Drug trafficking behavioral patterns insights
Comoros surfaces as a top-2 or #1 flag across four independent indicators β baseline population, dark activity, MMSI changes, and first-time visits. A registry that keeps recurring across unrelated behaviors is a stronger red flag than any single metric, pointing to the flag itself β not just individual vessels β as a smuggling enabler worth prioritizing for enhanced screening.
Layering vessel registration and beneficial ownership across different flags is a classic way to obscure who actually controls a vessel, frustrating attribution and asset seizure after an interdiction. Marshall Islandsβ outsized share of ownership β despite a lower vessel-flag rank β points to where the real controlling entities sit, not just where vessels happen to be registered.
MMSI changes let a vessel intermittently masquerade under a different identity, breaking the track history investigators would otherwise use to link a vessel to past smuggling runs, rendezvous points, or known trafficking networks. Because MMSI-change vessels carry the highest High-Risk rate of any indicator, identity manipulation is the single most efficient signal for prioritizing interdiction and inspection resources.
Cocaine trafficking is often assumed to run one-way, north from South American production hubs to European and North American markets. Both SouthβNorth and NorthβSouth movement remain substantial this month β likely also carrying cash, precursors, or return logistics β meaning surveillance still needs to cover both directions, not just the northbound leg.
Different evasion techniques cluster in different regions: Middle East and Black Sea operators favor going dark (AIS shut-off), while East and Southeast Asia favors MMSI spoofing. No single detection method works everywhere, so regional monitoring needs to be tailored to whichever evasion behavior actually dominates in that patrol area.
Vessel flag and registered-owner flag diverge sharply: π΅π¦Β Panama leads the vessel register, π²πΒ Marshall Islands the owner register. That split is a flag-of-convenience structuring signal, consistent with evasion behavior.
Windward doesn't only score vessels β registered owners (companies) get their own risk score too. This is the share of the 2,548 unique owners behind this population that are themselves rated High Risk.
- π΅π¦Β Panama, π°π²Β Comoros and Saint Kitts & Nevis together account for 38.5% of the entire August risk population (1,094 of 2,840 vessels) β three flags carry over a third of the fleet.
- General Cargo and Bulk Carrier subclasses make up 71.2% of vessels (2,021 of 2,840), confirming this population is overwhelmingly bulk/general trade shipping rather than specialized craft.
- Registered owner flag diverges sharply from vessel flag: only 368 of 2,740 vessels with both fields populated (13.4%) share the same flag as their registered owner β 86.6% are structured so the vessel's flag and the owner's flag differ, the clearest fingerprint of flag-of-convenience layering in this month's data.
- π²πΒ Marshall Islands is the single largest registered-owner flag (561 vessels, 19.8%) despite ranking only 4th among vessel flags (165) β ownership is far more concentrated in Marshall Islands than the vessel-flag distribution alone would suggest.
- Registered Owner Risk is rated High for 224 vessels (7.9% of the population) β notably lower than the 12.1% rated High on Smuggling Risk overall, suggesting ownership risk and smuggling risk are scored on different signals rather than one driving the other.
- 2,548 unique registered owners sit behind 2,840 vessels β ownership is almost as fragmented as the fleet itself, with very little consolidation under a small number of owner entities.
607 events Β· 33.3% of all dark activity β the dominant region this month, alongside Black Sea / Ukraine War Zone (353 events, 19.4%). Together these two account for over half of all dark-activity events β consistent with sanctions-evasion-adjacent traffic and not necessarily a narcotics-specific pattern.
- 916 of the 2,840 baseline vessels (32.3%) went dark at least once in August β almost exactly a third of the whole risk population showed this behavior.
- Middle East / Persian Gulf (33.3%) and Black Sea / Ukraine War Zone (19.4%) together account for over half of all dark-activity events, consistent with sanctions-evasion-adjacent traffic and not necessarily a narcotics-specific pattern.
- Repeat behavior is concentrated but not flag-exclusive: π΅π¦Β Panama supplies the most repeat offenders in absolute terms (11 vessels with 5+ events), but π§πΏΒ Belize, πΉπ¬Β Togo and πΉπΏΒ Tanzania each contribute proportionally more of their fleet to the repeat-offender group.
