sitmap.live

Methodology: how sitmap.live works

What is sitmap.live?

An unofficial open-source intelligence (OSINT) map of conflict reporting in the Middle East, built from public posts. It is not a news service, and nothing on it is confirmed by its makers.

Where do the reports come from?

Public news feeds, Telegram channels, X accounts, crowd reports and official records such as Israel's Home Front Command siren alerts, airspace notices (NOTAMs) and UKMTO maritime notices. Every event links to the reports behind it.

How are reports processed?

An automated pipeline sets aside posts that are not about the conflict, groups the reports of one incident into an event, and writes its title and summary with the help of an AI model. Sirens, airspace notices and other official records are used as they are. Titles, summaries, places and times can contain mistakes: open the linked reports before relying on anything.

What do the verification states mean?

Confirmed: two or more independent origins agree and a neutral body or an authority's own record confirms it, or a party admits it against its own interest; or it is the authority's own notice. A party's claims about its own strikes, its interceptions or the enemy's losses never confirm. Corroborated: two or more independent origins agree. Single source: one credible source so far. Unverified: no credible or independent source yet, the norm for fresh reports. Disputed: sources contradict each other. Debunked: judged false or misattributed, kept for the record. A state says how well sourced a report is, not how true it is, and casualty figures are always shown as reported by someone, never as verified.

Who sets an event's verification state?

Rules, from the number of independent origins (reposts of one origin count once) and any official confirmation. An automated review can lower that state, which is what marks an event disputed or debunked, or add a warning; it never raises it.

What does "Details by origin" show?

For an event with more than one origin, each detail its reports give (what happened, the place, the time, who did it, the target, casualty figures), the independent origins that reported each value, and a status per value from the same rules as the event. A casualty figure counts who it is attributed to, so two outlets quoting one ministry are one source for it. "Reports differ" means two origins gave values that cannot both be true; it is about that detail, not about whether the incident happened. A higher figure reported later is an update, not a disagreement. No detail reads as corroborated while the event does not. The table counts reports, is not a measure of accuracy, and does not change the event's status or its place on the map.

Does a siren alert mean something was hit?

No. A siren is an official warning, not a confirmed impact. A confirmed siren alert means only that the alert sounded: it is labelled "Official alert issued", and siren markers are never drawn stronger than single source.

How are events placed on the map?

Places are matched with a gazetteer (GeoNames, OCHA's Gaza neighbourhoods and a curated list) and, for airports, ports, energy sites and military bases, with reference data from OurAirports, Wikidata and the NGA World Port Index. Some points are estimated from the place name or mark only an area's centre; their markers have a dashed edge. A point is never more exact than the report behind it.

How are mistakes corrected?

States change as reports arrive: an event moves up when independent origins agree, and down when sources contradict each other or a report is judged false. Events judged out of scope are withdrawn. The corrections page lists what is marked disputed or debunked, how recent events stand by state, and every recorded change of state.

How often is it updated?

Continuously: sources are read every few minutes and official siren alerts within about a minute, and events change as new reports arrive. Times are kept in UTC; a time stated in a report can be wrong, and when a report gives none, the time it was first seen is used.

How is internet connectivity measured?

From Cloudflare Radar's data. Each hour, the traffic from each country of the region to Cloudflare's network is compared with the same hour 7 days earlier. 80% of usual or more reads near usual, 50 to 80% reduced, 15 to 50% a severe drop, and under 15% a near-total drop. A country's status changes only after two hours in a row at the new level, so one odd hour changes nothing. There is no reading when Radar has too little data for the country, when the same hour a week earlier was itself far below usual, or when the newest data is more than 3 hours old; no reading is never shown as normal. The measurement says that less traffic reached Cloudflare, not why: power cuts lower it too, VPNs move it to where their exits are, holidays can show as reduced, and Gaza and the West Bank are one reading. Reports of internet disruptions, from NetBlocks, news outlets and Cloudflare Radar's outage records, are events like any other, with their own verification state. Data: Cloudflare Radar, CC BY-NC 4.0; sitmap.live computes the share of usual.

Can I use the data?

Yes. The events are served as GeoJSON at /api/events.geojson, one event with its reports at /api/events/<id>, and the corrections at /api/corrections, with no account. Each event carries its state, its times in UTC, its place and its report links. Internet data at /api/internet.json is derived from Cloudflare Radar's, under CC BY-NC 4.0: non-commercial use, with attribution to Cloudflare Radar.

Contact

On X: @Sitmap_live. By email: hi@sitmap.live.

Live map · Corrections · Sources