Cyrillic Confusion: Tracing the Yi Peng 3 Port Log Back to Its Source

Title: Cyrillic Confusion (Bellingcat Challenge, Maritime Mysteries series)

Description: In November 2024, two underwater data cables in the Baltic Sea experienced faults, disrupting communications between European nations and igniting suspicions of sabotage. A Chinese cargo vessel, the YUI PENG 3, quickly became a focus for both investigators and the online open source research community. Some mistakenly suggested that a port log showed the vessel’s captain was Russian (confusing a temporary harbor pilot with the ship’s captain). A key question emerged: could the authenticity of the log be verified?

Question: What is the original URL for this log? (don’t include the ‘http://’ or ‘https://’)

The answer, up front: the log is a page on the vessel-movement system of the Russian Baltic seaports administration, for vessel call 165759 in the port of Ust-Luga. The page itself no longer loads outside Russia, but the Wayback Machine captured it on 20 November 2024, five days after the ship left port, and the archived copy matches the screenshot row for row.

skap.pasp.ru/Move/InOutMoveList/165759?harb=UL

The route is four hops: Lens finds where the screenshot circulated, a forum post gives a name in Cyrillic, Yandex turns that name into the source URL, and the Wayback Machine proves the page existed.

The whole brief: an English rendering of a Russian log. No URL bar, no logo, no source.

Step 1: What the screenshot gives you

There’s no browser chrome and no site header, so the URL has to be found, not read. What the table does contain:

• A vessel call number, 165759. The kind of ID that ends up in a URL.
• The ship name as YUI PENG 3. The ship is registered as Yi Peng 3. “YUI” is what you get when the Cyrillic ЮИ ПЕНГ is transliterated back into Latin letters. That’s the confusion in the title, and it’s a hint: the original is in Russian.
• Port codes B1 UL, UMAR3, Yak 11A. UL is Ust-Luga, where the Yi Peng 3 loaded in November 2024; Yak is short for якорная стоянка, anchorage.
• A “Pilot” column with four names, Stechentsev A.E. on the last two rows, the move out to SEA. That’s the pilot who took the ship out of the harbour, and the person some people took for the captain.

The English is clearly machine-translated (“Osvart. at the pier” is the abbreviation ошварт., moored, left half-translated). So searching the English wording verbatim won’t find the source. The original page has Cyrillic text.

Step 2: Google Lens, where the screenshot circulated

Google Lens on the whole image. The top visual matches are the Bellingcat challenge itself and other writeups, which are useless, but one hit is a German tech forum:

ComputerBase: a forum thread on the damaged cables, with the same table. That’s someone who posted it in November 2024, not someone solving the challenge.

Step 3: ComputerBase, the name in Cyrillic

The hit leads to page 6 of the ComputerBase thread on the cable damage, post #118 of 20 November 2024. A user posts the same table and a classification-register entry, and names the pilot as the “captain”, in Latin and Cyrillic:

“Kapitän Stechentsev Alexander Evgenievich (Стеченцев Александр Евгеньевич)”. The post repeats the mistake from the brief, but it hands over the name in the script the source uses.

The post itself doesn’t link the log. What it gives is the search term: Стеченцев Александр. A Russian port page will have the name in Cyrillic, and the Latin spellings vary (Stechentsev, Stetentsev, Stezentsev all turn up in the press), so the Cyrillic is the stable key.

How sure? It’s only a lead. The forum poster could have got the screenshot from anywhere. The test is whether a search with the Cyrillic name finds a page with the same table.

Step 4: Yandex, the Cyrillic name plus the ship

Russian pages are indexed far better by Yandex than by Google. The query combines the Cyrillic name with the ship as it appears in the log:

Стеченцев Александр yui peng 3

Fourth result: skap.pasp.ru, path Move/InOutMoveList/165759, and a snippet that is the log’s own header and first row.

The first three results are coverage of the “Russian captain” story (Echo FM, The Insider, a VK post quoting the leak). The fourth is the source: skap.pasp.ru, with the vessel call number 165759 in the path. pasp.ru is the domain of ФГБУ «АМП Балтийского моря», the state administration of Russia’s Baltic seaports, and the snippet (“Movement of the vessel YUI PENG 3 in ship call No. 165759 … B1 UL. He went to the entrance.”) is the first row of the challenge table.

