daemon-sec-cheatsheet

transport-tracking.md (32651B)

---

 ---
 title: "Aircraft, Vessel & Vehicle Tracking"
 description: "Track flights and ships live and historically, and understand the gaps operators use to disappear."
 category: osint
 subcategory: "Transport"
 tags: [osint, aviation, maritime, adsb, ais]
 tools: [opensky, pyopensky, adsb-lol, adsbexchange, readsb, flightradar24, marinetraffic, equasis, global-fishing-watch]
 difficulty: intermediate
 updated: 2026-10-03
 references:
   - name: "Bellingcat's Online Investigation Toolkit"
     url: "https://bellingcat.gitbook.io/toolkit"
     author: "Bellingcat"
     license: none
     relation: derived
     note: "Tool catalogue: names, descriptions, cost flags and links for this area."
   - name: "OSINT Newsletter Tools Library"
     url: "https://tools.osintnewsletter.com"
     author: "The OSINT Newsletter"
     license: none
     relation: derived
     note: "Second tool catalogue, cross-checked against the above."
 ---
 
 ## What this covers
 
 Aircraft and vessels broadcast their own positions, which makes transport one of the few OSINT
 domains with a structured, queryable, global feed behind it. The important knowledge is not which
 website to open — it is where the data has gaps, because the gaps are where the interesting
 behaviour is, and distinguishing a coverage gap from an evasion is the whole skill.
 
 ## Method
 
 1. **Pin the durable identifier first.** For aircraft that is the ICAO 24-bit hex address; for
    vessels the IMO number. Registrations, callsigns, names and flags all change, frequently on
    purpose, and a track assembled on a callsign will silently merge two aircraft.
 2. **Look at live data on a map to orient yourself**, then stop using the map. Anything you intend
    to assert needs the underlying records, because a screenshot of a map is not reproducible and
    the free sites retain only days.
 3. **Pull the track from an API and store it.** Positions, timestamps and the receiver metadata if
    you can get it. Historical ADS-B and AIS are the parts that cost money, so capture while you can
    see it rather than planning to come back.
 4. **Resolve the operator separately from the registered owner.** Aircraft sit in trusts and
    leasing companies; ships sit under flags of convenience with a manager in a third country. The
    tracking feed names neither — that is a
    [corporate records](/sheets/osint/companies-and-finance) problem.
 5. **Characterise the gap before you call it a gap.** Establish the coverage baseline for that area
    and that hour, from a second receiver network if possible, then show the vessel or aircraft was
    inside coverage and absent anyway. Without that comparison you have a missing data point, not a
    dark period.
 6. **Corroborate position with something that is not a transponder.** Satellite imagery over the
    claimed location and time, a port-call record, a photograph with a spotter's timestamp. A
    transponder reports what it is told to report.
 
 ## Aircraft
 
 Aircraft transmit ADS-B: identity, position, altitude, speed, on 1090 MHz. Reception is
 crowd-sourced, so coverage follows volunteer receivers, which follow population and wealth.
 
 | Source | Why use it |
 | --- | --- |
 | [ADS-B Exchange](https://globe.adsbexchange.com/) | **Does not honour blocking requests.** The only major aggregator that shows aircraft others hide, which is precisely why it matters for research. The map is free; the API is not. |
 | [Flightradar24](https://www.flightradar24.com/) | Best coverage and UI; filters blocked aircraft. Historical playback behind a subscription. |
 | [OpenSky Network](https://opensky-network.org/) | Research-oriented, documented free API, good historical archive. The right choice for bulk and scripted work. |
 | [adsb.lol](https://adsb.lol/) | Community feed with a free, keyless JSON API in the ADS-B Exchange shape. The practical replacement for scripted work now that ADSBx is paid. |
 | [Airframes](https://airframes.org/) | Registration-to-airframe history: owners, previous registrations, type, serial. |
 | [FAA Registry](https://registry.faa.gov/AircraftInquiry/Search/NNumberInquiry) | Authoritative for US N-numbers: registered owner, address, airworthiness, and the trust structures that obscure them. |
 | [GPSJam](https://gpsjam.org/) | Daily maps of GPS interference derived from aircraft navigation-accuracy reports. Reveals jamming zones, which is also why some tracks go wrong. |
 | [Live ATC](https://www.liveatc.net/) | Archived air-traffic control audio, which sometimes names aircraft that were never tracked. |
 
 ### OpenSky Network API
 
 The feed to automate against. It publishes state vectors (one position per aircraft per second,
 aggregated from its receiver network), per-aircraft flight lists, and full tracks, with a documented
 rate model rather than a scraping fight.
 
