#26 LEMONADE // Vessel Intelligence System

Intelligence Overview

LEMONADE · MMSI 319247500 · 🇰🇾 US · Primary Port: San Diego

PERIOD: JAN–DEC 2024

⚠ INTELLIGENCE ASSESSMENT: LEMONADE ranks #26 of 69,461 monitored vessels with 326 anomalous detections across 9 months. Composite risk score: 0.9500 (CRITICAL). Active alert types: POSITION_JUMP, ZIGZAG, DARK_VESSEL, SPEED_ANOMALY.

Global Rank

#26

of 69,461 vessels

Composite Score

0.9500

CRITICAL

Total Detections

326

Months Active

9/12

Unique Ports

8

Dark Events

1

AIS blackout

Position Jumps

74

GPS spoofing

Speed Anomalies

79

Max Speed

102.2 kn

Max Jump

3,706km

Monthly Detection Volume

10
65

11
45

12
55

4
19

2024 MONTHLY DETECTIONS

Alert Type Distribution

SPEED_ANOMALY

79

POSITION_JUMP

74

ZIGZAG

30

DARK_VESSEL

1

Key Intelligence Findings

AIS Blackout Confirmed — 1 Event

Deliberate AIS transponder deactivation detected. Each event represents a period where LEMONADE was operating outside electronic surveillance. Consistent with covert cargo transfer or evasion operations.

GPS Spoofing — 74 Position Jumps

AIS coordinates fabricated at impossible locations. Maximum jump of 3,706 km confirms the AIS transmitter is broadcasting false positions. Systematic identity concealment is in progress.

Velocity Fraud — 79 Speed Anomaly Events

AIS SOG field manipulated to broadcast physically impossible speeds up to 102.2 knots. Systematic falsification of movement data to corrupt automated tracking algorithms.

Evasion Navigation — 30 Zigzag Events

Erratic course-over-ground patterns up to 143.2° std deviation, far exceeding the 50° anomaly threshold. Pattern consistent with surveillance evasion maneuvers or anchor position AIS noise.

Port Detection Summary

🇺🇸

San Diego

146

avg 0.779

🇺🇸

Long Beach

14

avg 0.852

🇲🇽

Manzanillo

8

avg 0.851

🇺🇸

Los Angeles

7

avg 0.775

🇺🇸

Oakland

4

avg 0.911

🇺🇸

San Francisco

2

avg 0.783

🇺🇸

Brownsville

2

avg 0.732

🇲🇽

Veracruz

1

avg 0.950

Monthly Alert Log — All Months

Month	Detections	Severity	Score	Nearest Port	Alert Types
April 2024	19	CRITICAL	0.9472	San Diego	POSITION_JUMP; SPEED_ANOMALY; ZIGZAG
May 2024	46	CRITICAL	0.9500	Oakland	POSITION_JUMP; SPEED_ANOMALY; ZIGZAG
June 2024	39	CRITICAL	0.9500	San Diego	POSITION_JUMP; SPEED_ANOMALY; ZIGZAG
July 2024	28	CRITICAL	0.9500	San Diego	POSITION_JUMP; SPEED_ANOMALY; ZIGZAG
August 2024	6	HIGH	0.8807	Victoria	ZIGZAG
September 2024	23	CRITICAL	0.9500	Vancouver	ZIGZAG; POSITION_JUMP; SPEED_ANOMALY
October 2024	65	CRITICAL	0.9500	Oakland	POSITION_JUMP; SPEED_ANOMALY; ZIGZAG; DARK_VESSEL
November 2024	45	CRITICAL	0.9266	San Diego	SPEED_ANOMALY; POSITION_JUMP; ZIGZAG
December 2024	55	CRITICAL	0.9500	San Diego	POSITION_JUMP; SPEED_ANOMALY; ZIGZAG

Activity Map

Detection events plotted · Color-coded by alert type · Drag to pan · Scroll to zoom

● Speed Anomaly ● Position Jump ● Zigzag ● Dark Vessel ● Rendezvous

Threat Intelligence

Analytical confidence: HIGH · Multi-indicator assessment

Threat Indicators Matrix

Indicator	Status	Evidence	Confidence
AIS Blackout / Dark Vessel	CONFIRMED	1 events detected	CRITICAL
GPS Spoofing / Position Jump	CONFIRMED	74 jumps · max 3705.5km	CRITICAL
Velocity Fraud / Speed Anomaly	CONFIRMED	79 events · max 102.2 kn	CRITICAL
Evasion Navigation / Zigzag	CONFIRMED	30 events · max COG std 143.2°	HIGH
Ship-to-Ship Rendezvous	NOT DETECTED	—	LOW
Multi-Port Operations	CONFIRMED	8 unique ports	HIGH
High-Risk Port Proximity: Manzanillo	CONFIRMED	8 detections	HIGH
High-Risk Port Proximity: Veracruz	CONFIRMED	1 detections	HIGH

Operational Profile

Primary AO

San Diego and surrounding maritime zone

Active Period

9 months of continuous alert activity in 2024

Alert Density

326 detections across 184 individual events (avg 36.2/month)

Active Techniques

⊕ POS JUMP ⟳ ZIGZAG ◐ DARK ⚡ SPEED

Threat Category

High-Confidence AIS Manipulation — Multiple confirmed evasion techniques

TTP Analysis

Tactics, Techniques & Procedures — Maritime ATT&CK Framework

MAR-T001

RTE-ANO-001

Velocity Fraud

AIS SOG field manipulation to broadcast impossible speeds up to 102.2 kn. Corrupts automated tracking algorithms and creates false movement vectors. Count: 79 events.

HIGH CONFIDENCE
79 events

MAR-T002

AIS-MAN-003

GPS Spoofing

GPS coordinate spoofing — AIS positions fabricated at impossible locations. Max jump: 3705.5km. Implies deliberate identity concealment. Count: 74 events.

HIGH CONFIDENCE
74 events

MAR-T003

RTE-ANO-005

Evasion Navigation

Erratic COG changes exceeding 50° threshold (max 143.2°). Consistent with surveillance evasion or at-anchor AIS manipulation. Count: 30 events.

HIGH CONFIDENCE
30 events

MAR-T004

AIS-MAN-001

AIS Blackout

Deliberate AIS transponder deactivation to create surveillance gaps. Count: 1 events. Each event represents an unmonitored operational window.

HIGH CONFIDENCE
1 events

Risk Analysis

Composite risk scoring · Weighted indicator model · Quantus v2.4

Composite Score

0.9500

CRITICAL

Avg Detection Score

0.9394

Global Rank

#26

of 69,461 vessels

Weighted Indicator Scoring

Formula: (Dark×3) + (Rendezvous×4) + (PosJump×2) + (Speed×1) + (Zigzag×0.5) + (MaxScore×50)

Indicator	Count	Weight	Contribution
DARK_VESSEL	1	×3	3.0
RENDEZVOUS	0	×4	0.0
POSITION_JUMP	74	×2	148.0
SPEED_ANOMALY	79	×1	79.0
ZIGZAG	30	×0.5	15.0
MaxSingleScore	0.9500	×50	47.5
COMPOSITE TOTAL	Normalized [0,1]		0.9500 CRITICAL

⚡ Speed Anomaly Detections

Indicator: RTE-ANO-001 · 79 events · Max: 102.2 kn

AIS SOG FRAUD

Speed anomaly events are triggered when AIS Speed Over Ground (SOG) exceeds the 30-knot detection threshold. LEMONADE reports speeds up to 102.2 kn — consistent with deliberate AIS SOG field manipulation to corrupt tracking algorithms.

Total Events

79

Max Reported SOG

102.2 kn

Indicator ID

RTE-ANO-001

Speed Anomaly Events (Top 50 by score)

Date	Max SOG (kn)	Score	Severity	Port	Coordinates

⊕ Position Jump Detections

Indicator: AIS-MAN-003 · 74 events · Max jump: 3,706 km

GPS SPOOFING

Position jumps confirm GPS coordinate spoofing — AIS positions fabricated at impossible locations. LEMONADE has 74 confirmed position jumps with maximum displacement of 3,706 km.

Total Events

74

Max Jump Distance

3,706 km

Indicator ID

AIS-MAN-003

Position Jump Events (Top 50 by distance)

Date	Jump (km)	Implied Speed (kn)	Score	Severity	Spoofed-To Port	Coordinates

⟳ Zigzag / Erratic Navigation

Indicator: RTE-ANO-005 · 30 events · Max COG std: 143.2°

EVASION PATTERN

Zigzag events are triggered when course-over-ground (COG) standard deviation exceeds 50°. LEMONADE records COG deviations up to 143.2° — consistent with surveillance evasion maneuvers or at-anchor AIS noise manipulation.

