable status, license, privacy status, and upload status.
– Content Details: Caption availability, video definition, dimensions, duration, and licensed content indicators.
– Geolocation Details: Location name, latitude, longitude, altitude, and a direct Map Link.

  1. Interpret the Geolocation Data: If the uploader manually added a location during upload, the tool will display it. If the field shows “n/a,” the video was not geotagged.

Linux/Windows Command-Line Alternative (Using `yt-dlp`):

For investigators who prefer command-line tools, `yt-dlp` can extract similar metadata:

 Install yt-dlp (Linux/macOS)
pip install yt-dlp

Extract metadata in JSON format
yt-dlp -j "https://www.youtube.com/watch?v=VIDEO_ID" | jq '.'

The JSON output includes fields such as upload_date, view_count, like_count, channel_id, and `location` (if available). Use `jq` to filter specific fields:

yt-dlp -j "https://www.youtube.com/watch?v=VIDEO_ID" | jq '{title, upload_date, view_count, location}'

On Windows (PowerShell), the equivalent approach uses `ConvertFrom-Json` after retrieving the metadata.

2. MW Metadata: Bulk Analysis and Investigative Features

MW Metadata, developed by Matt Wright, is a more comprehensive tool that extends beyond single-video lookups. It supports bulk analysis of playlists and channels, making it invaluable for large-scale OSINT investigations.

Step-by-Step Guide:

  1. Access MW Metadata: Visit https://mattw.io/youtube-metadata/` or the bulk endpoint athttps://mattw.io/youtube-metadata/bulk`.

  2. Single Video Lookup: Enter a video URL to retrieve all available metadata, including auto-translations of language and country codes, and a direct Google Maps link for geotagged content.

  3. Bulk Playlist/Channel Analysis: Enter a playlist ID or channel ID to retrieve metadata for all videos within that playlist or channel. This is particularly useful for:

– Profiling a content creator’s entire library.
– Identifying patterns in upload behavior and geolocation.
– Archiving video and channel data that may disappear.

  1. Reverse Image Search: The tool provides a reverse image search feature for video thumbnails, helping to verify the authenticity and origin of content.

  2. Export and Import: Save metadata as a ZIP archive containing raw JSON data from the API and CSV tables for further analysis. Import the ZIP later to view the data within the tool.

  3. Finding Private/Deleted Videos: The tool queries Filmot to check if it has archived data for private or deleted videos, and provides links to Archive.org, SocialBlade, and other resources.

Python Script for Automated Bulk Extraction:

For investigators who need programmatic access, the YouTube Data API v3 can be used directly:

from googleapiclient.discovery import build

API_KEY = "YOUR_API_KEY"
youtube = build("youtube", "v3", developerKey=API_KEY)

def get_video_metadata(video_id):
request = youtube.videos().list(
part="snippet,statistics,contentDetails,status",
id=video_id
)
response = request.execute()
return response

Example usage
metadata = get_video_metadata("VIDEO_ID")
print(metadata)

This script retrieves all metadata parts available through the API, including geolocation if present.

3. MW Geofind: Geolocation-Centric Video Discovery

MW Geofind is a specialized tool designed specifically for finding YouTube videos tagged with a geographical location. It is an essential resource for SOCMINT analysts tracking events by location.

Step-by-Step Guide:

  1. Access MW Geofind: Visit the tool via Bellingcat’s toolkit or directly.

  2. Search by Keywords: Enter keywords related to your investigation. Use YouTube’s keyword operators to refine searches.

  3. Search by Location: Enter a location name or coordinates. Set a search radius between 1 and 1000 kilometers to narrow results.

  4. Filter by Timeframe: Filter results by “past hour,” “past 30 days,” or custom ranges.

  5. Visualize on Map: Results are automatically displayed on an interactive map, with icons representing video locations. Click an icon to view the video title, channel, and other details.

  6. View Metadata: Scroll to the search results and click “View metadata” to open MW Metadata – Bulk in a new tab, displaying detailed JSON data including upload date, geotag, view counts, likes, favorites, and comments.

Understanding YouTube Geotags:

Geotags on YouTube are manually set by video creators during upload, not derived from EXIF data. This has critical implications for investigators:
– Geotags are optional and can be left blank.
– Creators can intentionally enter inaccurate locations.
– The same coordinates can refer to multiple locations (e.g., “Manhattan, New York” and “United States” may share coordinates).
– Geotagging influences YouTube’s location-based recommendations and ad targeting.