 **The auth model changed:** HTTP basic authentication with your account password is gone. Current
 access is OAuth2 client credentials — create an API client in your OpenSky account, then exchange
 the client ID and secret for a 30-minute bearer token.
 
 ```bash
 # one-off: get a token (expires in 30 minutes; a 401 later means refresh it)
 TOKEN=$(curl -s -X POST \
   'https://auth.opensky-network.org/auth/realms/opensky-network/protocol/openid-connect/token' \
   -d 'grant_type=client_credentials' \
   -d 'client_id=YOUR_CLIENT_ID' \
   --data-urlencode 'client_secret=YOUR_CLIENT_SECRET' | jq -r .access_token)
 ```
 
 ```bash
 # current state of one aircraft by ICAO 24-bit address
 curl -s -H "Authorization: Bearer $TOKEN" \
   'https://opensky-network.org/api/states/all?icao24=4ca7b5' | jq '.states'
 
 # everything in a bounding box right now — cheaper in credits than a global pull
 curl -s -H "Authorization: Bearer $TOKEN" \
   'https://opensky-network.org/api/states/all?lamin=45&lomin=5&lamax=48&lomax=10' \
   | jq '.states | length'
 
 # aircraft category as well as position, for sorting military from civil
 curl -s -H "Authorization: Bearer $TOKEN" \
   'https://opensky-network.org/api/states/all?icao24=4ca7b5&extended=1' | jq .
 
 # state vector at a past instant — the cheap way to answer "where was it at 14:00Z"
 #   1773237600 is 2026-03-11T14:00Z; `date -u -d '2026-03-11 14:00' +%s` on GNU,
 #   `date -u -j -f '%Y-%m-%d %H:%M' '2026-03-11 14:00' +%s` on BSD/macOS
 curl -s -H "Authorization: Bearer $TOKEN" \
   'https://opensky-network.org/api/states/all?icao24=4ca7b5&time=1773237600' | jq .
 
 # every flight this airframe flew in a two-day window (the maximum interval)
 curl -s -H "Authorization: Bearer $TOKEN" \
   'https://opensky-network.org/api/flights/aircraft?icao24=4ca7b5&begin=1740614400&end=1740787200' \
   | jq '.[] | {firstSeen, estDepartureAirport, lastSeen, estArrivalAirport}'
 
 # arrivals at an airport, for finding who came in on an unlisted flight
 curl -s -H "Authorization: Bearer $TOKEN" \
   'https://opensky-network.org/api/flights/arrival?airport=EGLL&begin=1740614400&end=1740700800' \
   | jq 'length'
 
 # the full track of one flight, including the points between airports
 curl -s -H "Authorization: Bearer $TOKEN" \
   'https://opensky-network.org/api/tracks/all?icao24=4ca7b5&time=0' | jq '.path | length'
 ```
 
 Free-tier limits are credit-based and daily: roughly 400 credits anonymous, 4,000 for a registered
 account, 8,000 if you feed data back from your own receiver with at least 30% uptime. A
 `/states/all` call costs 1–4 credits depending on how large the bounding box is; `/flights/*` and
 `/tracks/*` cost far more because they scan day partitions, so a careless historical loop burns a
 day's quota in a few calls. `/flights/aircraft` only serves the previous day and earlier — there is
 no same-day history.
 
 What it does not tell you: the hex address identifies a transponder, not an owner, and the
 `callsign` field is whatever the crew typed. An aircraft absent from the results was not
 necessarily absent from the sky — it may have been out of receiver range, or not transmitting at
 all.
 
