Aircraft, Vessel & Vehicle Tracking

What this covers

Aircraft and vessels broadcast their own positions, which makes transport one of the few OSINT domains with a structured, queryable, global feed behind it. The important knowledge is not which website to open — it is where the data has gaps, because the gaps are where the interesting behaviour is, and distinguishing a coverage gap from an evasion is the whole skill.

Method

1. Pin the durable identifier first. For aircraft that is the ICAO 24-bit hex address; for vessels the IMO number. Registrations, callsigns, names and flags all change, frequently on purpose, and a track assembled on a callsign will silently merge two aircraft.
2. Look at live data on a map to orient yourself, then stop using the map. Anything you intend to assert needs the underlying records, because a screenshot of a map is not reproducible and the free sites retain only days.
3. Pull the track from an API and store it. Positions, timestamps and the receiver metadata if you can get it. Historical ADS-B and AIS are the parts that cost money, so capture while you can see it rather than planning to come back.
4. Resolve the operator separately from the registered owner. Aircraft sit in trusts and leasing companies; ships sit under flags of convenience with a manager in a third country. The tracking feed names neither — that is a corporate records problem.
5. Characterise the gap before you call it a gap. Establish the coverage baseline for that area and that hour, from a second receiver network if possible, then show the vessel or aircraft was inside coverage and absent anyway. Without that comparison you have a missing data point, not a dark period.
6. Corroborate position with something that is not a transponder. Satellite imagery over the claimed location and time, a port-call record, a photograph with a spotter’s timestamp. A transponder reports what it is told to report.

Aircraft

Aircraft transmit ADS-B: identity, position, altitude, speed, on 1090 MHz. Reception is crowd-sourced, so coverage follows volunteer receivers, which follow population and wealth.

OpenSky Network API

The feed to automate against. It publishes state vectors (one position per aircraft per second, aggregated from its receiver network), per-aircraft flight lists, and full tracks, with a documented rate model rather than a scraping fight.

The auth model changed: HTTP basic authentication with your account password is gone. Current access is OAuth2 client credentials — create an API client in your OpenSky account, then exchange the client ID and secret for a 30-minute bearer token.

# one-off: get a token (expires in 30 minutes; a 401 later means refresh it)
TOKEN=$(curl -s -X POST \
  'https://auth.opensky-network.org/auth/realms/opensky-network/protocol/openid-connect/token' \
  -d 'grant_type=client_credentials' \
  -d 'client_id=YOUR_CLIENT_ID' \
  --data-urlencode 'client_secret=YOUR_CLIENT_SECRET' | jq -r .access_token)

# current state of one aircraft by ICAO 24-bit address
curl -s -H "Authorization: Bearer $TOKEN" \
  'https://opensky-network.org/api/states/all?icao24=4ca7b5' | jq '.states'

# everything in a bounding box right now — cheaper in credits than a global pull
curl -s -H "Authorization: Bearer $TOKEN" \
  'https://opensky-network.org/api/states/all?lamin=45&lomin=5&lamax=48&lomax=10' \
  | jq '.states | length'

# aircraft category as well as position, for sorting military from civil
curl -s -H "Authorization: Bearer $TOKEN" \
  'https://opensky-network.org/api/states/all?icao24=4ca7b5&extended=1' | jq .

# state vector at a past instant — the cheap way to answer "where was it at 14:00Z"
#   1773237600 is 2026-03-11T14:00Z; `date -u -d '2026-03-11 14:00' +%s` on GNU,
#   `date -u -j -f '%Y-%m-%d %H:%M' '2026-03-11 14:00' +%s` on BSD/macOS
curl -s -H "Authorization: Bearer $TOKEN" \
  'https://opensky-network.org/api/states/all?icao24=4ca7b5&time=1773237600' | jq .

# every flight this airframe flew in a two-day window (the maximum interval)
curl -s -H "Authorization: Bearer $TOKEN" \
  'https://opensky-network.org/api/flights/aircraft?icao24=4ca7b5&begin=1740614400&end=1740787200' \
  | jq '.[] | {firstSeen, estDepartureAirport, lastSeen, estArrivalAirport}'

# arrivals at an airport, for finding who came in on an unlisted flight
curl -s -H "Authorization: Bearer $TOKEN" \
  'https://opensky-network.org/api/flights/arrival?airport=EGLL&begin=1740614400&end=1740700800' \
  | jq 'length'

# the full track of one flight, including the points between airports
curl -s -H "Authorization: Bearer $TOKEN" \
  'https://opensky-network.org/api/tracks/all?icao24=4ca7b5&time=0' | jq '.path | length'

Free-tier limits are credit-based and daily: roughly 400 credits anonymous, 4,000 for a registered account, 8,000 if you feed data back from your own receiver with at least 30% uptime. A /states/all call costs 1–4 credits depending on how large the bounding box is; /flights/* and /tracks/* cost far more because they scan day partitions, so a careless historical loop burns a day’s quota in a few calls. /flights/aircraft only serves the previous day and earlier — there is no same-day history.

