OxINT Strategic Research

Flag-Hopping and Fraudulent Ship Registries

How sanctioned vessels launder their identity by cycling through open and fraudulent flag-state registries — the deregistration-and-reflag pattern, the registries that absorb the traffic, and how to track an identity that keeps changing.

As of June 2026 GEOINT · CORPINT · OSINT 15 min read

A flag is just an identity you can buy

A ship's flag determines its legal nationality, its inspection regime, and which authority is supposed to vouch for it. For a vessel under pressure, the flag is also the easiest part of its identity to change. Flag-hopping — rapid deregistration from one state and reflagging under another — lets a sanctioned ship shed the scrutiny that a designation attaches to its old registration.

This brief explains the mechanism and how to track it. It draws on maritime-press and policy reporting; every named registry, figure, and vessel example below is reported, not independently confirmed by us. Per our forensic rule, a blocked or failed fetch is never treated as verification.

As of date: registry behaviour shifts month to month as states crack down or are pressured. Re-confirm any registry's current posture before relying on it.

The reflag pattern, as reported

FH-01REPORTED

Lloyd's List reports the average time between a ship being sanctioned and reflagging fell to roughly 45 days in 2025, down from about 85 days in 2024 REPORTED. Treat both figures as reported aggregates.

SOURCE: Lloyd's List, “Flag-hopping hits unprecedented levels” — not primary-verified here

FH-02REPORTED

Open registries reported as prominent in dark-fleet tonnage — including Gabon, Barbados, and the Cook Islands — are reported to be shrinking as ships leave or are removed after being sanctioned in 2024–2025 REPORTED.

SOURCE: Maritime Executive; Windward — not primary-verified here

FH-03REPORTED

As Western pressure pushes ships off larger open registries, reporting describes migration toward smaller registries such as Palau and Comoros, and toward fraudulent registries that issue documents for states that did not authorise them REPORTED.

SOURCE: Maritime Executive; Windward knowledge base — not primary-verified here

FH-04REPORTED

The Gabon register is reported to be operated by a private company, Intershipping Services LLC, based in the UAE — an example of how flag administration can be outsourced away from the flag state itself REPORTED.

SOURCE: Maritime Executive — not primary-verified here

FH-05REPORTED

As an illustrative case, the tanker Sooraj is reported to have been flagged with Gabon when sanctioned by the UK in February 2025, then to have used an MMSI affiliated with Panama, then to have switched to Djibouti within weeks REPORTED.

SOURCE: Maritime Executive — not primary-verified here

Tracking an identity that keeps changing

A vessel's flag, name, and MMSI can all change; its hull and history are harder to fake. The workflow below pins identity to the durable attributes.

  1. Anchor on the IMO number The IMO hull number is assigned for the life of the ship and survives reflagging, renaming, and MMSI changes. Treat it, not the flag, as the primary key.
  2. Reconstruct the flag history Pull the sequence of flags and registration dates. A cluster of rapid changes around a sanctions date is the flag-hopping signature.
  3. Watch the MMSI separately from the flag Operators sometimes switch the MMSI's country prefix independently of the legal flag. Mismatches between flag, MMSI prefix, and call sign are flags in themselves.
  4. Test the registry's legitimacy Check whether the issuing registry actually administers that flag, or whether the documents are fraudulent. Cross-reference against states' own disavowals of fraudulent registrations.
  5. Map the administrator, not just the flag Identify who runs the register. Private, offshore administrators are a risk indicator distinct from the flag state's nominal jurisdiction.
  6. Record each change with a confidence tag A registration change you can source to a registry or class record is stronger than one inferred from AIS metadata; tag accordingly.

What changes vs. what persists

AttributeChangeable?Use it to…
IMO numberNo (life of hull)Anchor identity across all other changes
FlagYes (days)Detect the reflag-after-sanction pattern
MMSI / call signYesSpot flag/MMSI mismatches
Vessel nameYesLink renamed identities via IMO
Registry administratorRarelyFlag outsourced or fraudulent administration

Common questions

What is flag-hopping?

It is the rapid deregistration of a ship from one flag state and reflagging under another, often within days of a sanctions designation, to shed the scrutiny attached to the old registration.

How do you track a vessel that keeps changing its flag and name?

Anchor on the IMO hull number, which persists for the life of the ship. Reconstruct the flag and name history around it, and watch for MMSI-prefix changes that move independently of the legal flag.

What is a fraudulent registry?

It is an operation issuing registration documents for a flag state that did not authorise them. States periodically disavow such fraudulent registrations; checking those disavowals is part of testing a registry's legitimacy.

Related briefs and tools