🛰️ Taiwan Gray Zone & Submarine Cable Monitor

Gray Zone Monitor Articles 中

What Is AIS Spoofing?

Fake Positions • Identity Fraud • Pattern Detection • Taiwan Waters

In short

AIS spoofing is when a vessel keeps broadcasting AIS but the content is faked: false position, speed, or course, or even another ship's MMSI, name, or IMO. Unlike "going dark" (switching AIS off), spoofing actively creates a misleading picture. Because AIS is self-reported with no real-time third-party verification, this site detects it through physical and data inconsistencies.

RELATED → What Is AIS Dark Vessel Methodology Glossary
A ship's AIS shows it cruising steadily down a shipping lane. The problem: satellite radar photographed it somewhere else, and its "broadcast position" is a patch of sea it never visited.

It didn't switch off AIS — it's lying.

What Is AIS Spoofing?

AIS spoofing is when a vessel keeps broadcasting AIS but the content is forged. It is a different tactic from "going dark" (switching AIS off): going dark is disappearing, spoofing is actively manufacturing a false version of yourself.

It is possible because AIS is self-reported: the onboard equipment fills in position, speed, and identity, then broadcasts it, with no real-time third party checking. Tamper with the inputs and the broadcast can say anything.

What Can Be Faked?

Almost every field can be forged. The common ones:

📍
Position (GPS coordinates)The most common: make the ship "appear" tens or hundreds of miles away from the sensitive waters it is really in.
🚀
Speed (SOG) & course (COG)Report a false slow speed or wrong heading to mask real loitering, circling, or a fast getaway.
🆔
MMSIBorrow another legitimate ship's identifier to confuse tracking or "wear" a clean identity.
🚢
Vessel name & call signChange frequently or enter a fake name to sever the link to existing suspicious records.
🔢
IMO numberMeant to be permanent for life, yet falsely reported or borrowed — a highly suspicious signal.
The Key DifferenceGoing dark leaves a "gap"; AIS spoofing fills that gap with "fake data." The former tells you something went missing; the latter tries to make sure you never get suspicious at all — which is why spoofing is often harder to spot than going dark.

How Is AIS Spoofing Detected?

Since the content can be faked, detection cannot rely on "what it says" — it has to find where the claims contradict each other, or clash with physics or registry data. This site's scoring engine uses several patterns:

⚡
Impossible speedDivide the distance between two consecutive positions by the time; if the implied speed far exceeds what a ship can do (e.g. jumping hundreds of km instantly), the position was tampered with.
🧭
Course vs displacement mismatchThe broadcast course (COG) differs sharply from the direction the positions actually move — a sign of forged data.
⬜
Box patternMultiple near-90° turns with a closed or tiny path — a classic signature of a computer-generated fake track.
⭕
Circle patternVery low radius variation and near-complete arc — real sailing is rarely this symmetric; often GPS jamming or a synthetic signal.
📑
Registry mismatchThe broadcast name, IMO, or call sign does not match public registries such as ITU — suggesting a borrowed or falsely reported identity.

No single pattern "proves" spoofing, but when several coincide, credibility drops sharply. Full logic is in our methodology.

Why It Matters for Cables and the Gray Zone

Spoofing is a gray-zone weapon because it attacks attribution itself. If a ship can make monitors believe it is elsewhere, it can operate near a submarine cable without being connected to the event in real time.

Stack spoofing, going dark, and identity changes together and you get a full concealment toolkit: first blur the real movements (spoof/dark), then make after-the-fact tracing hard (rename, change MMSI). That is why this site folds all of these patterns into the threat score — no single one is decisive, but together they sharply erode deniability.

How This Site Reads It

  1. Check each vessel's track for the patterns above (impossible speed, box, circle, course mismatch).
  2. Compare the broadcast identity against registries such as ITU MARS to find name/IMO/call-sign mismatches.
  3. Detected spoofing patterns are "high-threat indicators" added directly to the score.
  4. Spoofing combined with cable proximity adds further weight — the scenario that best fits deliberate concealment.
  5. Vessels reaching the threshold are listed as suspicious for human assessment.

Data Limitations & Disclaimer

  • Not every anomaly is deliberate spoofing — GPS jamming, equipment faults, or data errors can produce similar patterns.
  • SAR satellites can corroborate independently, but their coverage has spatial and temporal gaps.
  • Registry data itself can be stale or incomplete, so matches need careful interpretation.
  • A detected spoofing pattern is a strong red flag and a lead to investigate — not a legal finding, and not an accusation against any named vessel.

This page is for research and education, aggregating public data under the MIT License.

FAQ

How is AIS spoofing different from going dark?
Going dark removes the ship from AIS; spoofing keeps broadcasting but with fake content — false position, speed, or even another ship's identity. Going dark leaves a gap; spoofing actively misleads.
What information can be faked?
Almost all of it: GPS position, speed over ground (SOG), course (COG), MMSI, vessel name, call sign, and IMO number — because AIS is self-reported and broadcast with no real-time third-party verification.
How do you detect AIS spoofing?
Through internal contradictions in the physics and data: impossible speed, a broadcast course that doesn't match the actual displacement, synthetic box or circle tracks, and name/IMO mismatches against registries like ITU. This site's scoring engine specifically detects these.
What does AIS spoofing have to do with submarine cables?
If a ship can appear to be elsewhere, it can operate near a cable without being connected to the event in real time. Combined with going dark and identity changes, spoofing makes gray-zone behavior harder to attribute.
Next: What is a dark vessel? → ← Back to articles

Sources

The concepts on this page can be verified against these public, authoritative sources:

This page is for research and education; detection signals are leads to investigate, not legal or factual findings. See the methodology.

Related gray-zone topics