Shadow Fleet AIS Spoofing: How Seven Tankers Hid in Plain Sight

WarBrief Live | November 6, 2026 | Shipping & Logistics

AIS spoofing is the deliberate broadcast of false ship positions. In the latest case, seven sanctioned Russian tankers spent 90 days telling the world they were drifting near the Bosphorus while actually sailing from the Russian port of Novorossiysk, according to maritime intelligence firm Windward. The finding, published on November 3, 2026, is the clearest evidence yet that location falsification has become a routine operating procedure for the shadow fleet — the network of ageing tankers that moves sanctioned oil outside the reach of Western enforcement.

This explainer sets out what AIS spoofing is, how the seven tankers were caught, what an earlier investigation found in October, and what a separate change to Iran’s Hormuz blacklist does — and does not — mean.

What is AIS spoofing?

The Automatic Identification System (AIS) is the radio system ships use to broadcast their identity, position, course and speed to nearby vessels and coastal authorities. Under the International Convention for the Safety of Life at Sea (SOLAS), it is mandatory for ships over 300 gross tonnage on international voyages. The signals are picked up by shore stations and by satellites, and they feed the public tracking maps used by journalists, insurers, port authorities and sanctions-compliance teams. Our guide to tracking ships with free OSINT tools explains how that open data is used.

AIS spoofing means transmitting a position that is not where the ship actually is. It differs from going “dark”, which is switching the transponder off altogether, and from a third technique exposed in October: dual transmission, in which a vessel broadcasts two different positions at the same time. Spoofing is harder to spot than silence, because a ship that appears to be drifting harmlessly in a recognised anchorage attracts far less attention than one that has vanished from the map.

The motive is straightforward. A sanctioned tanker that can make its voyages invisible — or at least unremarkable — can load, sail and discharge with less risk of detention, refusal of insurance or port services, or targeting. The Windward analysis describes the falsification as “routine and deliberate”, language that points to a settled tactic rather than a one-off error. Analysts distinguish spoofing from genuine faults by looking for patterns: positions that stay fixed for days, jumps that no vessel could physically make, and mismatches between the broadcast position and satellite imagery, radio-frequency geolocation, draught changes and port records.

How did seven tankers fake their positions near the Bosphorus?

According to Windward’s November 3, 2026 analysis, written by senior maritime intelligence analyst Michelle Wiese Bockmann, a cluster of seven sanctioned Russian tankers repeatedly broadcast false positions indicating they were drifting off the Black Sea close to the Bosphorus entrance. Satellite and other tracking placed them instead on voyages originating in Novorossiysk, Russia’s main Black Sea oil port. The analysis covers a 90-day window ending on or about November 5, 2026, and describes the falsification as repeated and coordinated rather than incidental.

Windward did not publish the names of the seven vessels, the precise sanctions authorities that listed them, or any cargo figures, so no individual tanker in the cluster can be identified from the public reporting. That matters for compliance teams: a screen that relies only on AIS positions would have seen seven unremarkable vessels loitering near a strait, not seven sanctioned tankers moving oil. The firm’s next scheduled release of its sanctioned-fleet dataset is expected on Monday, November 10.

The same Windward analysis also tracked three tankers reported to be sailing to the United States with Russian diesel: the Russia-flagged Talisman (IMO 9292060), the Sierra Leone-flagged Leruo (IMO 9385831) and the Malta-flagged, Greece-owned Agioi Fanendes (IMO 9798375). The first two are sanctioned by the EU, the UK, the US, or a combination of the three; the third is not sanctioned. General License 135, issued by the US Treasury on October 9, 2026, temporarily allows Russian diesel to be imported to the US, but Windward reported that it had yet to result in any cargo being delivered. The Talisman changed its AIS-declared destination to “For Order” and sailed through the Strait of Gibraltar, while the Leruo amended its destination to “Brazil for order”. Only the Agioi Fanendes still appeared to be heading for the US north-east coast.

What did the October investigation find?

The Windward finding did not come out of nowhere. On October 19, 2026, the Financial Times reported research by Ollie Ballinger, a shadow-fleet tracking specialist at University College London, which found indications that at least 12 sanctioned tankers operating in the Black Sea transmitted fixed coordinates different from their actual locations. Six of the vessels appeared to transmit two different sets of location data simultaneously in recent months.

The clearest example was the Russian-flagged tanker Pirop. On August 27, it transmitted a position near Türkiye’s Bosphorus Strait while also sending out data placing it along the Turkish coast about 800 kilometres away. Ballinger found that the false positions were all fixed at 08:13 UTC, suggesting the vessels were using the same devices and software. Eleven of the 12 tankers had changed their flag states to Russia over the past year, and Windward’s Bockmann noted that more than 80 vessels changed to Russian registration between July and September 2026 — a shift she described as the clearest sign yet that Moscow intends to exert greater control over shipping and logistics.