- π΅π¦Β Panama and π°π²Β Comoros again top the flag list for dark-activity vessels, mirroring their dominance in the baseline population β but π°π²Β Comoros, π°π³Β St Kitts & Nevis, πΉπΏΒ Tanzania and π§πΏΒ Belize are all somewhat over-represented here relative to their baseline share.
π¨π³Β China alone 21 of those.
Third: a π°π²Β Comoros-flagged vessel β 7 events Moderate.
7Comoros
2Belize
2Cameroon
1Liberia- MMSI change remains concentrated in East & Southeast Asia (34.4% of events) β π¨π³Β China alone accounts for 21 of the region's 65 events β a similar level of concentration to this month's dark-activity hotspot (Middle East / Persian Gulf, 33.3%), rather than the sharper contrast seen last month.
- π°π²Β Comoros is both the top flag by vessel count (32) and supplies the most repeat offenders (7 vessels with 2+ events) β the strongest single-flag concentration seen across any August activity type.
- 15.9% of MMSI-change vessels are High Risk β a higher High-Risk share than the baseline population (12.1%) or dark activity (9.4%), suggesting identity-switching correlates more with elevated risk than simply going dark does.
- The most frequent identity-switching this month is a tie: a π±π·Β Liberia-flagged Cement Carrier and a πΉπΏΒ Tanzania-flagged General Cargo ship, both rated Moderate Risk, each changing MMSI 8 times β a less extreme concentration than July's single 11-event, High Risk outlier.
- North Atlantic (35.7%) and South Atlantic (35.7%) together account for 71% of first-time-visit events β the dominant signature of the South AmericaβtoβWest Africa/Europe transatlantic cocaine corridor.
- The most common zone-to-zone transition is North Atlantic β South Atlantic (10 vessels), with the reverse South Atlantic β North Atlantic close behind (7 vessels) β a genuinely two-way corridor, not a one-directional route.
- 19 of 79 vessels (24.1%) registered first-time entries into more than one zone in the same month β all of them crossing directly between North and South Atlantic. No vessel this month crossed into a third zone, unlike July's single three-zone sequence.
- Two secondary clusters sit alongside the dominant Atlantic corridor: Caribbean & Latin America (π¨π΄Β Colombia, π»πͺΒ Venezuela, π§π·Β Brazil, Peru β 12 events) and the Indian Ocean (9 events) β the Indian Ocean cluster is a new pattern not seen in July's data.
- π°π²Β Comoros leads the flag list (17 vessels), with π΅π¦Β Panama close behind (16) for first-time visits β the same two flags that lead the baseline population and dark-activity lists, reinforcing them as the two flags to prioritize across every activity type this month.
Stay ahead of what's moving across the cocaine corridors
Windward's Maritime Intelligence Operations Center (MIOC) fuses Maritime AI™, all‑source intelligence, and expert analysts to deliver continuous monitoring, rapid investigations, and reporting that drives strategic, operational, and risk decisions.
Every flag, owner and behavior in this dashboard is watched the same way, every day — so when a vessel's pattern breaks, you hear it from an analyst, with the evidence attached.
Learn moreAnatomy of a drug bust
How one vessel gave itself away. Windward analysts walk the behavioral trail — an invalid MMSI, a dark gap, a first-time call — from a routine cargo run to a cocaine seizure at sea.
The video can’t play in the page on this device — the YouTube player didn’t answer and there’s no local copy to fall back to. Watch it on YouTube
The June deep-dive behind this month's numbers — narcotics threat trends, trafficking corridors, and the evasion behaviors driving them.
Read More
A 63-year-old cargo vessel reflagged to landlocked Mali, dark for 30 days across 1,790 nautical miles of Atlantic transit, now under tow into the Amazon estuary — measured against the UNITED S, seized in Spain with 10 tonnes of cocaine.
Read More
4,973 kg of methamphetamine — the largest maritime drug seizure in Asia-Pacific history — on a vessel that had already renamed itself from HE TAI. Regional seizures hit 349 metric tons in 2025, up 48% year-on-year.
Read More