Exposing spoofing in sanctioned oil transfers: Why better AIS data is necessary when monitoring activity off Malaysia’s coast

In the high-stakes world of maritime compliance and sanctions enforcement, the ability to detect AIS manipulation is essential. Nowhere is this more evident than in the waters off Malaysia’s coast, where shadow fleet tankers are exploiting regulatory gaps and limited enforcement capacity to carry out illicit ship-to-ship (STS) transfers of sanctioned oil.

According to data from Lloyd’s List Intelligence, over 50 shadow fleet vessels are spoofing their AIS signals monthly in Malaysia’s outer port limits, a key STS hub for Iranian crude bound for China.

Malaysia has pledged to implement new regulations to tighten enforcement, but no details have yet emerged, and dark STS transfers continue unchecked. The maritime intelligence community is left to rely on advanced detection tools to uncover deceptive practices and shine a light on hidden risks.

Above are three different examples of spoofing patterns that can be spotted because of the impossibility of the movement. The yellow vessel is stationary, the pink vessel moves in a perfect circle and the green vessel appears to be moving back and forth in a completely straight line

Some tankers are manipulating their AIS data to appear in the eastern part of the Singapore Strait, such as Lafit (IMO: 9379698) in May. The box pattern confirms the data is false

How AIS SeaOrbis is Supporting Sanctions Enforcement Through Advanced Spoofing Detection

AIS spoofing - the manipulation of vessel location data to disguise real activity - is a sophisticated and evolving challenge. But thanks to the volume, quality and precision of AIS signals delivered through SeaOrbis, Lloyd’s List Intelligence is now identifying these events with greater confidence and clarity.

Our detection methodology uses a hybrid approach, blending rule-based systems with machine learning models trained to spot:

• Unrealistic vessel behaviour - such as consecutive speeds or extreme velocity changes
• Physically impossible movement patterns - where clusters of reported positions don’t match reality
• Anomalies that are a departure from normal behaviour - that signal deliberate deception

These capabilities are enhanced by the increased availability of unique positions delivered via SeaOrbis, allowing analysts to detect subtle spoofing behaviours even when efforts are made to blend in with legitimate traffic.

As senior risk and compliance analyst Bridget Diakun noted in her analysis, some vessels spoof for just a few hours while others, like the Sao Tome and Principe-flagged Lafit (IMO: 9379698), can be tracked spoofing for nearly three weeks. The AIS data for Lafit, which showed it near the Singapore Strait, was entirely fabricated. This makes it even more difficult to monitor the number of dark STS transfers taking place.

Detecting this kind of deception requires not just access to high-quality data, but also advanced analytics to challenge what appears normal.

The Compliance Challenge in High-Risk Waters

The Malaysian government has declared its intent to curb these illegal operations. “This ship-to-ship issue has become a thorn in our side,” Foreign Minister Dato’ Seri Mohamad Hasan said earlier this month. But with transfers taking place outside the 12 nautical mile territorial sea limit, the general principle is that ships are subject to the exclusive jurisdiction often lies with the flag state, Malaysia’s ability to intervene is limited without new legislation and more proactive surveillance.

For organisations with regulatory exposure to sanctions, SeaOrbis plays a vital role in filling that intelligence gap. By delivering the granularity needed to detect spoofing in dense, high-risk maritime corridors, SeaOrbis enables compliance teams and regulators to monitor beyond public signals, and build stronger cases based on evidence, not assumptions.

A Global Challenge that Requires Rigorous Due Diligence

AIS spoofing off Malaysia’s coast is not just a local enforcement issue, it’s a global compliance concern. With sanctions scrutiny intensifying, and tactics like flag-hopping, identity theft and signal manipulation on the rise, organisations must ensure their maritime intelligence is built on data they can trust.

AIS SeaOrbis is helping lead that effort, empowering clients to:

• Uncover deceptive practices with greater precision
• Strengthen due diligence in high-risk areas
• Support enforcement actions with verifiable insights

Whether you're monitoring shadow fleet movements, investigating sanctions evasion, or simply safeguarding your operations in geopolitically sensitive waters, SeaOrbis delivers the AIS signal integrity and detection capabilities that today’s compliance landscape demands.