4. Amnesty International’s YouTube DataViewer: Verification and Authenticity

Amnesty International’s YouTube DataViewer is a powerful tool for verifying video authenticity, particularly useful for human rights documentation and fact-checking.

Step-by-Step Guide:

  1. Access the Tool: Visit `https://radar.ircai.org/en/tools/youtube-dataviewer-by-amnesty-international/`.

  2. Enter Video URL: Paste the YouTube video URL into the input field.

  3. Extract Metadata: The tool retrieves all available metadata, including upload date, channel information, and view statistics.

  4. View Thumbnail: The tool displays the video’s thumbnail image.

  5. Conduct Reverse Image Search: Perform a reverse image search on the thumbnail to trace the origin of the content and verify its authenticity.

  6. Document Evidence: Export or document the findings for use in reports, legal proceedings, or human rights documentation.

5. Integrating YouTube OSINT into Cybersecurity Workflows

YouTube OSINT is not limited to investigative journalism—it has direct applications in cybersecurity, threat intelligence, and SOC operations.

Use Cases:

  • Threat Actor Profiling: Extract channel metadata to profile threat actors who use YouTube for propaganda, recruitment, or operational security (OPSEC) failures.
  • Incident Geolocation: Use geotagged videos to verify the location of cyber incidents, physical breaches, or geopolitical events.
  • Social Media Intelligence (SOCMINT): Monitor YouTube for mentions of your organization, brand, or key personnel.
  • OSINT Automation: Integrate YouTube metadata extraction into larger OSINT frameworks using Python scripts and the YouTube Data API.

API Key Setup for Automated Extraction:

To use the YouTube Data API v3 programmatically:

1. Go to the Google Developers Console.

  1. Create a new project or select an existing one.

3. Enable the YouTube Data API v3.

4. Create credentials (API Key) for your application.

  1. Use the API key in your scripts as shown in Section 2.

Rate Limiting Considerations: The YouTube Data API has usage quotas (10,000 units per day). Each `videos().list()` request costs 1 unit, so plan bulk operations accordingly.

What Undercode Say:

  • Key Takeaway 1: YouTube’s geolocation data is entirely user-supplied and should never be treated as definitive proof of location without additional verification. Cross-reference with other OSINT sources, including reverse image searches, EXIF data from other platforms, and geospatial analysis tools.

  • Key Takeaway 2: Tools like YouTube Lookup, MW Metadata, and MW Geofind are force multipliers for SOCMINT investigations. They transform YouTube from a passive content platform into an active intelligence source, but their effectiveness depends on the investigator’s ability to interpret metadata critically and combine it with other intelligence streams.

Analysis: The landscape of YouTube OSINT is rapidly evolving. While YouTube’s API provides structured access to metadata, the platform’s policies restrict bulk exports and limit certain data fields. Investigators must therefore rely on a combination of web-based tools, command-line utilities, and custom scripts to achieve comprehensive coverage. The rise of AI-powered video analysis and automated metadata extraction (as seen in tools like OpenClaw and social-media-scraper-skill) points toward a future where OSINT investigations become increasingly automated and scalable. However, the human element—critical thinking, contextual awareness, and verification—remains irreplaceable.

Prediction:

  • +1 The continued development of OSINT tools tailored to video platforms will democratize access to intelligence, enabling smaller security teams and independent researchers to conduct investigations previously possible only for nation-states or large enterprises.

  • +1 Integration of YouTube OSINT with AI-driven analytics will enable real-time threat detection, automated pattern recognition, and predictive intelligence, significantly enhancing SOC capabilities.

  • -1 As OSINT tools become more accessible, threat actors will increasingly adopt countermeasures, including deliberate geotagging inaccuracies, metadata stripping, and OPSEC-aware content strategies, reducing the reliability of platform-derived intelligence.

  • -1 YouTube’s evolving privacy policies and API restrictions may further limit metadata availability, forcing investigators to rely on scraping techniques that carry legal and ethical risks, potentially chilling legitimate OSINT research.

▶️ Related Video (84% Match):

https://www.youtube.com/watch?v=6Udw3mxMRCE

🎯Let’s Practice For Free:

🎓 Live Courses & Certifications:

Join Undercode Academy for Verified Certifications

🚀 Request a Custom Project:

Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands

IT/Security Reporter URL:

Reported By: Mariosantella Osint – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅

🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]

💬 Whatsapp | 💬 Telegram

📢 Follow UndercodeTesting & Stay Tuned:

𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky

Related Posts: