Drug trafficking behavioral patterns insights

Published: September 2026 Reporting Period: August 2026
Bottom line up front
Vessels tracked63July 2026: 2,777Change against July 2026, the previous month. Hover any change for July’s own figure. NEW = not in July’s list.
2,840 Moderate + High Risk
Moderate Risk vessels71July 2026: 2,425
2,496 of the 2,840 base-population vessels
High Risk vessels8July 2026: 352
344 of the 2,840 base-population vessels
Top flagJuly 2026: πŸ‡΅πŸ‡¦ Panama (21.2% of population) β€” no change
πŸ‡΅πŸ‡¦ Panama Largest flag in the population
01
πŸ‡°πŸ‡²Β Comoros: strongest cross-cutting signal
Top-2 in the baseline population and dark activity. Top flag in both MMSI changes and first-time visits. No other registry matches all four.

Comoros surfaces as a top-2 or #1 flag across four independent indicators β€” baseline population, dark activity, MMSI changes, and first-time visits. A registry that keeps recurring across unrelated behaviors is a stronger red flag than any single metric, pointing to the flag itself β€” not just individual vessels β€” as a smuggling enabler worth prioritizing for enhanced screening.

02
Ownership structuring is the norm
Only 13.4% of vessels share flag and owner. πŸ‡²πŸ‡­Β Marshall Islands is the #1 owner flag (19.8%) despite ranking 4th by vessel flag – ownership is far more concentrated.

Layering vessel registration and beneficial ownership across different flags is a classic way to obscure who actually controls a vessel, frustrating attribution and asset seizure after an interdiction. Marshall Islands’ outsized share of ownership β€” despite a lower vessel-flag rank β€” points to where the real controlling entities sit, not just where vessels happen to be registered.

03
MMSI changes: sharpest risk concentration
MMSI-change vessels are High Risk 15.9% of the time – vs 12.1% baseline and 9.4% for dark-activity vessels. Identity manipulation is the strongest risk signal.

MMSI changes let a vessel intermittently masquerade under a different identity, breaking the track history investigators would otherwise use to link a vessel to past smuggling runs, rendezvous points, or known trafficking networks. Because MMSI-change vessels carry the highest High-Risk rate of any indicator, identity manipulation is the single most efficient signal for prioritizing interdiction and inspection resources.

04
Atlantic corridor runs both ways
71% of first-time visits fall in North or South Atlantic zones. Northβ†’South (10 vessels) leads Southβ†’North (7) this month – still bidirectional traffic on the cocaine corridor, but with a heavier northbound-to-southbound tilt than last month.

Cocaine trafficking is often assumed to run one-way, north from South American production hubs to European and North American markets. Both South→North and North→South movement remain substantial this month — likely also carrying cash, precursors, or return logistics — meaning surveillance still needs to cover both directions, not just the northbound leg.

05
Dark activity and MMSI changes: opposite geographies
Middle East + Black Sea drive 53% of dark events but 33% of MMSI changes. East & SE Asia drives 34% of MMSI changes but just 16% of dark activity.

Different evasion techniques cluster in different regions: Middle East and Black Sea operators favor going dark (AIS shut-off), while East and Southeast Asia favors MMSI spoofing. No single detection method works everywhere, so regional monitoring needs to be tailored to whichever evasion behavior actually dominates in that patrol area.

Base Population
The Moderate + High smuggling-risk universe – all other indicators are subsets of this group. Flags and subclasses here set the baseline against which every indicator is measured.
Signal

Vessel flag and registered-owner flag diverge sharply: πŸ‡΅πŸ‡¦Β Panama leads the vessel register, πŸ‡²πŸ‡­Β Marshall Islands the owner register. That split is a flag-of-convenience structuring signal, consistent with evasion behavior.

Top flags Β· vessel registry
Vessel subclass breakdown
Registered owner flags
Owner risk assessment

Windward doesn't only score vessels – registered owners (companies) get their own risk score too. This is the share of the 2,548 unique owners behind this population that are themselves rated High Risk.