What it does not tell you: the hex address identifies a transponder, not an owner, and the callsign field is whatever the crew typed. An aircraft absent from the results was not necessarily absent from the sky — it may have been out of receiver range, or not transmitting at all.

pyopensky

The maintained Python client, worth using over hand-rolled requests because it handles the token refresh and because it also wraps OpenSky’s Trino historical database, which the REST API does not expose.

pip install pyopensky

Credentials go in settings.conf (the library prints its location on first run) under a [opensky] section with client_id and client_secret.

from pyopensky.rest import REST
from pyopensky.trino import Trino
import datetime as dt

rest = REST()

# live state vectors in a bounding box, as a DataFrame
rest.states(bounds=(45, 5, 48, 10))

# the route an airline publishes for a callsign — useful when the callsign is the only clue
rest.routes("RYR27LQ")

# arrivals and departures at an airport over a window
rest.arrival("EGLL", dt.datetime(2026, 3, 11), dt.datetime(2026, 3, 12))

# historical flight list for one airframe over months, which REST cannot do
db = Trino()
db.flightlist(start="2026-01-01", stop="2026-03-01", icao24="4ca7b5")

# the raw trajectory, for plotting a loiter pattern or an orbit
db.history(start="2026-03-11 13:00", stop="2026-03-11 16:00", icao24="4ca7b5")

Trino access is granted separately from the REST credentials and is intended for academic and research use — you apply for it, and it is not guaranteed. The REST methods work with ordinary credentials. Treat Trino as the thing that makes a months-long pattern-of-life analysis possible, and the REST API as what you use day to day.

adsb.lol and ADS-B Exchange

ADS-B Exchange retired its freemium API tier in March 2025; the current ADSBexchange.com RapidAPI plan starts around $10/month for 10,000 requests, and there is no free key. The map at globe.adsbexchange.com remains free and still shows aircraft that honour-the-blocklist aggregators hide, so it stays the right place to look. For scripted work, adsb.lol serves the same response shape with no key at all.

# one aircraft by ICAO hex — same JSON shape as the ADSBx v2 API
curl -s 'https://api.adsb.lol/v2/hex/4ca7b5' | jq '.ac[] | {flight, r, t, alt_baro, gs, lat, lon}'

# by callsign, when that is all a photo or an ATC recording gave you
curl -s 'https://api.adsb.lol/v2/callsign/RYR27LQ' | jq '.ac | length'

# by registration, to confirm a tail number is airborne now
curl -s 'https://api.adsb.lol/v2/reg/EI-EFZ' | jq '.ac[0].hex'

# every aircraft of a type currently tracked, for fleet questions
curl -s 'https://api.adsb.lol/v2/type/B738' | jq '.total'

# everything within 50 nm of a point — the query for "what was over this place"
curl -s 'https://api.adsb.lol/v2/point/51.5/-0.12/50' | jq '.ac[] | {hex, flight, alt_baro}'

# aircraft squawking an emergency code
curl -s 'https://api.adsb.lol/v2/squawk/7700' | jq '.ac[] | {hex, flight, squawk}'

# military-tagged aircraft worldwide, right now
curl -s 'https://api.adsb.lol/v2/mil' | jq '.total'

# LADD and PIA: aircraft using the FAA's blocking and anonymisation programmes
curl -s 'https://api.adsb.lol/v2/ladd' | jq '.total'
curl -s 'https://api.adsb.lol/v2/pia' | jq '.total'

There is no documented quota, but the service rate-limits aggressively — a burst of requests starts returning HTTP 429 within seconds, so sleep between calls and cache. Both of these are live-only: neither gives you history, which is the thing that actually costs money across every ADS-B provider.

The /v2/ladd and /v2/pia endpoints are worth knowing for their own sake. LADD is the FAA programme that lets an owner suppress their aircraft from public feeds; PIA assigns a temporary alternative hex address. An aircraft appearing in either list is telling you its owner asked not to be tracked, which is itself a fact about the aircraft.

readsb and dump1090

Your own receiver removes the dependency on someone else’s coverage, which matters when the area you care about is a coverage hole. A software-defined radio dongle and an antenna gets you ADS-B reception out to roughly 200 nautical miles line-of-sight.

dump1090 has forked repeatedly; the maintained decoder is wiedehopf/readsb, with tar1090 as the web interface over it. FlightAware’s dump1090-fa is still maintained and still fine. Mutability’s original dump1090-mutability is abandoned — do not start there.