Total Events

30

Max COG Std Dev

143.2°

Threshold

50°

Zigzag Events (Top 50 by COG deviation)

Date	COG Std Dev (°)	Score	Severity	Port	Coordinates

◐ Dark Vessel Events

Indicator: AIS-MAN-001 · 1 AIS blackout events detected

AIS BLACKOUT

⚠ HIGH SIGNIFICANCE: Dark vessel events represent deliberate AIS transponder deactivation — a primary indicator of intentional surveillance evasion, covert cargo transfer, or sanctions circumvention.

Dark Vessel Events

1

Indicator

AIS-MAN-001

Risk Level

CRITICAL

◐ DARK EVENT #1 — 2024-10-31T05:52:00

AIS BLACKOUT

Location

35.7082°N, 119.2485°W — Los Angeles

AIS Gap Duration

6.7 hours

Pre-Blackout Speed

43.8 knots SOG

Displacement

127.8 NM from port during gap

Score

0.7071 · HIGH

Assessment

High-speed approach (43.8 kn) before AIS deactivation — evasion pattern detected.

Port History

8 distinct port areas · US primary flag state

Complete Port Detection Summary

Port	Country	Detections	Avg Score	Avg Dist NM	Risk
San Diego	🇺🇸	146	0.7788	70.4	STANDARD
Long Beach	🇺🇸	14	0.8521	51.3	STANDARD
Manzanillo	🇲🇽	8	0.8508	437.4	HIGH
Los Angeles	🇺🇸	7	0.7746	138.7	STANDARD
Oakland	🇺🇸	4	0.9107	89.3	STANDARD
San Francisco	🇺🇸	2	0.7835	204.6	STANDARD
Brownsville	🇺🇸	2	0.7317	346.3	STANDARD
Veracruz	🇲🇽	1	0.9500	916.3	HIGH

🇺🇸 San Diego — Port Profile

146 detections · Avg score 0.7788 · Avg distance 70.4 NM

LOW RISK

Total Detections

146

Primary port of operation

Avg Alert Score

0.7788

Avg Distance NM

70.4

Port proximity zone

Detection Types at San Diego

POSITION_JUMP

60

SPEED_ANOMALY

60

ZIGZAG

26

Coordinates: 32.715°N, 117.157°W

Port Intelligence Notes

Port Country

🇺🇸 US

Risk Classification

LOW — Standard port monitoring applies

Detection Share

146 of 184 total detections (79.3%)

Avg Distance from Port

70.4 NM — consistent with port proximity operations

🇺🇸 Long Beach — Port Profile

14 detections · Avg score 0.8521 · Avg distance 51.3 NM

LOW RISK

Total Detections

14

Secondary port

Avg Alert Score

0.8521

Avg Distance NM

51.3

Port proximity zone

Detection Types at Long Beach

SPEED_ANOMALY

8

POSITION_JUMP

4

ZIGZAG

2

Coordinates: 33.754°N, 118.216°W

Port Intelligence Notes

Port Country

🇺🇸 US

Risk Classification

LOW — Standard port monitoring applies

Detection Share

14 of 184 total detections (7.6%)

Avg Distance from Port

51.3 NM — consistent with port proximity operations

🇲🇽 Manzanillo — Port Profile

8 detections · Avg score 0.8508 · Avg distance 437.4 NM

HIGH RISK

⚠ HIGH RISK PORT: Manzanillo is a known high-risk transshipment zone associated with illicit maritime activity. Detections here require elevated scrutiny.

Total Detections

8

Secondary port

Avg Alert Score

0.8508

Avg Distance NM

437.4

Possible spoofed coords

Detection Types at Manzanillo

POSITION_JUMP

4

SPEED_ANOMALY

4

Coordinates: 19.054°N, 104.318°W

Port Intelligence Notes

Port Country

🇲🇽 MX

Risk Classification

HIGH — HIGH

Detection Share

8 of 184 total detections (4.3%)