The dual-transmission trick appears to be tied to the Bosphorus itself. Turkish authorities require vessels transiting the strait to transmit a position while passing through the narrow waterway with tug assistance. According to the reporting, some tankers briefly activated their real, satellite-tracked AIS during transit while continuing to broadcast a separate frozen position near the mouth of the Bosphorus. The result is a ship that is, on paper, in two places at once — compliant where it must be, and invisible everywhere else.

The scale of the fleet behind these tactics is large. Windward estimates the shadow fleet at 1,229 vessels above 20,000 deadweight tonnes, with more than three-quarters sanctioned by the US, UK or EU, and nearly 700 tankers carrying Russian oil and gas have faced European and UK sanctions since 2022. For background on how oil sanctions work, including price caps and enforcement, see our earlier explainer.

Why do tankers spoof, and who catches them?

Sanctions evasion is the primary motive, but it is not the only one. Reporting on the October findings noted that falsified positions also reduce exposure to Ukrainian drone attacks on Black Sea shipping: a tanker that appears to be sitting still near the Bosphorus is a less obvious target than one under way from Novorossiysk. Reflagging to Russia adds a further layer, bringing vessels under Moscow’s maritime regulations and complicating enforcement by other states.

Detection relies on cross-checking AIS against independent sources. Satellite imagery can show a vessel where its transponder says it is not. Radio-frequency geolocation can place the actual transmitter. Draught changes reveal loading and discharge even when the position is faked. Port and canal records, insurance filings and the work of specialist firms such as Windward and Lloyd’s List Intelligence turn isolated anomalies into patterns — which is how a single frozen coordinate at 08:13 UTC became evidence of a coordinated tactic rather than a glitch.

Enforcement is catching up, but slowly. The US Treasury’s Office of Foreign Assets Control (OFAC) has been expanding designations against Iran-linked shipping under Operation Economic Outcast, including the fake-flag crackdown and the A7 network designation covered in our sanctions tracker. Yet the week’s sanctions reporting recorded no fresh vessel or entity designations by OFAC, the EU, UK OFSI or the UN — the only list movement was an Iranian administrative change, covered below.

What changed in Iran’s Hormuz blacklist?

Separately, Iran’s Persian Gulf Strait Authority (PGSA) has removed two vessels from its non-compliance list and added one, according to Seatrade Maritime News. The two removals are Gas Marakua, a 2003-built, Barbados-flagged LPG carrier registered to a single-ship entity in China, and SOGL, a 2001-built LPG carrier falsely flagged in Comoros and registered to an owner in the Marshall Islands. Both were sanctioned by OFAC on October 8, 2026, for links to Iranian shipping as part of Operation Economic Outcast. The single addition is Mercan, a 2018-built, Panama-flagged chemical and products tanker owned and operated out of Türkiye. The PGSA list now stands at 239 vessels as of November 5.

Two points need to be stated plainly. First, this is an Iranian administrative change, not a Western easing: the US sanctions on Gas Marakua and SOGL remain in force. Second, none of the three vessels has been the target of a confirmed attack during the current Middle East conflict, and Seatrade reported no suggestion that the list changes were connected to any known attack. The PGSA has not announced how vessels can be removed from its blacklist, though it provides an email address for vessels seeking to be struck from the list.

The PGSA list has grown fast. It reached 240 vessels on November 2 after 114 were added in a single update, at least 29 of them linked to the South Korean operator Sinokor. The authority says listed ships face fines, detention or confiscation on future Strait of Hormuz passages, and Reuters reported in August that their cargo could be confiscated too. The context is a US naval blockade of Iran, reimposed on July 14, under which US Central Command said 138 vessels had been redirected as of October 17, with four disabled and 10 Iran-linked tankers destroyed, according to CENTCOM. Reuters analysis found that at least eight LPG cargoes totalling about 4.1 million barrels still slipped out of the Gulf of Oman after the blockade was reimposed, six of them on sanctioned tankers — though Kpler recorded zero Iranian crude exports in September, the first zero-shipment month in its data going back to 2013.

What this means for US/UK/EU readers

For readers in the US, UK and EU, AIS spoofing is not an abstract maritime curiosity. It is one of the main reasons sanctions on Russian oil leak. Every tanker that hides its voyage is a tanker that can keep discounted Russian crude and diesel flowing to buyers willing to look the other way, blunting the price pressure that sanctions are meant to apply and complicating the work of insurers, banks and port authorities in London, Rotterdam, Piraeus and Houston.

