2,894 Vessel Loitering Events in 45 Days. Two Reached High Risk. Context Determines the Classification.

The Setup

2,894 vessel loitering events were detected between April 11 and May 22, 2026 — a 45-day window. Two of them were classified high risk. The other 2,892 were low or medium. The behavioral difference between those two and the rest wasn't how long they loitered or how far they'd drifted. It was where they stopped.

Loitering detection works by identifying vessels that drop below mobility thresholds for sustained periods. Two behaviors are tracked: stationary (average speed 0.02–0.03 knots, essentially motionless) and slow_roll (0.09–0.35 knots, creeping forward). Both are flagged when they exceed a minimum duration. Both are then risk-scored by context — the type of zone where the loitering is occurring.

The Chain

The dominant pattern is stationary loitering in shipping lanes: 1,516 of 2,894 events (52.4%), classified low risk, average 5.6 hours, average speed 0.02 knots. These are vessels that have stopped — engine trouble, crew rest, weather holds — in transit corridors. The average risk score is 13.9 out of 100. Low, because stopping in a shipping lane, while operationally unusual, doesn't map to any known obfuscation pattern.

Move the same vessel to hotspot_vicinity — within detection radius of a known ship-to-ship transfer zone — and the risk profile shifts. Stationary events near hotspots split into two tiers: 445 events classified low risk (avg 4.5 hours) and 635 classified medium (avg 5.1 hours). The behavior is identical. The context changes. The classifier resolves the distinction through proximity weighting.

Slow_roll events are rarer and carry higher baseline risk. 128 slow_roll events in shipping lanes reached medium risk (avg 5.6 hours, 0.09 knots). 72 slow_roll events near hotspots were classified medium (avg 4.5 hours, 0.20 knots). And then there are two: slow_roll in hotspot_vicinity, classified high risk, both detected on May 18, average 4.7 hours at 0.25 knots.

Those two events are the edge of this window's risk envelope. They didn't exceed average duration. They weren't longer than typical. What distinguished them was the combination of speed signature (0.25 knots — faster than a vessel drifting but slower than one maneuvering intentionally), duration (4.7 hours near an STS zone), and hotspot proximity. Three variables aligned simultaneously for the first time in 45 days.

The Implication

Context is doing more work than behavior in this risk model. A vessel stationary at 0.02 knots in open water is not interesting. The same vessel stationary at 0.03 knots near an STS transfer zone carries a different explanation set — and therefore a different risk weight — even though nothing in its AIS track has changed.

The two May 18 high-risk events may represent positioning for undeclared transfers. They may represent vessels with mechanical issues that happened to be near hotspot zones. The classification system cannot resolve that from AIS alone. What it does is flag that the prior probability of a benign explanation is lower when all three variables align: behavior type, speed signature, and zone proximity. That is what "high risk" means in this context — not confirmed activity, but an elevated probability that warrants additional scrutiny before clearing.

No co-loitering events were detected in this window. Every flagged event involved a vessel that appeared to be alone at the loitering location. When a second vessel appears in proximity to an ongoing slow_roll loitering event, the risk implications compound. That combination has not occurred in this 45-day window.

What to Watch

The slow_roll/hotspot_vicinity category is the leading indicator. It held at 74 events (72 medium + 2 high) across this window. An increase to 100 or more in the next 45 days would signal more frequent proximity operations near transfer zones — and a higher probability that some of those events represent active positioning rather than incidental drift.

The May 18 high-risk pair is the benchmark event. A second high-risk detection — or a cluster of high-risk events in the same hotspot_vicinity zone — would establish a pattern that two isolated events cannot support on their own.

Co-loitering remains at zero. The first detection of a second vessel within range of an ongoing slow_roll/hotspot event is the threshold where individual risk scores aggregate into a multi-vessel flag with a materially different implication for cargo screening.

Limitations

Duration is capped at six hours by the detection pipeline. Events that extend beyond six hours re-enter as new records. Long-duration loitering — vessels that hold position for 12 or 18 hours near an STS zone — is undercounted. The 2,894-event figure is a lower bound for total loitering activity in this window.

Speed thresholds are approximate. The boundary between stationary and slow_roll sits near 0.1 knots. Vessels at the boundary are classified into the more conservative bucket. Small GPS noise can shift individual events across the threshold without reflecting real behavioral differences.

Hotspot zone boundaries were calibrated in Q4 2025. Known STS zones that have emerged since then may not be represented in the proximity weighting.

Data as of May 22, 2026. Source: Axiom Overwatch loitering_events; 2,894 events covering April 11 – May 22, 2026, across stationary and slow_roll behavioral types in shipping_lane and hotspot_vicinity contexts.