The hide and seek game of sanctioned tankers

The resignation of Lebanon’s president and his government have thrown the country into a political crisis. On August 26th, news reported that Iran would ship more fuel to Lebanon and said more vessels carrying Iranian fuel would sail soon. An Iranian sanctioned tanker, the FAXON, which recently operated in Venezuela, is, according to some reports, supposed to arrive in Lebanon – but hasn’t left yet. Our system revealed that the FAXON actually has begun its journey. So why would news outlets report differently? The FAXON’s identifiers are being transmitted by a decoy vessel to disguise the FAXON’s true location. In this blog, I’ll walk through just how we were able to detect this deceptive practice. 

Understanding manipulation

To keep up with increasingly sophisticated deceptive practices, simply detecting the presence or absence of an AIS transmission is not enough. When it comes to cases of identity manipulation, the more data, the better. In addition to leveraging strong behavioral analytics, satellite imagery can add important context and help confirm if the information transmitted via the AIS systems makes sense. For example, when looking at the FAXON, its satellite image at Khor Fakan on August 24th, matched a typical Handymax measurement of 176 meters. But on August 25th, the FAXON would transmit an AIS signal with a measurement of 330 meters. 

On the 25th of August, the FAXON engaged in a ship-to-ship (STS) activity in the Iranian EEZ with a non-transmitting vessel. Our system detected the FAXON was drifting at a very slow speed – indicative of a STS meeting. Following this event, the FAXON arrived at Bander E Jask, and then it went dark. When it turned its AIS back on, the vessel transmitted its location as Bandar Siraf, 315 nautical miles away. But the FAXON was not actually there. Why? The size reported at transmission didn’t correspond to the original size of the FAXON, confirmed by satellite imaging. So unless it magically grew to 330 meters – the FAXON could not have been at Bander Siraf. This triggered our system to automatically flag the event for ID & Location Tampering. Where the vessel currently is is an open question mark. When looking at the positional data of the vessel in other data provider systems’, the vessel appears in Iran – with no red flags. 

Detecting deceptive practices with the right tools

A change in vessel specifications is not inherently risky. However, by training a system that knows how to recognize identity and location manipulation, it becomes possible to contextualize AIS data and understand how it compares to the historical data of that vessel. Without the ability to detect cases like these, stakeholders will always be one step behind deceptive practices. If the vessel isn’t in Bandar Siraf, then where is it? Did it part for Lebanon? Will it cross the Suez Canal, or like the GRACE 1, will it take the long route around? What activity is going undetected? Are there other vessels are doing the same thing? What operations could they be engaged in without you knowing? Leaving these questions unanswered can leave risk unaccounted for. 

Windward goes beyond AIS and leverages multiple data sources to detect sophisticated deceptive practices. For example, with HawkEye 360’s RF signal layers and Planet satellite imagery, we can accurately validate and support anomaly detection and behavioral insights. When it comes to managing high-risk threats, this accuracy is mission-critical. Sanctioned vessels will always find ways to continue to operate. Leveraging a system that can automatically detect identity and location manipulation is key to staying ahead of sanction evaders, no matter their latest tricks and methods of deception.

Featured resources

Data & AI Tech

2025: The Year for Building a Resilient Data Strategy

Data resilience is the foundation of reliable operations. To deliver unmatched curated data and insights powered by Windward Maritime AIâ„¢, we’ve collaborated with globally recognized data providers. As the AIS data market keeps on evolving, these strategic partnerships ensure redundant data sources are in place, safeguarding continuity even in the face of acquisitions or closures….

Read more

In the Spotlight

Global Trade Lessons from 2024 to Help Optimize in 2025

If there’s one thing 2024 taught us about the maritime and supply chain ecosystems, it’s that change is constant – and often unpredictable. To succeed, organizations must be proactive and agile, ensuring that their strategic decision-making is built on a foundation of flexibility and foresight. This blog leverages insights from Windward’s 2025 Top Trends in…

Read more

Risks & Compliance

The EU’s 15th Sanctions Package: Targeting Russia’s Shadow Fleet

The European Union has introduced the 15th sanctions package, in its continued effort to address sanctions circumvention and undermine Russia’s military and industrial capabilities. It targets 52 additional ships involved in high-risk activities, including transporting oil, arms, and stolen Ukrainian grain.  Escalating Measures Against Russia’s Shadow Fleet The EU’s focus in this sanctions package is…

Read more

Border Security & Intelligence

4 Tons of Cocaine Seized by Windward Customers 

Windward customers keep winning!  A Spanish operation in the Atlantic led to the seizure of 4 tons of cocaine, according to a LinkedIn post from the Maritime Analysis and Operations Centre – Narcotics (MAOC-N).  Shared Intel & Operational Plan Lead to Huge Drug Bust The MAOC-N is an initiative by nine EU Member Countries (France,…

Read more