There is a direct household angle too. Shipping risk feeds into freight and insurance costs, and freight and insurance feed into the price of diesel, heating oil and petrol. The same evasion techniques are at work in the Gulf, where the Hormuz blacklist and the US blockade are shaping the flows — and the risks — around the strait that carries about a fifth of the world’s daily crude oil and liquefied natural gas. When tankers fake their positions, the market’s picture of supply gets blurrier, and blurry supply means more volatile prices at the pump.

There is also a safety dimension. AIS exists to prevent collisions. A vessel broadcasting a false position is a hazard to every other ship in a congested waterway such as the Bosphorus, and a vessel that appears to be in two places at once can confuse traffic management precisely where the margin for error is smallest. For seafarers, insurers and coastal states alike, spoofing is a safety problem as well as a sanctions problem.

What to watch next in shadow fleet enforcement

The next data point arrives on Monday, November 10, when Windward releases its refreshed sanctioned-fleet dataset and any accompanying analysis. Watch for whether the seven tankers are named, and whether the cluster grows. Watch, too, for fresh designations: the absence of new OFAC, EU or UK listings this week stands in contrast to the operational tempo of the already-sanctioned fleet, and the US sanctions package against the Iran MANPADS procurement network announced on November 4 shows Washington is still adding names elsewhere.

In the Gulf, the PGSA list is now a weekly moving picture: 240 vessels on November 2, 239 on November 5, with the Sinokor fleet warned that all of its ships face action from November 1. Any further removals of US-sanctioned vessels would be worth noting, but only as an Iranian administrative signal — not as sanctions relief, which only Washington, London and Brussels can grant. And in the Black Sea, the question is whether Türkiye tightens its Bosphorus transit requirements in response to the dual-transmission findings, closing the loophole that lets a tanker be compliant and invisible at the same time.

By the numbers

Figures marked CONFIRMED come from the primary reporting outlet or two or more independent sources. Estimates are labelled as such. Windward did not name the seven tankers, and no cargo figures were published for them.

Frequently asked questions

What is AIS spoofing?
AIS spoofing is the deliberate transmission of false position data by a ship’s Automatic Identification System. The vessel broadcasts a location that is not where it actually is, so tracking maps, port authorities and sanctions screeners see a harmless or unremarkable position instead of the ship’s real voyage.

How can a ship be in two places at once?
It cannot — physically. In the October 2026 findings, six sanctioned tankers transmitted two different AIS positions simultaneously, one of them their real position and the other a frozen false position. Analysts detected the trick because the false positions were identical, fixed at 08:13 UTC, and hundreds of kilometres from the vessels’ real locations.

Is AIS spoofing illegal?
Manipulating AIS to evade sanctions can breach US, UK and EU sanctions law, and switching off or falsifying AIS can breach SOLAS safety obligations and flag-state rules. Enforcement depends on the vessel’s flag, the sanctions regime involved and whether authorities can prove intent, which is why detection and documentation by firms such as Windward matter.

What is the shadow fleet?
The shadow fleet is a network of mostly ageing tankers, often owned through opaque single-ship companies and frequently reflagged, that transports oil for sanctioned producers such as Russia and Iran outside normal commercial channels. Windward estimates it at 1,229 vessels over 20,000 deadweight tonnes, more than three-quarters of them sanctioned by the US, UK or EU. Our full explainer is here.

Why does AIS spoofing matter for fuel prices?
Because it keeps sanctioned oil flowing. Tankers that hide their voyages blunt the supply pressure sanctions are meant to create, while the added shipping risk raises freight and insurance costs. Both effects feed through to diesel, heating oil and petrol prices, and the uncertainty makes energy markets more volatile.

Sources

• Windward: Russian Diesel Cargoes Have Yet to Reach the U.S.
• Chosun Biz: Russia shadow fleet fakes ship locations to dodge drones and sanctions (Financial Times reporting)
• TradersUnion: Russian shadow fleet adopts coordinated AIS spoofing in Black Sea operations
• Seatrade Maritime News: US-sanctioned ships dropped from Iran’s PGSA blacklist
• Eagle Intel Mari: Shadow-Fleet AIS Spoofing Near Novorossiysk Persists as US-Sanctioned LPG Carriers Exit Iran Blacklist — 6 November 2026
• Seatrade Maritime News: Gulf of Aden piracy warning as US issues Iran blockade update

Read next: our Sanctions Tracker hub and the Conflict Zones hub, which follow the enforcement picture as it develops.