How the Shadow Fleet Tracker works

This page explains where the data comes from, what the colours on the map mean and how each alert is generated.

What is the shadow fleet?

The shadow fleet, sometimes called the dark fleet, is a loose group of mostly older tankers that move sanctioned oil outside mainstream shipping. Typical traits include frequent name and flag changes, unclear ownership, patchy insurance and AIS transponders that get switched off when the ship wants to hide a port call or a cargo transfer. Vessels of this kind have also been linked to damaged undersea cables and pipelines in the Baltic Sea.

Where the data comes from

AIS positions. Every large ship broadcasts its position, speed and identity over AIS radio. This site ingests a live worldwide feed from our own receiver and the AISHub exchange network, several hundred messages per second.
Sanctions lists. The watch list is built from official registers (US OFAC, EU, UK, Ukraine, Switzerland, Canada, UN) consolidated by OpenSanctions and refreshed daily. Vessels are matched by their IMO number, which stays the same through every name and flag change.
Reference data. About 3,800 ports from the World Port Index, submarine telecom cables from TeleGeography, Baltic pipelines from EMODnet and curated routes for key power links such as Estlink 1 and 2.

Vessel tracks are kept for five days at full resolution. Events, port calls and the watch list are kept permanently.

Map legend

Vessels

Red dot	Watched vessel, transmitting now (seen within 15 minutes)
Amber dot	Watched vessel, position getting stale
Purple dot	Watched vessel that has gone dark, shown at its last known position. In replay mode a hollow purple ghost marks where the signal was lost.
Grey dot	Other, non-listed vessel (encounter counterparts, nearby traffic)
Blue ring	Currently selected vessel
Yellow ring	Location of the event you jumped to

Infrastructure (the "Infra" toggle)

Blue lines	Submarine telecom cables. Routes are schematic, especially near shore, where every cable landing in a city is drawn to the same point.
Orange lines	Gas and oil pipelines. These are surveyed geometries, for example Balticconnector and Nord Stream.
Red lines	Power interconnectors (Estlink 1/2, NordBalt, Fenno-Skan, Baltic Cable, SwePol). Exact routes are not public, so these are approximations with a wide alert margin.

Other overlays

Green cells (Coverage)

Areas where AIS reception is consistently good. A vessel going silent in a covered area means something. Silence elsewhere may just be a reception gap.

Event types

Event	What it means
Went dark	The vessel stopped transmitting for more than six hours in an area with reliable reception. Ships switch AIS off to hide port calls and cargo transfers. If the last position was at a known waiting anchorage, the event is kept but marked low priority, because cutting the radio at anchor is routine.
Reappeared	The vessel transmits again after a dark gap. The event records how long it was silent and how far it moved in the meantime.
Teleport	A reappearance so far away that the vessel would have needed an average speed of over 25 knots. Points to a long hidden voyage or to manipulated position data.
Encounter	The vessel spent at least 30 minutes within 500 metres of another ship in open, quiet water. Meetings inside ports and busy anchorages are filtered out as everyday traffic.
STS suspect	A possible ship-to-ship cargo transfer: two vessels less than 300 metres apart, both stopped for over 45 minutes, away from any berth. This is the standard way to move sanctioned oil between ships at sea.
Identity change	The vessel got a new MMSI number, flag, name or call sign while its IMO number stayed the same. Frequent re-flagging is typical shadow fleet behaviour.
IMO conflict	Two live transmitters broadcast the same IMO number at the same time. One of them is using another ship's identity.
Draught change	The reported draught changed by half a metre or more, which means cargo was loaded or discharged. The event is escalated if the ship had no port call in the previous 48 hours or had a recent encounter, because in those cases the cargo moved at sea.
Port call	The vessel stayed essentially stationary for at least two hours inside a port area. Chains of port calls show where cargo is loaded and where it ends up.
Infra proximity	The vessel loitered for over 30 minutes on top of a cable, pipeline or power link corridor, outside ports and known anchorages. Anchor dragging incidents look like this before they make the news. Alerts inside learned anchorage areas are downgraded, and several ships tripping the same line at once are grouped into one low-priority note.
New listing	The vessel was added to one of the sanctions lists the tracker follows.

How the noise is kept down

The sea is full of perfectly normal stops, meetings and slow traffic. The tracker first learns what normal looks like and then reports deviations:

a coverage grid learns where reception is reliable, so dark alerts only fire where silence actually means something;
a learned anchorage map, built from the behaviour of ordinary non-listed traffic, marks the world's waiting areas, and routine findings inside them are demoted;
port stays, crowded roadsteads and cable landing zones are recognised and filtered before an alert is raised.

Every event stays in a permanent history. Nothing is deleted, but only the unusual rises to the top of the feed. The ⌖ map button on any event opens a replay of the situation, with a time slider that shows every watched vessel's movements around the moment of the event.

Honest limitations

AIS is self-reported. Names, destinations and draughts are typed in by the crew and can be wrong or deliberately misleading.
Coverage depends on receiver networks. Gaps on the open ocean are normal.
Cable routes are schematic and power link routes approximate, so distances to infrastructure are indicative.
Everything shown here is an indicator built from public data, not an accusation of unlawful activity.