Avg Distance from Port

437.4 NM — anomalously high, suggests spoofed coordinates

🇺🇸 Los Angeles — Port Profile

7 detections · Avg score 0.7746 · Avg distance 138.7 NM

LOW RISK

Total Detections

7

Secondary port

Avg Alert Score

0.7746

Avg Distance NM

138.7

Port proximity zone

Detection Types at Los Angeles

SPEED_ANOMALY

4

DARK_VESSEL

1

POSITION_JUMP

1

ZIGZAG

1

Coordinates: 33.729°N, 118.264°W

Port Intelligence Notes

Port Country

🇺🇸 US

Risk Classification

LOW — Standard port monitoring applies

Detection Share

7 of 184 total detections (3.8%)

Avg Distance from Port

138.7 NM — consistent with port proximity operations

🇺🇸 Oakland — Port Profile

4 detections · Avg score 0.9107 · Avg distance 89.3 NM

LOW RISK

Total Detections

4

Secondary port

Avg Alert Score

0.9107

Avg Distance NM

89.3

Port proximity zone

Detection Types at Oakland

POSITION_JUMP

3

ZIGZAG

1

Coordinates: 37.804°N, 122.271°W

Port Intelligence Notes

Port Country

🇺🇸 US

Risk Classification

LOW — Standard port monitoring applies

Detection Share

4 of 184 total detections (2.2%)

Avg Distance from Port

89.3 NM — consistent with port proximity operations

🇺🇸 San Francisco — Port Profile

2 detections · Avg score 0.7835 · Avg distance 204.6 NM

LOW RISK

Total Detections

2

Secondary port

Avg Alert Score

0.7835

Avg Distance NM

204.6

Possible spoofed coords

Detection Types at San Francisco

SPEED_ANOMALY

1

POSITION_JUMP

1

Coordinates: 37.775°N, 122.419°W

Port Intelligence Notes

Port Country

🇺🇸 US

Risk Classification

LOW — Standard port monitoring applies

Detection Share

2 of 184 total detections (1.1%)

Avg Distance from Port

204.6 NM — anomalously high, suggests spoofed coordinates

🇺🇸 Brownsville — Port Profile

2 detections · Avg score 0.7317 · Avg distance 346.3 NM

LOW RISK

Total Detections

2

Secondary port

Avg Alert Score

0.7317

Avg Distance NM

346.3

Possible spoofed coords

Detection Types at Brownsville

POSITION_JUMP

1

SPEED_ANOMALY

1

Port Intelligence Notes

Port Country

🇺🇸 US

Risk Classification

LOW — Standard port monitoring applies

Detection Share

2 of 184 total detections (1.1%)

Avg Distance from Port

346.3 NM — anomalously high, suggests spoofed coordinates

🇲🇽 Veracruz — Port Profile

1 detections · Avg score 0.9500 · Avg distance 916.3 NM

HIGH RISK

⚠ HIGH RISK PORT: Veracruz is a known high-risk transshipment zone associated with illicit maritime activity. Detections here require elevated scrutiny.

Total Detections

1

Secondary port

Avg Alert Score

0.9500

Avg Distance NM

916.3

Possible spoofed coords

Detection Types at Veracruz

SPEED_ANOMALY

1

Coordinates: 19.197°N, 96.134°W

Port Intelligence Notes

Port Country

🇲🇽 MX

Risk Classification

HIGH — HIGH

Detection Share

1 of 184 total detections (0.5%)

Avg Distance from Port

916.3 NM — anomalously high, suggests spoofed coordinates

Ownership Intelligence

MMSI registry · Flag state analysis · Beneficial ownership investigation

Vessel Name

LEMONADE

MMSI

319247500

Flag State (MMSI-derived)

🇰🇾 US

MID Code

319 → 🇰🇾 US

Primary Port

San Diego

Detection Period

9 months (2024)

Registered Owner

Pending registry lookup

Beneficial Owner

Requires FinCEN CDD query

OFAC SDN Status

Pending cross-reference

Recommended Action

Physical inspection + full registry query

Vessel Type Analysis

AIS declared type · Physical capability vs. observed behavior

Type Mismatch Assessment

AIS Declared Type

vessel_type=37 (Pleasure Craft)

Behavior Consistency

INCONSISTENT — year-round multi-port operations with 326 anomalous events are not consistent with pleasure craft use

Speed Capability

Reported 102.2 kn — physically impossible for Type 37 (max ~45 kn high-performance)

Inspection Priority

HIGH — Recommend USCG/CBSA physical boarding and documentation review

Applicable Statutes

47 C.F.R. § 80.953 (AIS falsification) · 33 C.F.R. § 164.46 (AIS carriage) · 21 U.S.C. § 955 (maritime drug law)