# readsb, the maintained decoder, via the project's install script
sudo bash -c "$(wget -qO - https://github.com/wiedehopf/adsb-scripts/raw/master/readsb-install.sh)"

# the web interface over it
sudo bash -c "$(wget -qO - https://github.com/wiedehopf/tar1090/raw/master/install.sh)"

# what your receiver is seeing right now, as JSON
curl -s http://localhost/tar1090/data/aircraft.json | jq '.aircraft | length'

# log your own feed to disk once a second — this is how you build private history
while true; do
  curl -s http://localhost/tar1090/data/aircraft.json >> "feed-$(date -u +%F).jsonl"
  echo >> "feed-$(date -u +%F).jsonl"
  sleep 1
done

# receiver stats, including message rate and position accuracy
curl -s http://localhost/tar1090/data/stats.json | jq '.last1min | {messages, position_rate}'

# raw Mode S frames on port 30002, for anything the decoder discards
nc localhost 30002 | head -20

# Beast binary format on 30005, which is what you feed to aggregators
nc localhost 30005 | xxd | head -5

Running your own receiver gives you one thing no aggregator will: the raw message stream with reception timestamps, which lets you say “my receiver, which was hearing six other aircraft in that sector at that minute, heard nothing from this one”. That is the comparison that turns a gap into evidence.

Vessels

Ships transmit AIS. Terrestrial receivers reach perhaps 40 nautical miles; beyond that, coverage depends on satellite AIS, which is almost entirely commercial.

Equasis

A free, registration-gated database funded by maritime administrations, holding the ownership and management chain for essentially every merchant ship, plus inspection history. It is the single most useful free maritime source and it has no API, so this is a walkthrough.

Register at equasis.org with a working email; approval is automatic but can take a day. Then search by IMO number, never by name.

Ship Info          flag, type, tonnage, build year, and the full list of PREVIOUS names
                   and previous flags with the dates they changed — this is the panel
                   that exposes a vessel renamed three times in two years
Management Detail  registered owner, ISM manager, commercial manager, technical manager,
                   each with a company IMO number and a country, and each with the date
                   it took over; the registered owner is usually a one-ship shell, and
                   the commercial manager is usually who you actually want
Ship History       the same chain backwards in time, which is what you cite when an
                   owner claims they sold the vessel before the incident
Inspections        port state control inspections, detentions and the deficiency codes,
                   which place the ship in a named port on a named date independently
                   of AIS

Capture for the record: the company IMO numbers, not just names, because company names repeat across jurisdictions. Then take each company IMO into corporate registries — the Equasis company record gives you a country and an address to start from, and nothing about beneficial ownership.

Equasis is self-reported by the industry and lags reality by weeks on ownership changes. A detention record is hard fact; a current owner field is a claim.

Global Fishing Watch API

AIS-derived vessel behaviour as a queryable dataset rather than a map: identity resolution across MMSI and IMO, and coded events — encounters between two vessels, loitering, port visits, and AIS gaps. The gap detection is the part that matters outside fisheries work, because it has already done the coverage reasoning for you.

Get a token at globalfishingwatch.org/our-apis/tokens. Access is free and non-commercial only.

TOKEN='YOUR_GFW_TOKEN'

# resolve an identifier to GFW's vessel id, with flag and name history
curl -s -H "Authorization: Bearer $TOKEN" -G \
  'https://gateway.api.globalfishingwatch.org/v3/vessels/search' \
  --data-urlencode 'query=9876543' \
  --data-urlencode 'datasets[0]=public-global-vessel-identity:latest' \
  | jq '.entries[] | {id:.selfReportedInfo[0].id, name:.selfReportedInfo[0].shipname, flag:.selfReportedInfo[0].flag}'

# encounters: two vessels close and slow for long enough to transfer something
curl -s -H "Authorization: Bearer $TOKEN" -G \
  'https://gateway.api.globalfishingwatch.org/v3/events' \
  --data-urlencode 'datasets[0]=public-global-encounters-events:latest' \
  --data-urlencode 'vessels[0]=VESSEL_ID' \
  --data-urlencode 'start-date=2026-01-01' --data-urlencode 'end-date=2026-03-01' | jq '.total'

# AIS gaps — transmission stopping and resuming, with both endpoints
curl -s -H "Authorization: Bearer $TOKEN" -G \
  'https://gateway.api.globalfishingwatch.org/v3/events' \
  --data-urlencode 'datasets[0]=public-global-gaps-events:latest' \
  --data-urlencode 'vessels[0]=VESSEL_ID' \
  --data-urlencode 'start-date=2026-01-01' --data-urlencode 'end-date=2026-03-01' \
  | jq '.entries[] | {start, end, lat:.position.lat, lon:.position.lon}'