Don’t copy the URL from the result text. Yandex displays it as 165759? harb=UL, with a space. Right-click the link and use Copy Link; that gives the real URL:

The display text is formatted for reading. The link behind it is the actual URL.

https://skap.pasp.ru/Move/InOutMoveList/165759?harb=UL

Step 5: Dead end, the live page

Clicking through doesn’t work. Yandex bounces the browser to an interstitial:

“The site doesn’t open in this browser”: skap.pasp.ru uses a Russian state TLS certificate that normal browsers don’t trust.

The page might work in Yandex Browser or with the Russian root certificate installed, but that’s not needed. The question is whether the page existed, and that’s what archives are for. archive.ph had no capture of the URL.

Step 6: The Wayback Machine has it

The copied URL goes into the Wayback Machine:

Three captures, the first on 20 November 2024.

Captures in 2025 on 23 February and 21 December. The earliest is in the 2024 calendar.

The CDX API lists all of them:

The first capture is from the evening of 20 November 2024, the same day as the ComputerBase post, and five days after the last row of the log.

Step 7: Verifying the log against the archive

The archived page is in Russian. Opened with the browser’s translation, the wording is different from the challenge image, sometimes wildly:

Top: the challenge. Bottom: the Wayback capture, auto-translated. The words differ, the data doesn’t: same eight times, same four pilots, same record numbers 494677 to 496237.

The translation is noise: “Pilot” becomes “Lotzman”, “Part No.” becomes “No zap.”, the ship becomes “SUI PENG”. That’s the second layer of the Cyrillic confusion. What carries the match is everything a translator leaves alone: timestamps, initials and record numbers. I also pulled the raw HTML of both 200 captures and compared the Cyrillic directly:

All eight rows match on time, point, pilot and record number, and the December 2025 capture is identical to the November 2024 one.

It also settles the captain question. The column is Лоцман, the harbour pilot who comes aboard to take a ship in or out of port. Stechentsev is listed only for the two moves from the anchorage to the sea on 15 November. The ship’s captain doesn’t appear in this log at all.

Verification

Three confirmations, none of them the same source twice:

1. Content. The archived page and the challenge image agree on all eight timestamps, all four pilots and all eight record numbers (494677 to 496237). Those are the fields a translator can’t change and a forger would have had to copy exactly.
2. Time. The Internet Archive captured the page on 20 November 2024, five days after the last row and independently of anyone posting the screenshot. The forum post on ComputerBase is from the same day and shows the same table, so the log was circulating while the page was still live on the port authority’s server.
3. Origin. The domain is the Russian Baltic seaports administration’s own (pasp.ru), the path carries the vessel call number from the screenshot’s title, and harb=UL is the port the table’s codes point to (B1 UL).

The moment of certainty is the record-number column. Eight six-digit sequence numbers in the right order aren’t something two independent pages share by chance.

The alternative, excluded. The Wayback CDX lists a second variant of the URL:

skap.pasp.ru/Move/InOutMoveList/165759?harb=UL&ref=epinardscaramel.eu

It’s the same page. Its January 2025 capture has the same content digest (QJUUNT6L…) as the November 2024 one. The ref= parameter is a referral tag added by a site that linked to the log, not part of the port authority’s URL. It first appears on 13 January 2025, two months after the original, and the address Yandex indexed carries no such tag. The original URL is the one without it. The http:// and https:// captures differ only in protocol, which the question tells you to leave out.

Answer

skap.pasp.ru/Move/InOutMoveList/165759?harb=UL

Takeaways

• A translated screenshot hides its source language. Find it and search in it. Here the transliteration “YUI” gave away the Cyrillic original, and the Cyrillic name was the key that the Latin spellings weren’t.
• Reverse image search finds the people who shared it, not the source. A forum post from the week of the event isn’t the answer, but it can carry the one detail (a name in the original script) that the screenshot lacks.
• Use the search engine of the source’s country. Yandex indexed skap.pasp.ru; the Latin-script coverage on Google just repeats the story.
• Copy the link, not the display text. Search result URLs are formatted for reading; Yandex showed a space that isn’t in the URL.
• A dead page still has a past. If one archive has nothing, try the next. The Wayback CDX API lists every capture with its timestamp, which is also your proof of when the page existed.
• Verify on what translation can’t change. Numbers, times and initials survive any translator. Words don’t.

Sources

• Bellingcat Challenge 8: Cyrillic Confusion
• Google Lens, visual matches for the log screenshot
• ComputerBase forum thread, page 6, post #118, 20 November 2024
• Yandex, query Стеченцев Александр yui peng 3
• Wayback Machine capture, 20 November 2024
• Wayback Machine capture, 21 December 2025
• Wayback CDX listing for the URL