139 HIGH-RISK OWNERS 218
5.5% of 2,548 unique owners of High and Moderate Risk vessels
Global event coverage
Every behavior in this dashboard on one map, across 12 maritime regions. Ring size is a region's combined event count; the ring's segments are its split by event type.
Surface patterns & insights
  • πŸ‡΅πŸ‡¦Β Panama, πŸ‡°πŸ‡²Β Comoros and Saint Kitts & Nevis together account for 38.5% of the entire August risk population (1,094 of 2,840 vessels) – three flags carry over a third of the fleet.
  • General Cargo and Bulk Carrier subclasses make up 71.2% of vessels (2,021 of 2,840), confirming this population is overwhelmingly bulk/general trade shipping rather than specialized craft.
  • Registered owner flag diverges sharply from vessel flag: only 368 of 2,740 vessels with both fields populated (13.4%) share the same flag as their registered owner – 86.6% are structured so the vessel's flag and the owner's flag differ, the clearest fingerprint of flag-of-convenience layering in this month's data.
  • πŸ‡²πŸ‡­Β Marshall Islands is the single largest registered-owner flag (561 vessels, 19.8%) despite ranking only 4th among vessel flags (165) – ownership is far more concentrated in Marshall Islands than the vessel-flag distribution alone would suggest.
  • Registered Owner Risk is rated High for 224 vessels (7.9% of the population) – notably lower than the 12.1% rated High on Smuggling Risk overall, suggesting ownership risk and smuggling risk are scored on different signals rather than one driving the other.
  • 2,548 unique registered owners sit behind 2,840 vessels – ownership is almost as fragmented as the fleet itself, with very little consolidation under a small number of owner entities.
Dark Activity
Turning off AIS transmission to avoid detection – obscuring a vessel's movements and behavior. The most common evasion behavior in the population. A known indicator of smuggling-related activity, including narcotics trafficking.
Vessels with dark events
916
9July 2026: 925
of 2,840 tracked vessels
Total dark events1,823 events is higher than the 916 vessels with dark events because some vessels went dark more than once during August.
1,823
16July 2026: 1,839
Avg 2.0 events/vessel
Moderate Risk vessels
830
6July 2026: 824
of the 916 vessels with dark events
High Risk vessels
86
15July 2026: 101
of the 916 vessels with dark events – below base rate
Median dark duration
51.2h
9.7hJuly 2026: 41.5h
per event
Standout Β· Middle East / Persian Gulf

607 events Β· 33.3% of all dark activity – the dominant region this month, alongside Black Sea / Ukraine War Zone (353 events, 19.4%). Together these two account for over half of all dark-activity events – consistent with sanctions-evasion-adjacent traffic and not necessarily a narcotics-specific pattern.