 ### pyopensky
 
 The maintained Python client, worth using over hand-rolled requests because it handles the token
 refresh and because it also wraps OpenSky's Trino historical database, which the REST API does not
 expose.
 
 ```bash
 pip install pyopensky
 ```
 
 Credentials go in `settings.conf` (the library prints its location on first run) under a
 `[opensky]` section with `client_id` and `client_secret`.
 
 ```python
 from pyopensky.rest import REST
 from pyopensky.trino import Trino
 import datetime as dt
 
 rest = REST()
 
 # live state vectors in a bounding box, as a DataFrame
 rest.states(bounds=(45, 5, 48, 10))
 
 # the route an airline publishes for a callsign — useful when the callsign is the only clue
 rest.routes("RYR27LQ")
 
 # arrivals and departures at an airport over a window
 rest.arrival("EGLL", dt.datetime(2026, 3, 11), dt.datetime(2026, 3, 12))
 
 # historical flight list for one airframe over months, which REST cannot do
 db = Trino()
 db.flightlist(start="2026-01-01", stop="2026-03-01", icao24="4ca7b5")
 
 # the raw trajectory, for plotting a loiter pattern or an orbit
 db.history(start="2026-03-11 13:00", stop="2026-03-11 16:00", icao24="4ca7b5")
 ```
 
 Trino access is granted separately from the REST credentials and is intended for academic and
 research use — you apply for it, and it is not guaranteed. The REST methods work with ordinary
 credentials. Treat Trino as the thing that makes a months-long pattern-of-life analysis possible,
 and the REST API as what you use day to day.
 
 ### adsb.lol and ADS-B Exchange
 
 ADS-B Exchange retired its freemium API tier in March 2025; the current `ADSBexchange.com` RapidAPI
 plan starts around $10/month for 10,000 requests, and there is no free key. The map at
 [globe.adsbexchange.com](https://globe.adsbexchange.com/) remains free and still shows aircraft
 that honour-the-blocklist aggregators hide, so it stays the right place to *look*. For scripted
 work, [adsb.lol](https://adsb.lol/) serves the same response shape with no key at all.
 
 ```bash
 # one aircraft by ICAO hex — same JSON shape as the ADSBx v2 API
 curl -s 'https://api.adsb.lol/v2/hex/4ca7b5' | jq '.ac[] | {flight, r, t, alt_baro, gs, lat, lon}'
 
 # by callsign, when that is all a photo or an ATC recording gave you
 curl -s 'https://api.adsb.lol/v2/callsign/RYR27LQ' | jq '.ac | length'
 
 # by registration, to confirm a tail number is airborne now
 curl -s 'https://api.adsb.lol/v2/reg/EI-EFZ' | jq '.ac[0].hex'
 
 # every aircraft of a type currently tracked, for fleet questions
 curl -s 'https://api.adsb.lol/v2/type/B738' | jq '.total'
 
 # everything within 50 nm of a point — the query for "what was over this place"
 curl -s 'https://api.adsb.lol/v2/point/51.5/-0.12/50' | jq '.ac[] | {hex, flight, alt_baro}'
 
 # aircraft squawking an emergency code
 curl -s 'https://api.adsb.lol/v2/squawk/7700' | jq '.ac[] | {hex, flight, squawk}'
 
 # military-tagged aircraft worldwide, right now
 curl -s 'https://api.adsb.lol/v2/mil' | jq '.total'
 
 # LADD and PIA: aircraft using the FAA's blocking and anonymisation programmes
 curl -s 'https://api.adsb.lol/v2/ladd' | jq '.total'
 curl -s 'https://api.adsb.lol/v2/pia' | jq '.total'
 ```
 
 There is no documented quota, but the service rate-limits aggressively — a burst of requests starts
 returning HTTP 429 within seconds, so sleep between calls and cache. Both of these are live-only:
 neither gives you history, which is the thing that actually costs money across every ADS-B
 provider.
 
 The `/v2/ladd` and `/v2/pia` endpoints are worth knowing for their own sake. LADD is the FAA
 programme that lets an owner suppress their aircraft from public feeds; PIA assigns a temporary
 alternative hex address. An aircraft appearing in either list is telling you its owner asked not to
 be tracked, which is itself a fact about the aircraft.
 
