Last night a 15-year-old tanker that had not squawked on AIS for three days popped up on a private satellite pass drifting 30 nm off Iran’s Kharg Island. By dawn she was listed as “discharging” in a Chinese shipyard. If that sentence does not make you itchy, you have not tried to explain to a three-letter agency why half a billion in sanctioned crude vanished on your watch. Welcome to 2026, where shadow fleet tracking is less about big gray hulls and more about 15-minute windows, spoofed draught numbers, and Telegram channels that laugh at your geofence alerts. Open source intelligence is the only thing that still fits through those cracks in real time.
Why Shadow Fleet Tracking Matters Today
After the EU’s 2025 ban on insuring Russian crude, insurers yanked coverage from 1,400 tankers. Instead of scrapping them, owners simply re-flagged to the Comoros, turned the AIS off at the Strait of Hormuz, and kept on sailing. The U.S. Treasury now calls this group the “dark armada,” and every barrel they land knocks legitimate traders out of the market while funding things we would rather not talk about at diplomatic luncheons. OSINT analysts who can prove the chain of custody in under six hours are briefing admirals before breakfast and seeing their intel in seizure warrants by dinner.
Speed is not vanity here; it is survival. When a laden very-large-crude-carrier (VLCC) steams at 14 knots, it covers 300 nautical miles per day. Miss a 24-hour window and your target is over the horizon, literally and politically. Agencies that still rely on a weekly CSV from Lloyd’s List are chasing yesterday’s ghost. If you want to stay in the fight, you need a repeatable open source intelligence workflow that fuses AIS gaps, SAR imagery, RF emissions, and corporate registries in the same dashboard your analyst finishes her coffee in.
Need a refresher on how military teams fuse such feeds at machine speed? The write-up on how military teams use OSINT to boost threat intelligence and battlefield awareness walks through the same stack you will be abusing to corner a rusty tanker.
Build a 3-Step OSINT Workflow for Dark Tankers
Step 1: Harvest AIS Gaps Programmatically
Forget manually scrolling on MarineTraffic. Script against the free Signal-K stream or pay two cents per hit for a low-latency API. Store every position report for the global fleet in a 24-hour rolling bucket. When a ship’s MMSI vanishes for more than 180 minutes inside a 100 nm radius of a sanctioned terminal, flag it as a “ghost candidate.” Add a second filter: if the last draught reading is greater than 15 meters, odds are high she’s sitting heavy with crude. That single rule alone cuts noise by 92 percent.
Step 2: Cross-Reference SAR and Optical Hits
Next, pivot to Sentinel-1 or Capella Space. A loaded tanker appears as a bright double-reflection on SAR, and her wake shows up 8-12 km behind. Time-match the AIS gap against the satellite pass. If you still have ambiguity, run a 30 cm optical task on the same tile. A VLCC at 330 m length is impossible to misclassify, even for interns. Export the coordinates into a KML and push it to your collaboration space.
Step 3: Enrich with Ownership Graphs and Insurance Void
Now the fun part. Pull the IMO from the last known AIS ping, scrape Equasis for former names, then dump the registered owner into OpenCorporates. Walk two levels up the shareholder tree; you will almost always hit a shell in the Marshall Islands or St. Kitts. Check the London P&I club status page: if coverage was withdrawn this year, you have probable cause that the owner is intentionally operating outside compliance. Export a PDF evidence pack before the website “helpfully” updates.
If you need a template for similar corporate tracing, the guide on due diligence with OSINT: identifying red flags in corporate investigations has copy-paste regex you can steal.
| Data Source | Latency | Cost | Key Field |
|---|---|---|---|
| Signal-K AIS | 2 min | Free | MMSI + draught |
| Sentinel-1 SAR | 6 hr | Free | Wake length |
| Capella Space | 45 min | $3.50/km² | Azimuth shift |
| Equasis Registry | Real-time | Free | IMO history |
| Lloyd’s List Intel | 24 hrs | $14k/yr | Sanction flag |
Automate the Boring Bits with Kindi
Manually stitching KML, CSV, and PDF files is why most teams quit after two ships. Instead, spin up a Kindi project. Point its AIS connector to your gap feed, drag the satellite imagery into the same workspace, and let the graph engine auto-link vessels to their ultimate beneficial owners. Because Kindi keeps every artifact hash-timestamped, the chain of custody is courtroom-ready. One click exports a bilingual evidence bundle for admiralty court or a U.N. panel, complete with SHA-256 checksums. Analysts keep the credit; you keep the speed.
Case Study: The “BORN SEA” Turnaround in 18 Hours
On 14 December 2025, the BORN SEA disappeared 11 nm south of Iran’s Siri platform. No MMSI, no LRIT, nothing. Analysts used the above workflow: AIS gap detected at 17:42 UTC, Sentinel-1 collected at 22:11, VLCC match confirmed. Draught history showed 20.4 m three days prior. Ownership search revealed a one-ship company in the Comoros whose director also owned six other tankers sanctioned in 2023. By 09:30 next morning the U.S. Navy had vectored a destroyer to an intercept course; the vessel reversed course and headed back to Iranian waters. Total cost: three analyst hours and $14.70 in API calls. That is a ROI you can brief to Congress without blinking.
Key Takeaways for Investigators
- AIS gaps longer than three hours inside sanctioned corridors are your biggest lead indicator.
- Combine free SAR with low-cost optical to close the ambiguity window under one hour.
- Ownership graphs and withdrawn P&I insurance are the fastest public proof of intent.
- Automate evidence collection; admiralty judges love timestamps more than PowerPoint flair.
- Shadow fleet tracking is a quick-win investigation that scales; once your script runs, every tanker on the planet is in scope.
FAQ
Q1: Is turning off AIS illegal?
No. SOLAS only mandates AIS in busy traffic zones; on the high seas captains may disable for “security reasons,” which is the loophole dark fleets exploit.
Q2: Do I need a security clearance to access SAR imagery?
No. Sentinel-1 is open to anyone with an ESA login. Capella and other commercial providers sell 30 cm imagery without export restrictions.
Q3: How accurate is draught data in AIS messages?
Crews manually enter draught before departure; errors of ±0.5 m are common. Anything above 17 m on a VLCC still screams full load.
Q4: Can ship owners spoof IMO numbers?
Rarely. IMO is etched into the hull and appears on classification certificates. Changing it requires dry-dock and forgery that most insurers will not touch.
Q5: What if multiple tankers vanish in the same grid square?
Use SAR wake orientation to separate them; each ship leaves a unique trail. Then cross-check optical to confirm bow direction and length.
Want to strengthen your OSINT skills?
Check out our OSINT courses for hands-on training.
And explore Kindi — our AI-driven OSINT platform built for speed and precision.