What happened to SondeHub, the weather balloon tracking service whose domain name was acquired as a joke but was unexpectedly used in war?

'SondeHub,' a website that tracks weather balloons, originally started as a joke domain that simply redirected users to another site. However, it has grown into a service with its own tracking and prediction capabilities, and its operators have revealed that it is now being used to locate military facilities and predict the paths of flying objects in Ukraine.

How a joke domain purchase turned into geopolitical warfare

https://sprocketfox.io/xssfox/2026/08/19/sondehub-and-war/

Meteorological agencies launch weather balloons to study the temperature, humidity, atmospheric pressure, and wind in the upper atmosphere. These balloons are equipped with small observation instruments called 'radiosondes,' and by tracking their position using GPS and other technologies, wind direction and speed in the upper atmosphere can also be determined.

The operators of SondeHub began tracking weather balloons around 2017. At the time, they were using 'Habhub,' a site for high-altitude balloons, but as the number of weather radiosondes tracked on Habhub increased, it stopped displaying them by default. So in 2018, they acquired 'sondehub.org' and created a system to redirect to Habhub with the setting to display radiosondes. According to the operators, they didn't intend to create a full-fledged service and acquired the domain 'almost as a joke.'

However, as the number of tracked balloons increased, the load on Habhub grew, so SondeHub began saving observation data independently and added a flight path prediction function. Furthermore, they developed 'reverse predictions' that estimate the launch site by working backward from the radiosonde in flight. While this is useful for finding unrecorded launch sites, in 2021 it even pinpointed military facilities, leading to requests to not explicitly mark these facilities on maps.

Subsequently, starting around December 2024, there were repeated instances of massive access to the flight path prediction API.

To investigate the source of the massive traffic, the site administrators plotted the locations they were asked to predict on a map, revealing numerous points concentrated around Ukraine and Russia. The following are just a few examples.

When the administrators attempted to contact those involved, they discovered that some groups on the Ukrainian side might be using SondeHub to direct flying objects towards their target areas by utilizing wind. Simply blocking the large volume of access could have serious consequences for users, so the administrators quickly prepared an environment where users could run the prediction system themselves without connecting to SondeHub.

Thus, what started as a simple forwarding destination, sondehub.org, became a predictive system potentially used on the battlefield a few years later, and in 2025, it even received a data request from U.S. military authorities. While SondeHub sometimes provides data for free if the request is also useful to the local community, it charged a fee for the military request, arguing that it could not expect any benefit to the community. However, the operators say that the invoice was never paid and there was no follow-up on the request.

The operators stated that they did not include all the communications they had received from government agencies and other organizations over the years, and that they may release a 'Part 2' in the future.