 ### readsb and dump1090
 
 Your own receiver removes the dependency on someone else's coverage, which matters when the area
 you care about is a coverage hole. A software-defined radio dongle and an antenna gets you ADS-B
 reception out to roughly 200 nautical miles line-of-sight.
 
 `dump1090` has forked repeatedly; the maintained decoder is
 [wiedehopf/readsb](https://github.com/wiedehopf/readsb), with
 [tar1090](https://github.com/wiedehopf/tar1090) as the web interface over it. FlightAware's
 `dump1090-fa` is still maintained and still fine. Mutability's original `dump1090-mutability` is
 abandoned — do not start there.
 
 ```bash
 # readsb, the maintained decoder, via the project's install script
 sudo bash -c "$(wget -qO - https://github.com/wiedehopf/adsb-scripts/raw/master/readsb-install.sh)"
 
 # the web interface over it
 sudo bash -c "$(wget -qO - https://github.com/wiedehopf/tar1090/raw/master/install.sh)"
 
 # what your receiver is seeing right now, as JSON
 curl -s http://localhost/tar1090/data/aircraft.json | jq '.aircraft | length'
 
 # log your own feed to disk once a second — this is how you build private history
 while true; do
   curl -s http://localhost/tar1090/data/aircraft.json >> "feed-$(date -u +%F).jsonl"
   echo >> "feed-$(date -u +%F).jsonl"
   sleep 1
 done
 
 # receiver stats, including message rate and position accuracy
 curl -s http://localhost/tar1090/data/stats.json | jq '.last1min | {messages, position_rate}'
 
 # raw Mode S frames on port 30002, for anything the decoder discards
 nc localhost 30002 | head -20
 
 # Beast binary format on 30005, which is what you feed to aggregators
 nc localhost 30005 | xxd | head -5
 ```
 
 Running your own receiver gives you one thing no aggregator will: the raw message stream with
 reception timestamps, which lets you say "my receiver, which was hearing six other aircraft in that
 sector at that minute, heard nothing from this one". That is the comparison that turns a gap into
 evidence.
 
 ## Vessels
 
 Ships transmit AIS. Terrestrial receivers reach perhaps 40 nautical miles; beyond that, coverage
 depends on satellite AIS, which is almost entirely commercial.
 
 | Source | Why use it |
 | --- | --- |
 | [MarineTraffic](https://www.marinetraffic.com/) | The standard. Live positions, port calls, vessel particulars, photos. Historical track needs a subscription. |
 | [VesselFinder](https://www.vesselfinder.com/) | Good free tier; useful cross-check, and its coverage differs from MarineTraffic's in ways that matter when you are arguing about a gap. |
 | [Equasis](https://www.equasis.org/) | **Ownership and management history, free with registration.** The best free source for who actually controls a ship. |
 | [IMO GISIS](https://gisis.imo.org/) | Authoritative vessel identity, company and casualty data, free with registration. |
 | [Global Fishing Watch](https://globalfishingwatch.org/map) | Fishing effort and vessel-behaviour events inferred from AIS, plus radar-detected vessels that are not broadcasting. |
 | [IUU Vessel List](https://iuu-vessels.org/) | Vessels listed by regional fisheries bodies for illegal, unreported and unregulated fishing. |
 
 ### Equasis
 
 A free, registration-gated database funded by maritime administrations, holding the ownership and
 management chain for essentially every merchant ship, plus inspection history. It is the single
 most useful free maritime source and it has no API, so this is a walkthrough.
 
 Register at [equasis.org](https://www.equasis.org/) with a working email; approval is automatic but
 can take a day. Then search by IMO number, never by name.
 
 ```text
 Ship Info          flag, type, tonnage, build year, and the full list of PREVIOUS names
                    and previous flags with the dates they changed — this is the panel
                    that exposes a vessel renamed three times in two years
 Management Detail  registered owner, ISM manager, commercial manager, technical manager,
                    each with a company IMO number and a country, and each with the date
                    it took over; the registered owner is usually a one-ship shell, and
                    the commercial manager is usually who you actually want
 Ship History       the same chain backwards in time, which is what you cite when an
                    owner claims they sold the vessel before the incident
 Inspections        port state control inspections, detentions and the deficiency codes,
                    which place the ship in a named port on a named date independently
                    of AIS
 ```
 
 Capture for the record: the company IMO numbers, not just names, because company names repeat
 across jurisdictions. Then take each company IMO into
 [corporate registries](/sheets/osint/companies-and-finance) — the Equasis company record gives you
 a country and an address to start from, and nothing about beneficial ownership.
 
