In my previous blog post, “Going in Circles”, I explored two distinct GNSS spoofing systems operating in the Gulf of Finland, which manipulated ship positions into circular or hexagonal patterns. However, the region’s navigational anomalies aren’t solely due to wide-scale spoofing. Individual vessels have also been observed falsifying their locations, likely to obscure connections to Russian ports and evade sanctions.
One such vessel is the LPG tanker FALCON (IMO: 9014432). Unlike the earlier cases where ships were unwitting victims of external spoofing, FALCON appears to be deliberately broadcasting deceptive AIS data. Its self-spoofing behavior results in conspicuous circular movement patterns, making the deception evident to observers.
In this post, I’ll delve into FALCON’s AIS spoofing tactics and why the synthetic tracks stands out to both the naked eye and simple numeric analysis.
Bird Without a Nest
Increased awareness of the so-called “shadow fleet” tankers has brought attention to FALCON. In online databases such as IMO GISIS and Equasis, the ship is listed with an “unknown” flag. While it may be properly registered with a flag state, being marked as “unknown” is a clear red flag. Could frequent flag hopping have caused discrepancies between systems, leaving them out of sync?
Although the vessel appeared to draw some attention from the Danish Navy while passing through the Danish Straits, it was ultimately allowed to continue its journey into the Gulf of Finland.
A few days ago, the ship dropped off AIS while passing Tallinn, only to reappear several hours later at what appeared to be a static position within Estonian waters.
At first glance, FALCON appears to have anchored at this location several times before. However, upon closer inspection, the circular patterns — initially suggestive of anchor swing — are far too precise to be caused by the wind and current.
Fake Anchor Swing Circles
While this alone might raise an eyebrow for the casual observer, there’s reason to believe these circles aren’t the result of cool Estonian winds and waters — but rather, the product of an algorithm.
Fake anchor swings, in polar coordinates. Radius of the circle is 220 meters.
The first indication of spoofing is the radius of the circles: in every visit to this area, the loops are exactly 220 meters wide. For this to occur naturally, the anchor chain would have to be winched to an identical length each time, and the wind and current would need to remain perfectly steady—without even minor shifts to stretch or slacken the chain. This level of precision is highly improbable.
The second clue lies in the distribution of the reported positions. They are evenly spaced along the circumference of the circle, implying a uniform force acting in all compass directions. This would require wind and current to be not only stable, but also symmetrically distributed—an even more implausible scenario.
But the third clue is the final nail in the coffin. When plotting the ship’s bearing — relative to the apparent “anchor point” — over time, a striking pattern emerges. The spoofer appears to follow a simple algorithm, remarkably similar to the wide-area circle spoofing described in my previous post.
Bearing — relative to the apparent “anchor point” — over time, February 2025. Click to enlarge.
The data shows that FALCON simulates circular motion around a fixed center, much like the hands of a clock, with a constant angular velocity of approximately 1.5 days per revolution. Not only is the motion mechanically perfect, but the speed remains consistent across multiple visits—strong evidence of a scripted spoofing pattern, not a drifting vessel at anchor.
In December 2024. Click to enlarge.
Some dropouts can be observed in the AIS data. This might indicate that the ship temporarily moved out of range of terrestrial AIS receivers. If anyone has access to historical AIS data for FALCON, including the locations of the receiving stations for each position report, this could be investigated further. I’d be happy to collaborate on a deeper analysis.
And finally in June 2024. Click to enlarge.
In June 2024, some of the reported positions fail to form a perfect circle. Could this be due to system instability? Spoofing errors? Or perhaps noise? It’s unclear—but worth investigating further.