GDE-001 |
Maritime vessel tracking and investigation | |||||||
Maritime intelligence | ||||||||
July 2026 | ||||||||
01
What it is
Maritime OSINT is the practice of tracking vessels, tracing ownership, and documenting incidents using publicly accessible data, without access to classified or proprietary systems. It covers the full investigative arc from AIS position data through corporate registry research, port inspection records, casualty documentation, and sanctions screening.
When a vessel goes dark in a conflict zone, the AIS gap is not the end of the investigation. It is the beginning. In June 2026, the Ever Lovely transmitted an AIS heading field inconsistent with its stated course in the Strait of Hormuz. Cross-referencing that signal against independent AIS reception and satellite positioning placed the vessel in a coercion corridor before the drone strike was reported. The open record did not prove what happened. It proved what could not have happened, and that is what made it publishable. This guide covers that methodology: from establishing vessel identity through AIS tracking, ownership tracing, port inspection records, incident reconstruction, and sanctions screening.
|
When to use this guide
|
02
How to track and investigate a vessel using open sources
The complete workflow: from establishing vessel identity through AIS tracking, ownership tracing, port inspection records, incident reconstruction, and sanctions screening.
The following tools cover the full maritime OSINT workflow. Free tools are listed before paid.
MarineTraffic: Real-time AIS position data and historical voyage playback. Free tier available; extended history and satellite AIS require a paid subscription.
VesselFinder: Independent AIS source for cross-referencing MarineTraffic data. Free tier available. Use alongside MarineTraffic and flag any positional discrepancies.
Equasis: Multi-administration maritime safety registry founded by European maritime administrations, with IMO holding observer status. Links vessels to registered owner, ship manager, flag state, class society, and port state control inspection history. Free with registration.
Global Fishing Watch: Independent AIS reception and gap detection. Free. Particularly useful for identifying dark vessel periods and cross-referencing gaps against MarineTraffic.
OpenCorporates: Corporate registry search for tracing ownership chains across jurisdictions. Free and paid tiers.
ICIJ Offshore Leaks: Searches the Panama Papers, Paradise Papers, Pandora Papers, and related leaked datasets by company and individual name. Free.
OpenSanctions: Cross-references individuals and entities against multiple international sanctions regimes simultaneously. Free.
TankerTrackers: Specialist ship-to-ship transfer tracking with satellite imagery integration. Paid. Relevant for sanctions evasion investigations involving crude oil and petroleum products.
|
Before you begin Anchor on the IMO number, not the vessel name. Vessel names change. Flags change. Ownership changes. The IMO number does not. It is a permanent seven-digit identifier assigned at build. Retrieve it from MarineTraffic or Equasis before doing anything else. Every subsequent query in this workflow should be anchored to the IMO number. Legal considerations. All techniques in this guide use publicly accessible data. Do not interact with vessel systems or attempt to access non-public maritime databases. Sanctions research involving designated individuals or entities may carry legal implications depending on your jurisdiction; consult counsel before publishing findings that identify sanctioned persons. |
Search the vessel name on MarineTraffic to retrieve the MMSI and IMO number. Confirm both against Equasis, which pulls from official IMO registration. Note the vessel class, gross tonnage, year of build, flag state, and current status. A vessel showing as active on MarineTraffic but inactive on Equasis warrants immediate investigation. Record the IMO number as the anchor for all subsequent queries; do not rely on the vessel name alone.
Search MarineTraffic by MMSI or IMO number and record the current position and voyage history. Cross-reference on VesselFinder and flag any positional discrepancies between the two platforms. Check both the position field and the heading field: a vessel broadcasting a heading inconsistent with its stated course is a spoofing indicator. Note all intervals where AIS transmission ceases for more than two hours in open water. AIS position reflects transponder output, not verified GPS, and relay stations near coastlines can introduce a lag of up to 30 minutes.
For each dark period, apply a speed plausibility test: calculate whether the vessel could physically have reached its post-gap position given elapsed time and vessel class speed. An implausible speed indicates positional falsification. Cross-reference against Global Fishing Watch, which maintains independent AIS reception. A gap appearing on MarineTraffic but not Global Fishing Watch indicates selective transmission rather than a technical fault. For nocturnal gaps in known transfer zones, NASA FIRMS VIIRS nighttime light detection provides a third independent position signal. See MAR-003 for the complete dark period and spoofing workflow.
Query Equasis to retrieve the registered owner, ship manager, flag state, and inspection history. The registered owner is frequently a single-vessel shell company; the ship manager is often the entity with real operational accountability. From the registered owner, trace the corporate chain through OpenCorporates and the relevant national registry, following director and shareholder links at each layer. Run all identified individuals and entities through OpenSanctions, the OFAC SDN List, and the UN Consolidated List. Screen against ICIJ Offshore Leaks for appearances in major leaked datasets. For the full beneficial ownership tracing workflow specific to maritime structures, see MAR-005. For the corporate registry method applied here, see the COR-001 card and the corporate investigation guide.