 Equasis is self-reported by the industry and lags reality by weeks on ownership changes. A
 detention record is hard fact; a current owner field is a claim.
 
 ### Global Fishing Watch API
 
 AIS-derived vessel behaviour as a queryable dataset rather than a map: identity resolution across
 MMSI and IMO, and coded events — encounters between two vessels, loitering, port visits, and AIS
 gaps. The gap detection is the part that matters outside fisheries work, because it has already
 done the coverage reasoning for you.
 
 Get a token at [globalfishingwatch.org/our-apis/tokens](https://globalfishingwatch.org/our-apis/tokens).
 Access is free and non-commercial only.
 
 ```bash
 TOKEN='YOUR_GFW_TOKEN'
 
 # resolve an identifier to GFW's vessel id, with flag and name history
 curl -s -H "Authorization: Bearer $TOKEN" -G \
   'https://gateway.api.globalfishingwatch.org/v3/vessels/search' \
   --data-urlencode 'query=9876543' \
   --data-urlencode 'datasets[0]=public-global-vessel-identity:latest' \
   | jq '.entries[] | {id:.selfReportedInfo[0].id, name:.selfReportedInfo[0].shipname, flag:.selfReportedInfo[0].flag}'
 
 # encounters: two vessels close and slow for long enough to transfer something
 curl -s -H "Authorization: Bearer $TOKEN" -G \
   'https://gateway.api.globalfishingwatch.org/v3/events' \
   --data-urlencode 'datasets[0]=public-global-encounters-events:latest' \
   --data-urlencode 'vessels[0]=VESSEL_ID' \
   --data-urlencode 'start-date=2026-01-01' --data-urlencode 'end-date=2026-03-01' | jq '.total'
 
 # AIS gaps — transmission stopping and resuming, with both endpoints
 curl -s -H "Authorization: Bearer $TOKEN" -G \
   'https://gateway.api.globalfishingwatch.org/v3/events' \
   --data-urlencode 'datasets[0]=public-global-gaps-events:latest' \
   --data-urlencode 'vessels[0]=VESSEL_ID' \
   --data-urlencode 'start-date=2026-01-01' --data-urlencode 'end-date=2026-03-01' \
   | jq '.entries[] | {start, end, lat:.position.lat, lon:.position.lon}'
 
 # loitering: slow movement away from port, often the other half of an encounter
 curl -s -H "Authorization: Bearer $TOKEN" -G \
   'https://gateway.api.globalfishingwatch.org/v3/events' \
   --data-urlencode 'datasets[0]=public-global-loitering-events:latest' \
   --data-urlencode 'vessels[0]=VESSEL_ID' \
   --data-urlencode 'start-date=2026-01-01' --data-urlencode 'end-date=2026-03-01' | jq '.total'
 
 # port visits, which date the vessel to a jurisdiction
 curl -s -H "Authorization: Bearer $TOKEN" -G \
   'https://gateway.api.globalfishingwatch.org/v3/events' \
   --data-urlencode 'datasets[0]=public-global-port-visits-events:latest' \
   --data-urlencode 'vessels[0]=VESSEL_ID' \
   --data-urlencode 'start-date=2026-01-01' --data-urlencode 'end-date=2026-03-01' | jq '.total'
 ```
 
 A GFW gap event is a reasoned inference, not a raw observation: it accounts for expected satellite
 coverage and known reception quality in that cell, which is exactly the work you would otherwise
 have to do yourself. It is still an inference — a receiver outage or an equipment failure produces
 the same signature as a deliberate switch-off.
 
