Drug trafficking behavioral patterns insights
A fall this steep is worth watching rather than celebrating. The vessels that kept switching identity are still the riskiest group in the dashboard (13.0% High Risk, vs 12.8% for the base population), so fewer switchers means each remaining one is a sharper lead for investigators — not that the behavior has gone away. Identity manipulation can come in waves as networks rotate vessels and registries, which is exactly what the new flags this month suggest.
Small registries that suddenly over-index on identity manipulation are an early-warning signal. Mozambique-flagged vessels are ten times more common among MMSI changers (3.9%) than in the base population (0.4%), and the Mongolia and São Tomé & Príncipe changes all took place in East and Southeast Asian waters. Flags with few vessels are cheap to adopt and drop, which makes newly active registries worth adding to screening lists before they scale.
A registry that keeps recurring across unrelated behaviors is a stronger red flag than any single metric. Comoros is only 12.4% of the base population but 19–24% of every behavioral indicator, pointing to the flag itself — not just individual vessels — as a smuggling enabler worth prioritizing for enhanced screening.
Middle East and Mediterranean dark activity is driven largely by sanctions-evasion traffic rather than narcotics. The more relevant shift for counter-narcotics is the fall along Caribbean and West African routes: fewer AIS gaps there can mean less activity — or vessels evading detection in other ways, which is why first-time visits and identity changes on the same corridors matter more this month.
Cocaine trafficking is often assumed to run one-way, north from South American production hubs to European and North American markets. This month movement is exactly balanced in both directions — the return leg likely also carrying cash, precursors, or return logistics — and more vessels are entering the corridor for the first time, so surveillance needs to cover both directions, not just the northbound leg.
Vessel flag and registered-owner flag diverge sharply: 🇵🇦 Panama leads the vessel register, 🇲🇭 Marshall Islands the owner register. That split is a flag-of-convenience structuring signal, consistent with evasion behavior.
Windward doesn't only score vessels – registered owners (companies) get their own risk score too. This is the share of the 2,528 unique owners behind this population that are themselves rated High Risk.
- Fewer vessels, riskier mix: the population shrank by 36 to 2,804 vessels, yet High Risk vessels rose by 14 to 358 – the High-Risk share climbs from 12.1% to 12.8% while Moderate Risk fell by 50.
- 🇸🇱 Sierra Leone is new to the vessel-flag top 10 (84 vessels, 3.0%) – and half of its fleet went dark this month (42 vessels, vs 32.6% for the population as a whole).
- Among the top flags, 🇱🇷 Liberia (164 → 140, −15%) and 🇲🇭 Marshall Islands (165 → 138, −16%) shrank the most, while 🇰🇲 Comoros (+12) and 🇰🇳 St Kitts & Nevis (+13) grew – the two flags at the center of this month’s behavioral signals.
- 🇵🇦 Panama, 🇰🇲 Comoros and Saint Kitts & Nevis now account for 39.4% of the risk population (1,105 of 2,804 vessels), up from 38.5% in August – concentration in the three leading flags is rising.
- Ownership layering is unchanged: only 14.2% of vessels share a flag with their registered owner (August: 13.4%), and 🇲🇭 Marshall Islands remains the #1 owner flag (558 vessels) despite ranking only 5th by vessel flag.
- High-Risk owners fell from 139 to 125 (4.9% of 2,528 owners). The owner registry is shifting too: 🇵🇦 Panama-registered owners rose by 11 (128 → 139) while 🇨🇳 China (−17), 🇹🇷 Turkey (−14) and 🇦🇪 UAE (−9) all fell.
673 events · 38.7% of all dark activity – the dominant region this month and up from 607 in August, alongside Black Sea / Ukraine War Zone (312 events, 18.0%). Together these two account for well over half of all dark-activity events – consistent with sanctions-evasion-adjacent traffic and not necessarily a narcotics-specific pattern.
- Fewer but longer dark periods: events fell by 85 (1,823 → 1,738) while the number of vessels held steady (914 vs 916), and the median dark period lengthened from 51.2h to 55.5h. Still a third of the risk population (32.6%) went dark at least once.
- Middle East / Persian Gulf (38.7%) and Black Sea / Ukraine War Zone (18.0%) together account for well over half of all dark-activity events, consistent with sanctions-evasion-adjacent traffic and not necessarily a narcotics-specific pattern. The Middle East is up 66 events on August, and East & Southeast Asia (312) now matches the Black Sea.
- Narcotics-relevant routes went quieter: Caribbean & Latin America fell 37% (98 → 62 events, led by 🇬🇾 Guyana with 20) and West Africa 39% (74 → 45), while the Mediterranean rose 35% (116 → 157), driven by 🇹🇷 Türkiye (80 events).
- 🇰🇲 Comoros overtakes 🇵🇦 Panama as the top dark-activity flag (177 vs 163 vessels) and is the most over-represented: 19.4% of dark-activity vessels vs 12.4% of the baseline. 🇹🇿 Tanzania and 🇰🇵 North Korea also over-index, while Panama under-indexes (17.8% vs 19.7%).
