The hidden world of the shadow fleet
Globally, hundreds to thousands of vessels operate beyond the reach of regulatory oversight or are difficult to monitor. This so-called shadow fleet is actively used to circumvent international sanctions, facilitate illicit trade flows, and conceal ownership structures.
Consider, for example, oil shipments conducted outside established price caps, vessels engaging in mid-sea cargo transfers to conceal origin, or, in certain cases, the transport of sanctioned or illicit goods.
These practices pose tangible risks. Vessels that disable or manipulate their Automatic Identification System (AIS) are significantly less detectable within digital maritime monitoring systems. This signal normally shares information about position, course, and speed. When it is absent or falsified, the risk of incidents at sea increases. At the same time, many of these vessels operate without adequate insurance or verifiable maintenance, significantly raising the risk of environmental damage. For governments and financial institutions, this undermines not only sanctions of regimes but also the reliability of international trade flows.
For intelligence and OSINT analysts, this presents a complex challenge: how can vessels that deliberately attempt to evade detection be effectively identified? And how can links be established between vessels operating under changing identities, opaque ownership structures, and suspicious shipping routes?
Characteristics and modus operandi of the shadow fleet
The shadow fleet is not defined by a single characteristic, but by a combination of behaviors and structures that deliberately obscure visibility into activities. For analysts, it is precisely this combination that provides valuable indicators.
One key characteristic is the frequent alteration of vessel identity. Ships regularly change their name, flag (so-called flags of convenience), MMSI number, and registered owner, while the IMO number (International Maritime Organization) remains unchanged. Although these changes are not illegal in themselves, they may—especially in combination—indicate attempts to evade oversight and sanctions.
In addition, complex ownership structures are used. Vessels are often placed within layers of shell companies, spread across multiple jurisdictions. This makes it difficult to identify the ultimate beneficial owner (UBO) and requires in-depth analysis of corporate networks and international registries.
Operational behavior also often deviates from standard commercial shipping. Examples include disabling, interrupting (AIS gaps), or manipulating AIS signals, as well as loitering: remaining in one location or maneuvering slowly for extended periods without a clear reason. Ship-to-ship (STS) transfers are also conducted, often outside ports or monitored areas, to obscure the origin of cargo. The combination of identity changes, anomalous behavior, and opaque ownership structures makes the shadow fleet a complex yet analyzable phenomenon. By systematically monitoring these indicators, analysts can uncover hidden networks and high-risk activities.
OSINT approach to shadow fleet investigations
An effective OSINT investigation into shadow fleet vessels requires a structured approach, combining multiple data sources and analytical techniques. By consolidating information from various sources, a more reliable picture gradually emerges.
The investigation begins with correctly identifying a vessel. Because names and flags can be changed relatively easily, the IMO number serves as the most reliable starting point. This unique number remains constant throughout a vessel’s lifetime and enables the linking of historical data such as previous names, flags, and registrations.
Using public tracking platforms, vessel movements can be monitored in near real time. These platforms rely on AIS signals. Analyzing this data provides insight into routes and underlying behavioral patterns.
What makes vessel tracking particularly valuable is its ability to detect anomalies. For example, if a vessel suddenly stops transmitting AIS data, follows unexpected routes, or remains in the same region for an extended period without a clear reason; this may indicate unusual or potentially suspicious activities. Combined with historical data, this makes it possible to identify patterns and establish links between vessels. An example of a platform that provides such insights is MarineTraffic.
In addition, vessel tracking plays an important role in identifying ships that frequently change identity. By tracking data such as IMO numbers, investigators can continue to follow vessels even when their name, flag, or ownership changes. This enables a more complete understanding of the activities and networks behind a shadow fleet.
To identify sanctioned vessels, various public sources and sanctions lists can be used. By combining these sanctions of databases with maritime registries, tracking data, and photographs, it can be determined whether a vessel is directly or indirectly linked to sanctioned entities. This not only helps identify risks, but also reveals networks seeking to evade sanctions through mechanisms such as re-registration or complex ownership structures.
Finally, attention is directed to underlying structures and the individuals involved. By mapping ownership arrangements and network relationships, a more comprehensive picture emerges of the organizations and actors behind a shadow fleet.
OSINT tools
OSINT tooling plays a crucial role in analyzing a shadow fleet. By combining and enriching diverse public data sources, connections can be established between vessels, organizations, and individuals. This provides insight into the structures behind a vessel and enables faster identification of risks, for example, in the area of sanctions.
When multiple OSINT tools, each with its own data sources and analytical methods, are used in combination, they often yield valuable information.
NexusXplore by OSINT Combine supports this process with a powerful vessel tracking module. It allows vessels to be identified and analyzed based on, among other things, name, history, flag changes, and associated organizations. It also immediately shows whether a vessel or organization appears on a sanctions list, which is essential for compliance and investigative purposes.
In addition, NexusXplore offers the ability to map involved individuals. With the Person Identifier module, additional information can be gathered, such as online profiles, networks, and digital activities. This results in a more complete picture not only of the vessel, but also of the people and potential companies behind it.
For further in-depth analysis at the individual level, particularly in an online and social context, this can be complemented with the Horizon platform by ShadowDragon. This platform focuses strongly on identifying and analyzing social media profiles. With the Identity module, profiles can be found based on, for example, name, username, email address, or phone number. By adding additional data, such as date of birth or location, search results can be further refined.
The results of these analyses can then be used within the Graph functionality. This visually represents relationships and networks, helping to identify connections and present findings clearly. Data from the Identity module can be incorporated and further enriched. Data derived from the Identity module can be incorporated to further enrich analytical outputs. In addition, the Graph can also serve as a starting point for further analysis. Whereas competing solutions often concentrate on gathering and enriching data, ShadowDragon’s core strength lies in establishing meaningful connections and organizing information systematically.
Learn more
We invite you to contact us to discover more about implementing OSINT analysis solutions within your maritime investigation operations.
In addition, we are organizing an OSINT Day for the first time this year on Wednesday, July 1 in The Netherlands. During this day, we will share knowledge, practical cases, and insights related to OSINT investigations, including a live session on shadow fleet investigations.
The exact location will be announced soon, along with the official invitation. Stay informed by subscribing to our monthly newsletter.
By Helmi van den Brink and Chris de Meijer | 08-04-2026