 ## Evidencing a gap
 
 The difference between "went dark" as a finding and as a guess is whether you can show the data
 should have been there.
 
 ```text
 1. Fix the window        last position with a timestamp, first position after, both with
                          the reporting source named
 2. Establish coverage    other aircraft or vessels reported in the same cell during the
                          same window, from the same feed. If nothing else reported either,
                          you have a coverage hole, not a dark period
 3. Cross-feed            check a second, independent network: adsb.lol against OpenSky,
                          VesselFinder against MarineTraffic. Independent receiver
                          populations failing identically is coverage; one seeing traffic
                          while the other does not is a reception artefact
 4. Check the physics     the distance between last and first position divided by the gap
                          duration gives an implied speed. An implied 60 knots for a bulk
                          carrier means the track is wrong, not that the ship was fast
 5. Look for the reason   GPSJam for the aircraft case, since jamming degrades position
                          quality before it removes it; a port call or an AIS equipment
                          deficiency in the Equasis inspection record for the vessel case
 6. Corroborate           satellite imagery over the implied position during the gap.
                          A radar or optical detection of a hull where AIS says nothing
                          is the strongest version of this finding
 ```
 
 The three mechanisms to distinguish between: **transponder off**, where transmission simply stops
 and resumes, usually near a transfer or a sanctioned port; **MMSI spoofing**, where the identifier
 is set to another vessel's or an invalid one, detectable as two vessels with one MMSI in different
 oceans, or an MMSI whose country prefix contradicts the claimed flag; and **position spoofing**,
 where the track is plausible but false, detectable as an implied speed the hull cannot do, a track
 that crosses land, or imagery showing the berth empty.
 
 ## Rail and road
 
 - [OpenRailwayMap](https://www.openrailwaymap.org/) — global rail infrastructure, including
   electrification, gauge and signalling, which constrains what can run on a line.
 - [Chronotrains](https://www.chronotrains.com/) — how far you can travel by train in N hours,
   useful for bounding where someone could have been.
 - [License Plate Maps](https://www.licenseplatemania.com/) — plate formats by country, for
   narrowing a location from a vehicle in a photograph.
 - [VIN Decoder (NHTSA)](https://vpic.nhtsa.dot.gov/decoder/) — free US government VIN decode, with
   a JSON API: `curl -s 'https://vpic.nhtsa.dot.gov/api/vehicles/decodevin/1HGCM82633A004352?format=json'`
 
 ## Tool reference
 
 | Tool | What it does | Cost |
 | --- | --- | --- |
 | [Aviation Safety Network](https://aviation-safety.net/) | Aircraft incident database; can be searched by country, registration, year, etc. | free |
 | [Chronotrains](https://www.chronotrains.com/en) | Chronotrains is a free interactive map designed to explore the reach of Europe’s extensive rail network. Enter a starting point and travel time to see… | free |
 | [Federal Aviation Administration](https://registry.faa.gov/AircraftInquiry/Search/NNumberInquiry) | Nationwide Plane Registry. Search by N-Number (a.k.a. callsign). Comprehensive list of privately owned planes in the US. | free |
 | [FlightAware](https://www.flightaware.com/live/) | FlightAware is a global flight-tracking platform that provides real-time data on aircraft movements. It offers live tracking, historical data, and… | partly free |
 | [Illegal, unreported, unregular fishing Vessels List](https://iuu-vessels.org/Home/Search) | A combined list of known illegal, unreported, unregular fishing vessels | free |
 | [OpenRailwayMap](https://wiki.openstreetmap.org/wiki/OpenRailwayMap) | a detailed online map of the world's railway infrastructure | free |
 | [OpenSky-Network](http://opensky-network.org/) | Community, open source flight tracking network. | free |
 | [ShipFinder](https://shipfinder.co/) | ShipFinder is an application designed to track vessels in near real-time across the globe, available on iPhone and Android platforms (but no longer PC) | partly free |
 | License Plate Maps | Collection of tools and maps for discerning license plates by country | free |
 
 ## Pitfalls
 
 - **Coverage gaps read as events.** Most disappearances are receiver coverage, not evasion. Check
   the coverage map before claiming a vessel went dark.
 - **Callsigns and names are not identities.** Track on ICAO hex and IMO number.
 - **Historical data usually costs money**, and free sites silently retain only days. Capture what
   you need when you see it.
 - **Flags of convenience** mean the flag state tells you little about real ownership. Use Equasis.
 
