How to Track Ships Using OSINT — Dark Fleets, AIS Spoofing, and the Tools That Expose Them

A tanker carrying sanctioned crude is somewhere in a high-traffic maritime corridor tonight. Its AIS transponder — the system designed to broadcast its name, position, and destination to the world — says it's sitting in international waters. Routine. Unremarkable.

Except a Sentinel-1 satellite image captured two hours ago shows it moored at a port it isn't supposed to be anywhere near.

That single discrepancy, spotted by a civilian analyst using free and low-cost tools, is maritime OSINT in practice. No classified databases. No government access. Just two data sources that tell contradictory stories — and the knowledge to know which one to believe.

This is how the world's growing dark fleet gets caught. And this guide walks you through exactly how to do it — based directly on the techniques covered by OSINT analyst Rae Baker in her deep-dive session with David Bombal, and reinforced by current intelligence from active maritime investigations.

---

The Ships That Don't Want to Be Found

Most ships are easy to track. They broadcast their identity and position automatically, they file voyage plans, and they show up in port records, insurance filings, and customs databases like any legitimate commercial operation.

Then there are the others.

The dark fleet — sometimes called the shadow fleet — is a network of oil tankers operating deliberately outside normal regulatory oversight. These vessels move sanctioned crude from highly monitored jurisdictions to buyers willing to look the other way. They go quiet, change names, swap flags, and do everything possible to make a tracking analyst's job harder.

The scale is larger than most people realize. Estimates now put the shadow fleet at somewhere between 600 and 1,300 vessels, representing over 10% of the world's tanker capacity. Shadow fleet exports from these regions reached 4.1 million barrels per day in mid-2024. Major financial regulatory bodies added over 400 vessels to sanctions lists in 2025 alone — and the fleet keeps growing.

Understanding how to track ships using OSINT means understanding the specific methods these vessels use to disappear. Because every evasion technique leaves a different kind of trace.

How AIS Works — and Why It Can't Be Trusted Alone

AIS stands for Automatic Identification System. Every commercial vessel above a certain size is legally required to broadcast an AIS signal that includes its vessel name, MMSI number (a unique identifier), current GPS position, speed, heading, and destination port.

This sounds comprehensive. The problem is that AIS operates entirely on trust. A ship's crew enters the data manually. There is no cryptographic verification. No authority confirms the position is accurate before it goes out. A vessel can broadcast a false name, a false position, or a false destination — and it will appear on every tracking platform in the world as if that data were real.

This is called AIS spoofing. And it happens constantly.

Watch Out: The most sophisticated spoofing doesn't look like spoofing. Dark fleet vessels often broadcast AIS data that depicts perfectly normal, routine sailing patterns — except the position shown puts them somewhere innocuous while the real ship is loading sanctioned cargo 800 miles away.

There are three core AIS manipulation techniques analysts watch for:

• Going dark means the transponder is simply switched off. The vessel disappears from tracking platforms entirely. Crews often cite equipment failure as the explanation — and while legitimate technical issues do happen, repeated or conveniently-timed gaps are a behavioral red flag.
• Spoofing means broadcasting false position data. A common pattern in restricted regions has vessels showing their AIS position in international waters while physically sitting at a sanctioned port. Analysts catch this by cross-referencing AIS data with independent satellite imagery. If the AIS track and the satellite image disagree, the satellite wins.
• MMSI cloning is the most aggressive technique — a vessel broadcasts the identity of a different, legitimate ship. Two ships appear to be in two different places simultaneously.

The Core OSINT Toolkit for Maritime Tracking

MarineTraffic

MarineTraffic.com is the starting point for almost every maritime investigation. It aggregates AIS data from a global network of terrestrial receivers and satellites, showing vessel positions, voyage history, port calls, and vessel details on an interactive map.

TankerTrackers

TankerTrackers.com specializes in oil tanker intelligence and goes significantly deeper than general maritime platforms. It combines AIS data with satellite imagery and commodity flow analysis to track sanctioned crude movements.

Equasis

Equasis.org is a free public database funded by maritime safety authorities. It provides ownership and management history, safety inspection records, flag history, and class society information for registered commercial vessels.

Sentinel Hub and Google Earth

Satellite imagery is what makes it possible to verify or contradict what AIS data claims. Sentinel Hub provides free access to Copernicus SAR (Synthetic Aperture Radar) imagery updated every few days.

Shodan

Shodan.io is primarily known as a search engine for internet-connected devices — and that's exactly why it's relevant to maritime OSINT. Modern port infrastructure and vessel control systems are increasingly internet-connected and often exposed.

Pro Tip: When starting an investigation on a specific vessel, run its name and MMSI through both MarineTraffic and Equasis simultaneously. Discrepancies between the two are immediate red flags.

How Ships Disappear — and How to Find Them Anyway

When a vessel goes dark, it doesn't vanish from the physical world. It vanishes from one data source. The job of a maritime OSINT analyst is to find it in the others.

AIS gap analysis is the starting point. Geographic context transforms a technical anomaly into an investigative lead. Satellite cross-reference is the next step. If the ship is physically present at a location its AIS denies, you have your evidence.

Port record and draft analysis rounds out the picture. Ships sit lower in the water when loaded with cargo. Corporate ownership tracing through Equasis and national business registries reveals the layered shell structures that dark fleet operators use.

Frequently Asked Questions