Top flags Β· dark activity vessels
πŸ‡°πŸ‡²Β Comoros is the only flag also top-3 in MMSI changes and first-time visits.
Top 5 subclasses Β· dark activity vessels
Nearly half of all dark activity events were conducted by General Cargo vessels.
Regional cluster breakdown
Top 10 regions by number of dark activity events. The number on each bubble is the event count for that region; bubble size scales with the count.
1 Middle East / Persian Gulf 607 2July 2026: 609
2 Black Sea / Ukraine War Zone 353 37July 2026: 390
3 East & Southeast Asia 299 16July 2026: 283
4 Red Sea / Horn of Africa 171 17July 2026: 188
5 Mediterranean / Europe 116 22July 2026: 138
6 Caribbean & Latin America 98 5July 2026: 93
7 West Africa 74 24July 2026: 50
8 Indian Ocean / South Asia / East Africa 57 1July 2026: 56
9 Pacific Islands / Oceania 26 1July 2026: 27
10 Open Ocean / High Seas 22 18July 2026: 4
High-level insights & takeaways
  • 916 of the 2,840 baseline vessels (32.3%) went dark at least once in August – almost exactly a third of the whole risk population showed this behavior.
  • Middle East / Persian Gulf (33.3%) and Black Sea / Ukraine War Zone (19.4%) together account for over half of all dark-activity events, consistent with sanctions-evasion-adjacent traffic and not necessarily a narcotics-specific pattern.
  • Repeat behavior is concentrated but not flag-exclusive: πŸ‡΅πŸ‡¦Β Panama supplies the most repeat offenders in absolute terms (11 vessels with 5+ events), but πŸ‡§πŸ‡ΏΒ Belize, πŸ‡ΉπŸ‡¬Β Togo and πŸ‡ΉπŸ‡ΏΒ Tanzania each contribute proportionally more of their fleet to the repeat-offender group.
  • πŸ‡΅πŸ‡¦Β Panama and πŸ‡°πŸ‡²Β Comoros again top the flag list for dark-activity vessels, mirroring their dominance in the baseline population – but πŸ‡°πŸ‡²Β Comoros, πŸ‡°πŸ‡³Β St Kitts & Nevis, πŸ‡ΉπŸ‡ΏΒ Tanzania and πŸ‡§πŸ‡ΏΒ Belize are all somewhat over-represented here relative to their baseline share.
MMSI Changes
Switching a vessel's unique AIS identifier – often paired with a flag change to re-register identity and break the link to its prior track record.
Vessels
138
19July 2026: 119
of 2,840 tracked vessels
Total events190 events is higher than the 138 vessels involved because some vessels changed their MMSI identity more than once during August.
190
30July 2026: 160
Avg 1.4/vessel
Moderate Risk vessels
116
15July 2026: 101
of the 138 MMSI-change vessels
High Risk vessels
22
4July 2026: 18
of the 138 MMSI-change vessels – highest of any indicator
Cross-indicator signal
πŸ‡°πŸ‡²Β Comoros appears for the third time
The only flag registry in the top flags of Dark Activity, MMSI Changes, and First-Time Visits simultaneously. No other registry manages this across all three evasion dimensions.
Dark activity #2 Β· 163 MMSI changes #1 Β· 32 First-time visits #1 Β· 17
Top flags Β· MMSI change vessels
πŸ‡°πŸ‡²Β Comoros leads with 32 vessels Β· the strongest single-flag signal of any indicator this month.
Top 5 subclasses Β· MMSI change vessels
General Cargo narrowly leads Bulk Carrier (47 vs 43) – identity-switching this month is split almost evenly between bulk commodity shipping and general cargo.
Regional cluster breakdown
East & SE Asia dominates (65 events, 34.4%) Β·
πŸ‡¨πŸ‡³Β China alone 21 of those.
1East & Southeast Asia651July 2026: 66
2Middle East / Persian Gulf4715July 2026: 32
3Mediterranean / Europe215July 2026: 26
4Black Sea / Ukraine War Zone1512July 2026: 3
5Red Sea / Horn of Africa111July 2026: 10
6Indian Ocean / South Asia / East Africa112July 2026: 9
7West Africa94July 2026: 5
8Caribbean & Latin America7July 2026: 7 β€” no change
9Pacific Islands / Oceania21July 2026: 1
10Open Ocean / High Seas1July 2026: 1 β€” no change
Repeat-Offender Snapshot
Top vessels (tied): a πŸ‡±πŸ‡·Β Liberia-flagged Cement Carrier and a πŸ‡ΉπŸ‡ΏΒ Tanzania-flagged General Cargo – 8 MMSI-change events each this month Moderate.
Third: a πŸ‡°πŸ‡²Β Comoros-flagged vessel – 7 events Moderate.
7Comoros
2Belize
2Cameroon
1Liberia
High-level insights & takeaways
  • MMSI change remains concentrated in East & Southeast Asia (34.4% of events) – πŸ‡¨πŸ‡³Β China alone accounts for 21 of the region's 65 events – a similar level of concentration to this month's dark-activity hotspot (Middle East / Persian Gulf, 33.3%), rather than the sharper contrast seen last month.