 ## Worked example
 
 You have one datum: the tail number `N721AB`, from a photograph of an aircraft on a stand. The
 registration, hex and outputs below are illustrative — the sequence of pivots is the point.
 
 ```bash
 # 1. registration to hex, from a live feed — the hex is what you track on
 curl -s 'https://api.adsb.lol/v2/reg/N721AB' | jq '.ac[0] | {hex, t, flight, alt_baro}'
 # {"hex":"a8a2b5","t":"GLF6","flight":null,"alt_baro":"ground"}
 ```
 
 The airframe is a Gulfstream G650ER and it is on the ground somewhere right now. The hex `a8a2b5`
 is the identifier for everything that follows.
 
 ```bash
 # 2. registered owner, from the FAA registry — not the operator
 #    registry.faa.gov/AircraftInquiry/Search/NNumberInquiry, N721AB
 # -> registered to a Delaware LLC, c/o a Nevada registered agent
 ```
 
 A single-purpose LLC behind a registered agent is the normal arrangement for a private jet, so the
 registry gives you a company name, not a person. That name goes to
 [corporate records](/sheets/osint/companies-and-finance).
 
 ```bash
 # 3. the movement history, from OpenSky (begin/end are 2025-02-27 to 03-01 —
 #    two days is the maximum interval /flights/aircraft accepts)
 TOKEN=$(curl -s -X POST \
   'https://auth.opensky-network.org/auth/realms/opensky-network/protocol/openid-connect/token' \
   -d 'grant_type=client_credentials' -d 'client_id=ID' \
   --data-urlencode 'client_secret=SECRET' | jq -r .access_token)
 
 curl -s -H "Authorization: Bearer $TOKEN" \
   'https://opensky-network.org/api/flights/aircraft?icao24=a8a2b5&begin=1740614400&end=1740787200' \
   | jq '.[] | {dep:.estDepartureAirport, arr:.estArrivalAirport, off:.firstSeen, on:.lastSeen}'
 # three legs across the window; the second shows estDepartureAirport "KVNY"
 # and estArrivalAirport null
 ```
 
 A leg with a departure and no arrival is the pivot. Either the aircraft left coverage, or the
 transponder stopped.
 
 ```bash
 # 4. the raw track for that leg, to find where the positions stop
 curl -s -H "Authorization: Bearer $TOKEN" \
   'https://opensky-network.org/api/tracks/all?icao24=a8a2b5&time=1740671000' \
   | jq '.path[-3:]'
 # last point 31.2N 118.4W at FL410, over open water south-west of San Diego
 ```
 
 ```bash
 # 5. was that a coverage hole? ask what else reported in the same cell
 curl -s -H "Authorization: Bearer $TOKEN" \
   'https://opensky-network.org/api/states/all?time=1740671400&lamin=30&lomin=-120&lamax=33&lomax=-116' \
   | jq '[.states[] | {icao:.[0], alt:.[13]}] | length'
 # 0 — nothing at all reported in that box at that minute
 ```
 
 Zero other aircraft in a box that size over a busy approach corridor is a coverage answer, not an
 evasion answer: the aircraft flew out of the receiver network's reach over the Pacific. Checking
 [adsb.lol](https://adsb.lol/) for the same window returns nothing either, from an independent
 receiver population — which confirms coverage rather than contradicting it.
 
 What you can assert: a type, a hex, a registered owner to take into company records, three
 dated legs, and a documented reason to *not* report a dark period. What it does not give you is who
 was on board, which no transponder feed ever will — that needs a stand photograph with a timestamp,
 a flight-plan filing, or a planespotter's log, and the second independent source is what would make
 it defensible.
 
 What would falsify it: another receiver network showing continued positions through the alleged
 coverage gap, the registration-to-hex mapping changing before the flight, or the OpenSky track
 belonging to a reused callsign rather than hex `a8a2b5`. The no-evasion conclusion rests on the
 empty comparison cell across independent receiver populations, not on the missing arrival alone.
 
