> For the complete documentation index, see [llms.txt](https://tools.osintnewsletter.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://tools.osintnewsletter.com/osint-tools/russian-aggression-incident-log.md). # Russian Aggression Incident Log Tool Description: Situational Awareness web app to monitor, log, and analyse Russian grey-zone warfare, hybrid threats, and airspace or maritime incursions across European & NATO member states. | **Russian Aggression Incident Log** | **Quick Overview** | | ----------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | URL | | | What it does | Maps verified Russian aggression incidents and correlates them with critical European / NATO infrastructure. | | How to use it | Search by keyword or incident type, analyse spatial patterns across interactive tactical layers, scrub the timeline replay, and generate exportable intelligence briefs. | | Cost | Free. | | Account required | No. | | Cookies | Mainly associated with Google services plus one PostHog analytics cookie set by the site itself. | | Ownership | Not publicly disclosed. | | Use in Reporting | Useful for incident discovery, timelines and generating leads for further investigation. | ### What does Russian Aggression Incident Log do? Russian Aggression Incident Log provides four dedicated views to investigate Russian hybrid operations: an Incident Log of verified events (cable disruptions, GPS jamming, drone incursions), a Tactical Map with toggleable overlays for tracked spy ships (Yantar), shadow tankers, and subsea pipelines, and vessel Dossiers. An Intelligence Analytics dashboard visualises monthly incident frequency trends, category breakdowns, and geographic NATO front distributions using interactive charts. Built-in AI generates automated SITREP briefings detailing current escalation risks and tactical patterns, while a natural-language AI search bar lets you ask questions to uncover timelines, correlations, and specific threat actors across the entire database. **The lowdown:** The site provides a structured timeline of reported incidents involving Russian hostile activity towards NATO countries and partners. ### How to Use: **1. Browse the incident log for live alerts or enter a keyword/phrase into the search bar to locate events.** **You can filter by severity, domains (air, maritime, land etc), or prompt the AI search bar for instant intelligence summaries.** **2. Open the relevant incident and record the incident ID, date, location, category and description.** **3. Use the information as a research lead and verify the incident against the underlying primary sources and reputable reporting before publication.** ### Cost * [x] Free * [ ] Partially Free * [ ] Paid ## Data Processing ### Account Required: * [ ] Yes * [x] No ### Cookies: Cookies are mainly associated with Google services plus one PostHog analytics cookie set by the site itself. ### Use in Reporting **Russian Aggression Incident Log can be used to:** * Locate reported examples of Russian military, political, cyber, maritime, air and hybrid activity. * Establish chronological sequences of incidents involving a particular country or region. * Generate investigative leads. * Compare incident descriptions with official statements from governments, defence ministries and NATO. * Examine recurring activity across countries, dates and incident categories. * Provide a starting point for conflict, security and geopolitical investigations. **Real-World Investigation Examples Tracked in the Tool:** * **Baltic Subsea Cable Severing (Yi Peng 3 / C-Lion1 & BCS Cables, Nov 2024)** Application: Cross-referencing subsea fiber coordinates (Finland–Germany C-Lion1 and Sweden–Lithuania BCS cables) against the track of Chinese-flagged bulk carrier Yi Peng 3 departing Ust-Luga, Russia with Russian crew members on board. Reference Reporting: Financial Times: Chinese ship probed over severed Baltic seabed cables | Reuters Investigation
* **The Balticconnector Pipeline & Telecom Ruptures (Newnew Polar Bear, Oct 2023)** Application: Tracking spatial intersections between underwater gas infrastructure in the Gulf of Finland and anchor-dragging commercial vessels loitering in Russian-adjacent corridors. Reference Reporting: Yle News: Finnish police confirm anchor damage to Balticconnector
* **Baltic & Nordic GNSS Jamming Epidemic ("Baltic Jammer", 2023–Present)** Application: Mapping GPS signal degradation clusters affecting thousands of commercial flights and civilian vessels across Poland, the Baltics, and southern Sweden, traced back to electronic warfare arrays in Kaliningrad. Reference Reporting: Bellingcat / The Guardian: Baltic GPS jamming surge * **Russian GUGI Spy Ship Loitering (Yantar & Admiral Vladimirsky, 2022–2024)** Application: Mapping hydrographic research and "special purpose" Russian vessels equipped with deep-sea submersibles loitering over North Sea wind farms and Irish Sea trans-Atlantic internet cables. Reference Reporting: DR / SVT / NRK Nordic Public Broadcasters: "The Russian Spy Ships / Shadow War" Joint Investigation * **Danube Delta Drone Incursions (Romania & Moldova, 2023–2024)** Application: Logging Shahed-136 drone wreckage and border violations adjacent to Ukrainian Izmail and Reni ports to document NATO border spillover frequency. Reference Reporting: Radio Free Europe / Digi24: Russian drone debris on Romanian territory. | **Capabilities** | **Limitations** | | ------------------------------------------------------ | -------------------------------------------------------------------------------------- | | Interactive map tracking verified hybrid incidents. | Relies on unclassified open sources rather than classified radar. | | Tactical overlays for cables and vessels. | Regional focus constrained to European and NATO theater boundaries. | | Baltic and Arctic GNSS jamming visualizer. | Attribution delayed by formal forensic and maritime investigation timelines. | | Chronological timeline replay and month scrubber. | AI-generated intelligence briefs require analyst verification against primary sources. | | AI-powered threat analysis and escalation assessments. | Infrastructure overlays represent tactical schematics not certified nautical charts. | | Natural-language AI intelligence search query. |


| | Visual analytics charts tracking incident trends. |


| | One-click CSV and JSON data export. |


| ### Summary Russian Aggression Incident Log’s main value is in helping investigators quickly find incidents, construct timelines, and generate leads that can then be verified through primary and reputable secondary sources. It fits best within the collection, discovery and analysis stages of the OSINT workflow and should therefore generally be regarded as a lead-generation and cross-referencing resource rather than a standalone evidential source. ### Ownership The platform describes itself as an independent OSINT intelligence feed. Ownership is not clearly identified publicly. ### Ethical Considerations * Do not assume that an incident's classification establishes Russian responsibility. * Check original sources and use primary documentation wherever possible. * Clearly identify whether information comes from an underlying source or the database's own interpretation. * Keep the incident ID, URL, access date and original sources used during verification. * Do not republish personal or operationally sensitive information without a legitimate reporting reason. * Consider source bias by taking the site's stated purpose and editorial approach into account when assessing its categorisations. ### Related Tools: * ACLED * Recorded Future * Janes Threat Intelligence * Grey Dynamics * Crisis24 * Castellum.AI #### Sources
*With thanks to the community for submitting this tool to the OSINT Tool Library.*