- 🇸🇱 Sierra Leone is new to the dark-activity top 10 at 42 vessels – 4.6% of dark-activity vessels against 3.0% of the population, with half its fleet going dark this month.
- Repeat behavior centres on Comoros: 15 🇰🇲 Comoros vessels logged 5+ dark events, nearly double 🇵🇦 Panama (8), out of 48 repeat offenders in all.
🇨🇳 China alone 14 of those.
Next (tied): a 🇰🇲 Comoros-flagged General Cargo and a 🇰🇳 St Kitts & Nevis-flagged cargo vessel – 5 events each Moderate.
3Comoros
2Mozambique
2St Kitts & Nevis
2Tanzania- MMSI changes nearly halved this month – 104 events across 77 vessels, down from 190 across 138 in August.
- Three flags are new to the MMSI top 10: 🇲🇿 Mozambique, 🇲🇳 Mongolia and 🇸🇹 São Tomé & Príncipe – 10 of the 77 MMSI-change vessels between them. Mozambique stands out: only 10 vessels in the base population, 3 of them changed MMSI and 3 made first-time visits to the Atlantic.
- What remains is more concentrated in East & Southeast Asia (38.5% of events, up from 34.4%) – 🇨🇳 China alone accounts for 14 of the region's 40 events – matching the concentration of this month's dark-activity hotspot (Middle East / Persian Gulf, 38.7%).
- 🇰🇲 Comoros is still the top flag by vessel count (18, down from 32) and supplies the most repeat offenders (3 vessels with 2+ events) – 23.4% of all MMSI-change vessels, twice the next flag.
- 13.0% of MMSI-change vessels are High Risk – still above the baseline population (12.8%) and dark activity (9.5%), but the margin over the baseline has shrunk from 3.8 points in August to 0.2. This month, identity-switching is not a markedly sharper risk signal than the population as a whole.
- The most frequent identity-switcher this month is a 🇲🇿 Mozambique-flagged Fishing Vessel rated High Risk, changing MMSI 6 times – a High-Risk outlier, after August's tie between two Moderate-Risk vessels at 8 changes each.
- First-time visits rose 21% (98 → 119 events, 79 → 91 vessels), with the North Atlantic up 31% (35 → 46) and the South Atlantic up 23% (35 → 43). Together they now account for 75% of events, up from 71% – the transatlantic cocaine corridor is getting busier.
- The corridor is exactly balanced this month: 11 vessels moved North Atlantic → South Atlantic and 11 moved South Atlantic → North Atlantic, after August's 10 vs 7 tilt towards North → South.
- 27 of 91 vessels (29.7%) entered more than one zone for the first time, up from 19 of 79 – 22 crossing directly between North and South Atlantic, 3 moving from the North Atlantic into Latin American waters (🇻🇪 Venezuela, 🇧🇷 Brazil) and 2 crossing from the western to the eastern Pacific.
- 🇧🇧 Barbados (4 vessels) and 🇲🇿 Mozambique (3) are new to the flag top 10. Mozambique is the one to watch: 3 of its just 10 base-population vessels made first-time Atlantic visits, and 3 changed MMSI.
- 🇰🇲 Comoros (22 vessels) and 🇵🇦 Panama (21) still lead the flag list, while 🇰🇳 St Kitts & Nevis more than doubled (3 → 7) – the same three flags that lead the baseline population and dark activity.
- Secondary clusters persist alongside the Atlantic corridor: Caribbean & Latin America (🇻🇪 Venezuela, 🇧🇷 Brazil, the eastern Pacific, 🇨🇴 Colombia, Peru – 15 events, up from 12) and the Indian Ocean (11 events, up from 9).
Stay ahead of what's moving across the cocaine corridors
Windward's Maritime Intelligence Operations Center (MIOC) fuses Maritime AI™, all‑source intelligence, and expert analysts to deliver continuous monitoring, rapid investigations, and reporting that drives strategic, operational, and risk decisions.
Every flag, owner and behavior in this dashboard is watched the same way, every day — so when a vessel's pattern breaks, you hear it from an analyst, with the evidence attached.
Learn more
Anatomy of a drug bust
How one vessel gave itself away. Windward analysts walk the behavioral trail — an invalid MMSI, a dark gap, a first-time call — from a routine cargo run to a cocaine seizure at sea.
The video can’t play in the page on this device — the YouTube player didn’t answer and there’s no local copy to fall back to. Watch it on YouTube
A Mali-flagged general cargo vessel went dark for 25 days off eastern Libya, sailing from Albania – a leading European narcotics hub – and returning there after reappearing at nearly the same position.
Read More
A 63-year-old cargo vessel reflagged to landlocked Mali, dark for 30 days across 1,790 nautical miles of Atlantic transit, now under tow into the Amazon estuary — measured against the UNITED S, seized in Spain with 10 tonnes of cocaine.
Read More
4,973 kg of methamphetamine — the largest maritime drug seizure in Asia-Pacific history — on a vessel that had already renamed itself from HE TAI. Regional seizures hit 349 metric tons in 2025, up 48% year-on-year.
Read More