 ## Broader catalogues
 
 - [Transport OSINT](https://tools.osintnewsletter.com/tool-categories/transport-osint)
 
 
 ## More tools
 
 Further tools for this area from the OSINT Newsletter Tools Library ([Transport OSINT](https://tools.osintnewsletter.com/tool-categories/transport-osint)), excluding those already listed above.
 
 | Tool | What it does |
 | --- | --- |
 | [Air Cargo Tracking & News](https://www.utopiax.org/#google_vignette) | A free logistics portal that aggregates air cargo tracking, container tracking, parcel tracking, sailing schedules, logistics… |
 | [autoDNA](https://www.autodna.com/) | A vehicle history checking platform that uses a vehicle's VIN (Vehicle Identification Number) to uncover information about its… |
 | [Car Detective](https://www.cardetective.com/) | A vehicle intelligence platform providing access to vehicle history, registration information, and provenance data. |
 | [CITES Trade Database](https://trade.cites.org/) | An official database of international trade in species protected under the Convention on International Trade in Endangered… |
 | [Combat Aircraft](https://www.combataircraft.com/) | Military aviation reference database providing aircraft specifications, operators, imagery, aviation news, and background… |
 | [Container Tracking](http://container-tracking.org/) | A web-based tool for tracking shipping containers using container numbers, providing information on vessel movements, shipment… |
 | [Global ADS-B Exchange](https://globe.adsbexchange.com/) | Track aircraft movements worldwide in near real time using crowdsourced ADS-B signals. |
 | [Global Suppliers Online](https://www.globalsuppliersonline.com/) | A business directory that connects buyers with manufacturers, exporters, wholesalers and suppliers worldwide. |
 | [Import Yeti](https://www.importyeti.com/) | A supply chain intelligence tool that helps users discover who imports products into the United States and which overseas… |
 | [Live Train Tracker](https://mobility.portal.geops.io/world.geops.transit) | Interactive global public-transport map showing scheduled and, where available, real-time positions of trains and other… |
 | [LiveATC](https://www.liveatc.net/) | A live air traffic communications platform that streams air traffic control (ATC) radio transmissions from airports around the… |
 | [Maersk Tracking](https://www.maersk.com/tracking/#tracking) | A global cargo tracking platform providing visibility of Maersk ocean and air shipments, including container movements, shipment… |
 | [Maritime Database](https://maritime-database.com/) | Global maritime reference and vessel-tracking database providing vessel, port, and maritime-company information. |
 | [Open Infrastructure Map](https://openinframap.org/) | An interactive mapping platform that visualises critical infrastructure worldwide using data primarily sourced from OpenStreetMap. |
 | [OSINT Tools Map](https://cybdetective.com/osintmap/) | An interactive directory of country-specific OSINT resources, including phonebooks, cadastral maps, business registers, court… |
 | [Track-Trace](https://www.track-trace.com/) | An online tracking and lookup service that helps users trace parcels and shipments using tracking numbers. |
 | [Vehicle AI](https://vehicle-ai.net/) | AI-powered tool for identifying, analysing, and enriching vehicle-related data. |
 | [VIN Decoder from NHTSA](https://vpic.nhtsa.dot.gov/decoder/) | Official U.S. government tool that breaks down a vehicle’s VIN to reveal key details like manufacturer, model, engine type, and… |
 
 ## Sources
 
 Both catalogues below are maintained by other people and are considerably larger than
 this page. Use them as the canonical index; this sheet is a working route through them.
 
 - [Bellingcat's Online Investigation Toolkit](https://bellingcat.gitbook.io/toolkit) — ~340 tools, each with its own
   review page covering cost, difficulty, requirements and limitations.
 - [OSINT Newsletter Tools Library](https://tools.osintnewsletter.com) — ~280 tools, organised by investigative goal.
 
 Neither publishes a licence, so nothing here is copied from them: tool names, one-line
 descriptions, cost flags and links are catalogue facts, and the method and commentary are
 this site's own. See [credits](/credits).