Field manual
How to read the map, what the signals mean, and where the uncertainty is
Every contact carries three independent signals. They never share a colour, so a sanctioned hull that goes dark shows both facts at once instead of one hiding the other.
What a detector concluded the vessel is doing right now.
- Going dark · confirmed
- Going dark · suspected
- Loitering
- STS transfer
- Speed anomaly
- Route deviation
- Spoofed position
- Normal traffic
Which lists the hull is on. Reference data, not a detector.
- Sanctioned
- Shadow fleet
- Detained (port state)
- Listed · other
- Not on any list
How old the last received position is. Faded contacts are last-known, not live.
- 1h
- 1d
- 3d
- 7d
Contacts drop off the map after 7 days without a fix.
- Dashed amber box — a chokepoint zone. Counts in the header are contacts inside it.
- Dotted amber outline — monitored coverage. Empty sea outside it means unwatched, not empty.
- Amber ring — the selected contact. The rest of the field recedes while you investigate.
- Amber line — the last 24 hours of fixes for the selected contact, when any exist.
- White chevron — reported heading, drawn only when the vessel is under way and the heading is valid.
- OBS Observed — a fact from the AIS feed: a fix, a destination change. Reliable to the extent the transponder is.
- DET Detector — a conclusion drawn from observations, with a confidence. Can be wrong; the thresholds are below.
- REF Reference — an external listing (OpenSanctions). Authoritative about the list, not about what the vessel is doing today.
Timestamps are separated on purpose: refreshed is when the site last asked the database; latest fix is the newest observation anywhere; observed on a contact is that contact's own last fix. Only the last one tells you how current a position is.
- ⌘K jumps to a vessel, a chokepoint or a page from anywhere.
- The link icon on a contact copies a URL that reproduces the contact, the map view and your filters.
- Current watch on the live map lists the three things most worth a look right now, each one tap from its evidence.
Vessel stops broadcasting AIS signal while in a known coverage zone. Normal gaps in open ocean are excluded. Only gaps detected within monitored regional bounding boxes are flagged.
Vessel moving below 3 knots outside a known anchorage area, remaining within a 5 nautical mile radius for an extended period. Indicates possible at-sea waiting for a clandestine transfer or rendezvous.
Vessel speed drops below 3 knots outside port or anchorage areas. May indicate drifting, a disabled vessel, or intentional speed reduction to avoid detection windows.
Vessel heading contradicts its declared AIS destination. Detected by geocoding the declared destination via Nominatim and comparing actual heading to expected bearing. A deviation is confirmed when all positions over a 2-hour window show inconsistent heading.
Vessel has gone dark 3 or more times within a rolling 30-day window. Pattern strongly indicates deliberate AIS manipulation rather than equipment failure or communication blackspots.
Two vessels detected within 0.5 nautical miles of each other for 30 or more consecutive minutes. Ship-to-ship transfers at sea are a primary method for sanctions evasion and oil laundering: cargo is transferred between vessels to obscure origin.
A composite score (0-100) that aggregates evasion signals per vessel. Higher scores indicate a stronger pattern of behavior associated with sanctions evasion or illicit oil trade. The score updates whenever new anomaly events are detected.
| Factor | Points | Notes |
|---|---|---|
| Going Dark History | 8 pts / event | Capped at 40 pts (5 events max contribution) |
| Sanctions Match | 25 pts | Binary: vessel IMO appears in OpenSanctions database |
| Flag State Risk | 15 pts | High-risk flags: IR, RU, VE, KP, PA, CM, KM |
| Loitering History | 10 pts | Binary: any loitering event in past 90 days |
| STS Transfer History | 10 pts | Binary: any STS transfer event on record |
| Total Maximum | 100 pts |