GUIDES

Five Vessel Behaviors That Kill a Fixture and How to Spot Them

Request a demo

What’s inside?

By mid-2026, roughly a quarter of all crude tankers were operating outside the rules-based order, up from 20% a year earlier. Windward tracks about 2,000 dark fleet vessels. Any one of them can screen clean on paper and still carry a behavioral history that becomes your exposure the moment you sign.

Enforcement has moved the same direction. Vessels are increasingly flagged and acted on for behavior — identity manipulation, uneconomic routing, spoofed positions — not only for sanctioned status or cargo. Interdictions rose about 160% against the prior quarter, and roughly 85% of the vessels interdicted were falsely flagged. Behavior is a risk indicator in its own right now, and the screening that catches it has to happen before the deal, not after.

Static screening tells you who a vessel is on paper. Behavioral screening tells you what it does. The five behaviors below are the ones that most reliably separate a clean fixture from an exposure event. For each, the same three questions: what it looks like, why it kills the fixture, and what to verify before you sign or walk.

Windward’s 2,000+ tracked dark fleet vessels. Source: Windward Maritime AI™ Platform

1. Going Dark in the Wrong Place

What it looks like: An AIS gap is not automatically a red flag. Coverage drops and equipment fails. What matters is where and when the vessel goes dark. A gap that lines up with a known ship-to-ship area, a sanctioned loading point, or a stretch of coastline the vessel had no commercial reason to be near is a different signal entirely. So is a pattern of gaps. A vessel that repeatedly disappears at the same kind of location is telling you something its reporting is not.

Why it kills the fixture: The dark period is exactly where the declared voyage and the real one diverge. If you cannot account for where a vessel was during a gap, you cannot stand behind a cargo-origin warranty, a clean-load representation, or a sanctions attestation that depends on it. The exposure is not the gap itself. It is everything you are signing that assumes the gap was innocent.

What to verify: Do not resolve the gap using the vessel’s own reporting. Cross-reference it against independent sources — remote sensing (SAR and RF) and the vessel’s broader behavioral history. A single explained gap in a covered lane is one thing. A recurring gap over a high-risk zone, unconfirmed by any independent signal, is a reason to ask hard questions before you fix. Uneconomic routing is the same class of signal: Windward tracked a group of 12 EU/UK-sanctioned tankers making repeated diversions around Great Britain, adding hundreds of nautical miles to trade voyages purely to reduce enforcement exposure. A voyage that makes no commercial sense is telling you something.

The check also has to work in the other direction against false positives. Many screening tools flag any gap near a sanctioned area as a risk event, without asking whether the vessel could physically have gotten there. Windward runs a speed-and-distance feasibility test first: if the vessel never had the time to reach the area and conduct an activity, it is not a hit. That is the difference between a gap that kills a fixture and a gap that wastes an afternoon.

Satellite Imagery — Windward SAR imagery confirms the location of three vessels transiting dark (AIS off), along with their approximate direction of travel.
Source: Windward Remote Sensing Intelligence

2. A Position that Doesn’t Hold Up

What it looks like: Location manipulation (GNSS spoofing) is a vessel reporting one position while operating in another. Unlike a gap, the track looks continuous and plausible. That is the point. A spoofed position can place a vessel comfortably in a legitimate lane on your screen while it is hundreds of nautical miles away doing something it would rather you not see.

Why it kills the fixture: Cargo origin is the exposure. If a vessel can fabricate its position, it can obscure where a shipment was actually loaded, the single fact most sanctions and trade-compliance obligations turn on. A fixture built on a spoofed track is a fixture built on a location the vessel chose to show you, not the one it was in.

What to verify: A reported position is a claim, not a confirmation. Independent verification through multi-source fusion, corroborating the AIS-reported track against satellite and signal data, is what separates a real position from a manufactured one.

Windward SAR imagery confirms the M/T Veronica spoofing its AIS location to hide its true position. January 2026. Source: Windward Remote Sensing Intelligence — Windward SAR imagery confirms the M/T Veronica spoofing its AIS location to hide its true position. January 2026.
Source: Windward Remote Sensing Intelligence

3. A Vessel Wearing a New Identity

What it looks like: MMSI changes, name changes, flag hopping, registry hopping. Individually, each has legitimate explanations — a sale, a reflag, a genuine administrative change. Stacked together, and timed to follow a period of high-risk activity, they read differently: a deliberate effort to break the history trail so the vessel arrives at your desk looking new. This is not a fringe tactic. Around 700 tankers changed flags two to six times during 2025, and the count of falsely flagged ships reached roughly 546 by mid-2026, up from 470 at the end of 2025, two-thirds of them tankers, average age 26 years.