  • πŸ‡°πŸ‡²Β Comoros is both the top flag by vessel count (32) and supplies the most repeat offenders (7 vessels with 2+ events) – the strongest single-flag concentration seen across any August activity type.
  • 15.9% of MMSI-change vessels are High Risk – a higher High-Risk share than the baseline population (12.1%) or dark activity (9.4%), suggesting identity-switching correlates more with elevated risk than simply going dark does.
  • The most frequent identity-switching this month is a tie: a πŸ‡±πŸ‡·Β Liberia-flagged Cement Carrier and a πŸ‡ΉπŸ‡ΏΒ Tanzania-flagged General Cargo ship, both rated Moderate Risk, each changing MMSI 8 times – a less extreme concentration than July's single 11-event, High Risk outlier.
First-Time Visits
First entry into a known trafficking corridor – no prior recorded history in the zone. A leading indicator when it aligns with known transit routes. 71% of events fall in North or South Atlantic – the cocaine corridor, running both ways.
Unique vessels
79
13July 2026: 66
of 2,840 tracked vessels
Total events98 events is higher than the 79 vessels because some vessels made more than one first-time visit during August.
98
9July 2026: 89
Avg 1.2/vessel
Moderate Risk vessels
70
8July 2026: 62
of the 79 first-time-visit vessels
High Risk vessels
9
5July 2026: 4
of the 79 first-time-visit vessels – corridor pattern is the signal
Multi-zone vessels
19/79
1July 2026: 18/66
Crossed more than one zone for the first time
Top flags Β· first-time visit vessels
πŸ‡°πŸ‡²Β Comoros leads with 17 vessels, πŸ‡΅πŸ‡¦Β Panama close behind at 16 – same two flags that lead dark activity and the baseline.
Top 5 subclasses Β· first-time visit vessels
General Cargo dominant – bulk commodity ships traversing the transatlantic cocaine corridor.
Where events occurred
North Atlantic (35) and South Atlantic (35) Β· bidirectional corridor confirmed. Secondary clusters in Caribbean & Latin America and the Indian Ocean.
1North Atlantic Ocean352July 2026: 37
2South Atlantic Ocean351July 2026: 36
3Caribbean & Latin America124July 2026: 16
4Indian Ocean / South Asia9NEWNo events in July 2026
5Pacific Islands / Oceania7NEWNo events in July 2026
High-level insights & takeaways
  • North Atlantic (35.7%) and South Atlantic (35.7%) together account for 71% of first-time-visit events – the dominant signature of the South America–to–West Africa/Europe transatlantic cocaine corridor.
  • The most common zone-to-zone transition is North Atlantic β†’ South Atlantic (10 vessels), with the reverse South Atlantic β†’ North Atlantic close behind (7 vessels) – a genuinely two-way corridor, not a one-directional route.
  • 19 of 79 vessels (24.1%) registered first-time entries into more than one zone in the same month – all of them crossing directly between North and South Atlantic. No vessel this month crossed into a third zone, unlike July's single three-zone sequence.
  • Two secondary clusters sit alongside the dominant Atlantic corridor: Caribbean & Latin America (πŸ‡¨πŸ‡΄Β Colombia, πŸ‡»πŸ‡ͺΒ Venezuela, πŸ‡§πŸ‡·Β Brazil, Peru – 12 events) and the Indian Ocean (9 events) – the Indian Ocean cluster is a new pattern not seen in July's data.
  • πŸ‡°πŸ‡²Β Comoros leads the flag list (17 vessels), with πŸ‡΅πŸ‡¦Β Panama close behind (16) for first-time visits – the same two flags that lead the baseline population and dark-activity lists, reinforcing them as the two flags to prioritize across every activity type this month.
Windward MIOC

Stay ahead of what's moving across the cocaine corridors

Windward's Maritime Intelligence Operations Center (MIOC) fuses Maritime AI™, all‑source intelligence, and expert analysts to deliver continuous monitoring, rapid investigations, and reporting that drives strategic, operational, and risk decisions.

Every flag, owner and behavior in this dashboard is watched the same way, every day — so when a vessel's pattern breaks, you hear it from an analyst, with the evidence attached.

Learn more
Windward Maritime Intelligence Operations Center

Anatomy of a drug bust

How one vessel gave itself away. Windward analysts walk the behavioral trail — an invalid MMSI, a dark gap, a first-time call — from a routine cargo run to a cocaine seizure at sea.

Dive deeper
Why it matters