Port state control inspection records are publicly available through regional memoranda of understanding and aggregate through Equasis. Retrieve the full inspection history and note deficiencies and detentions separately. A deficiency is a noted fault; a detention means the vessel was held in port pending rectification of serious deficiencies. Patterns of recurring deficiencies across multiple inspections indicate systemic management failure. For vessels operating in US waters, the US Coast Guard PSIX database provides independent inspection records not always captured by other MoUs. See MAR-004 for the full PSC workflow.
Retrieve formal casualty filings from the IMO GISIS marine casualties module and EMSA EMCIP. Rebuild the AIS track covering the 30-minute window before and after the incident using MarineTraffic or Fleetmon. Pull historical meteorological data for the incident coordinates from Weather Underground. Discrepancies between the official narrative and the physical record are the investigative finding. Download AIS replay data and casualty report PDFs immediately; free-tier archive access ages off and official documents are sometimes removed. See MAR-006 for the full incident documentation workflow.
Screen the vessel against sanctions lists using the vessel name, IMO number, and all former names. Map AIS gaps against known ship-to-ship transfer anchorage areas: the Laconian Gulf, the Strait of Malacca approaches, and West African offshore zones are established transfer locations. Where a gap coincides with a known STS zone, seek satellite confirmation through TankerTrackers. Where an STS event is confirmed, retrieve the second vessel's IMO number and apply the same sanctions screening and AIS gap analysis to the transfer partner. Do not publish vessel coordinates that could alert operators to surveillance. See MAR-007 for the full STS transfer workflow.
Two cards in this series support the workflow above but aren't linked in the steps: MAR-001 for the full AIS and MMSI vessel tracking methodology, and MAR-002 for reading Equasis ownership records line by line.
03
What to watch for in maritime OSINT
Common false positives, evidentiary traps, and chain of custody requirements specific to maritime investigation.
Dark periods as proof of wrongdoing: AIS gaps are the most commonly misread signal in maritime OSINT. Technical failure is the most common cause of a dark period; transponder faults, relay station outages, and port-entry requirements that mandate AIS off all produce gaps indistinguishable from deliberate concealment at first inspection. Verifying check: Apply the speed plausibility test for each gap. Cross-reference against Global Fishing Watch. A gap appearing on one platform but not the other indicates selective transmission; a gap appearing on both is more consistent with technical failure or coverage absence.
Flag of convenience as evidence of illicit activity: The majority of vessels registered under flags of convenience are engaged in wholly legitimate trade. FOC registration is standard commercial practice driven by tax and regulatory considerations. Verifying check: Illicit activity requires positive evidence beyond flag registration alone. Combine FOC status with AIS gap analysis, PSC detention history, and sanctions screening before drawing conclusions.
Nominee directors as beneficial owners: Corporate registry searches frequently return nominee directors who are professional placeholders with no operational control. Treating a nominee as the beneficial owner misidentifies the investigative target. Verifying check: Confirm whether the named director appears across multiple unrelated vessels or companies; high repetition is a strong indicator of a nominee arrangement. Seek persons with significant control filings in jurisdictions that require them, such as the UK Companies House PSC register.
Single PSC detentions as indicators of rogue operators: A single detention does not establish a pattern. Technical deficiencies are common across the global fleet and detention following rectification means the vessel is compliant. Verifying check: Look for recurring deficiency categories across multiple inspections and multiple MoU regions. Patterns across inspections indicate systemic failure; isolated detentions do not.
Historical sanctions listings applied to current vessels: Vessels cycle identities. A sanctions designation against a vessel name may predate a flag change, name change, or ownership transfer that renders the current vessel distinct from the designated one. Verifying check: Always confirm designation status against the current IMO number, not the vessel name alone. Check the OFAC SDN List entry for the IMO number explicitly.
Chain of custody
Maritime OSINT produces evidence that may be used in legal proceedings, regulatory filings, or formal publication. Every query, screenshot, and downloaded file must be treated as a potential exhibit from the moment of capture.
Record query timestamps in UTC for every platform lookup, noting the platform, the search parameters used, and the result count.
Capture full browser URLs in all screenshots; platform URLs frequently contain query parameters that identify the specific record retrieved.
Generate a SHA-256 hash of every screenshot and downloaded file immediately after capture, before any editing or annotation.
Archive original files separately from working analysis notes; never annotate the original.
Preserve a Wayback Machine snapshot of every key registry or official report page at the time of retrieval.
04
Go deeper
Reference cards, tutorials, and the complete Maritime Intelligence pack for practitioners extending this workflow.
Evidentiary standard
Signal & Shadow operates to the LST-001 evidentiary standard. All claims are graded against the LST-001 v1.0.3 confidence tiers (Confirmed, Corroborated, Reported, Alleged) per the canonical voice and structural specification.
About Signal & Shadow
Signal & Shadow is an independent forensic investigation and methodology practice publishing tutorials, reference cards, and forensic dossiers for working practitioners. Founded by Derek Bowler.