Why it kills the fixture: A “new” vessel with a scrubbed past is often an old problem under a fresh flag. If you screen the current identity and stop there, you inherit whatever the previous identity was doing — sanctioned trade, deceptive routing, a seizure history — without knowing it. The clean counterparty in front of you may be one name change removed from an exposure you would never have accepted.

What to verify: Reconstruct the identity timeline before you treat the vessel as clean. Tie the current MMSI, name, and flag back through prior identities and flag histories. The scale one hull can reach is illustrated by the falsely flagged tanker Invicta (IMO 9250543): across roughly three years Windward recorded 58 different names, 98 MMSI changes, and 117 flag changes — and after Cameroon expelled it from the registry in May 2026, it kept broadcasting the Cameroon flag while loading in Russia. It is not an isolated case. When UK forces interdicted the Cameroon-flagged SMYRTOS in the English Channel in June 2026, it sat inside a cluster of 38 vessels Cameroon expelled that month, 37 of them already sanctioned. A “new” identity is often the same network under a fresh flag.

Falsely flagged Invicta sails towards the Danish Strait after loading in Russia, careful to avoid territorial waters on June 20, 2026. Source: Windward Maritime AI™ Platform — Falsely flagged *Invicta* sails towards the Danish Strait after loading in Russia, careful to avoid territorial waters on June 20, 2026.
Source: Windward Maritime AI™ Platform

4. Ship-to-Ship Transfers that Don’t Add Up

What it looks like: Ship-to-ship transfers are routine and legitimate across most of global trade, but STS in international waters now sits among the deceptive practices Windward is tracking at increasing levels. The behavioral signal is the transfer that sits outside the pattern: STS in an unusual location, drifting in international waters with no operational reason, or with a counterparty that carries its own risk history. A transfer that a vessel appears to have gone out of its way to conduct quietly is the one worth examining.

Why it kills the fixture: STS in international waters is a primary mechanism for obscuring cargo origin — the way sanctioned or high-risk volumes get laundered into a clean-looking supply chain. If your cargo touched a transfer you cannot fully account for, the origin you are representing may not survive scrutiny. The counterparty on the other side of that transfer becomes part of your exposure whether you screened them or not.

What to verify: Confirm the transfer behaviorally and independently = behavioral classification of the STS event plus remote sensing confirmation of what happened and who was involved. Screen the counterparty vessel, not only the one you are fixing.

Satellite imagery showing a ship-to-ship meeting occurring on December 13, 2025. Source: Windward Remote Sensing Intelligence

5. Ownership Engineered to Hide

What it looks like: Opaque ownership structures, control layers that resolve to sanctioned or high-risk entities, and operational tells like first-time port calls that deviate from the vessel’s established trade pattern. The vessel itself may screen clean. The exposure sits one or two layers up the ownership chain, or in a beneficial owner the surface documents were designed not to show.

Why it kills the fixture: Sanctions and counterparty risk do not stop at the hull. A vessel controlled,directly or through intermediaries, by a sanctioned or high-risk party carries that exposure into your deal regardless of what its flag or its papers say. Ownership built to obscure is ownership built to move risk past exactly the kind of check you are running.

What to verify: Resolve the ownership. Trace ultimate beneficial ownership and entity relationships across maritime and non-maritime links, and treat a structure engineered for opacity as a finding in itself, not a formality to clear. Pair it with the behavioral picture: a clean-looking owner attached to a vessel exhibiting the four behaviors above is not a clean owner.

Screening the Five Before the Next Fixture

None of these five behaviors is visible from a watchlist or a set of documents. They live in what the vessel does, and by the time they surface in an enforcement action or a designation, the fixture is signed and the exposure is booked. The organizations clearing deals with confidence in 2026 are the ones screening on behavior before signature, not reconciling it after.

That is the gap Windward closes: the distance between what the paperwork claims and what actually happened at sea. Windward’s Maritime AI™ platform fuses AIS, satellite (SAR, EO, RF), ownership data, and behavioral analytics into a single picture, so a dark gap, a spoofed track, a scrubbed identity, an anomalous STS, or an engineered ownership chain shows up as a screenable signal rather than a post-mortem finding. AI-Automated Document Validation checks declared cargo origin and voyage detail against observed vessel behavior. MAI Expert™, Windward’s Gen AI maritime agent, puts that screening at the desk, in minutes, in plain language.

For a trading or chartering team, that is two things at once. It is defense: fewer tainted cargoes, fewer sanctions surprises, fewer deals that unravel after they clear. And it is speed: the clean fixtures clear faster, with a defensible record behind the decision, while competitors are still screening on documents alone. Seeing the risk before it becomes exposure is not only how you avoid the bad fixture. It is how you win the good one first.

Screen the vessel, the counterparty, and the ownership before you sign.

🇮🇷 TRACK VESSEL ACTIVITY IN THE STRAIT OF HORMUZ 🇮🇷