# loitering: slow movement away from port, often the other half of an encounter
curl -s -H "Authorization: Bearer $TOKEN" -G \
  'https://gateway.api.globalfishingwatch.org/v3/events' \
  --data-urlencode 'datasets[0]=public-global-loitering-events:latest' \
  --data-urlencode 'vessels[0]=VESSEL_ID' \
  --data-urlencode 'start-date=2026-01-01' --data-urlencode 'end-date=2026-03-01' | jq '.total'

# port visits, which date the vessel to a jurisdiction
curl -s -H "Authorization: Bearer $TOKEN" -G \
  'https://gateway.api.globalfishingwatch.org/v3/events' \
  --data-urlencode 'datasets[0]=public-global-port-visits-events:latest' \
  --data-urlencode 'vessels[0]=VESSEL_ID' \
  --data-urlencode 'start-date=2026-01-01' --data-urlencode 'end-date=2026-03-01' | jq '.total'

A GFW gap event is a reasoned inference, not a raw observation: it accounts for expected satellite coverage and known reception quality in that cell, which is exactly the work you would otherwise have to do yourself. It is still an inference — a receiver outage or an equipment failure produces the same signature as a deliberate switch-off.

Evidencing a gap

The difference between “went dark” as a finding and as a guess is whether you can show the data should have been there.

1. Fix the window        last position with a timestamp, first position after, both with
                         the reporting source named
2. Establish coverage    other aircraft or vessels reported in the same cell during the
                         same window, from the same feed. If nothing else reported either,
                         you have a coverage hole, not a dark period
3. Cross-feed            check a second, independent network: adsb.lol against OpenSky,
                         VesselFinder against MarineTraffic. Independent receiver
                         populations failing identically is coverage; one seeing traffic
                         while the other does not is a reception artefact
4. Check the physics     the distance between last and first position divided by the gap
                         duration gives an implied speed. An implied 60 knots for a bulk
                         carrier means the track is wrong, not that the ship was fast
5. Look for the reason   GPSJam for the aircraft case, since jamming degrades position
                         quality before it removes it; a port call or an AIS equipment
                         deficiency in the Equasis inspection record for the vessel case
6. Corroborate           satellite imagery over the implied position during the gap.
                         A radar or optical detection of a hull where AIS says nothing
                         is the strongest version of this finding

The three mechanisms to distinguish between: transponder off, where transmission simply stops and resumes, usually near a transfer or a sanctioned port; MMSI spoofing, where the identifier is set to another vessel’s or an invalid one, detectable as two vessels with one MMSI in different oceans, or an MMSI whose country prefix contradicts the claimed flag; and position spoofing, where the track is plausible but false, detectable as an implied speed the hull cannot do, a track that crosses land, or imagery showing the berth empty.

Rail and road

• OpenRailwayMap — global rail infrastructure, including electrification, gauge and signalling, which constrains what can run on a line.
• Chronotrains — how far you can travel by train in N hours, useful for bounding where someone could have been.
• License Plate Maps — plate formats by country, for narrowing a location from a vehicle in a photograph.
• VIN Decoder (NHTSA) — free US government VIN decode, with a JSON API: curl -s 'https://vpic.nhtsa.dot.gov/api/vehicles/decodevin/1HGCM82633A004352?format=json'

Tool reference

Pitfalls

• Coverage gaps read as events. Most disappearances are receiver coverage, not evasion. Check the coverage map before claiming a vessel went dark.
• Callsigns and names are not identities. Track on ICAO hex and IMO number.
• Historical data usually costs money, and free sites silently retain only days. Capture what you need when you see it.
• Flags of convenience mean the flag state tells you little about real ownership. Use Equasis.

Worked example

You have one datum: the tail number N721AB, from a photograph of an aircraft on a stand. The registration, hex and outputs below are illustrative — the sequence of pivots is the point.

# 1. registration to hex, from a live feed — the hex is what you track on
curl -s 'https://api.adsb.lol/v2/reg/N721AB' | jq '.ac[0] | {hex, t, flight, alt_baro}'
# {"hex":"a8a2b5","t":"GLF6","flight":null,"alt_baro":"ground"}

The airframe is a Gulfstream G650ER and it is on the ground somewhere right now. The hex a8a2b5 is the identifier for everything that follows.

# 2. registered owner, from the FAA registry — not the operator
#    registry.faa.gov/AircraftInquiry/Search/NNumberInquiry, N721AB
# -> registered to a Delaware LLC, c/o a Nevada registered agent

A single-purpose LLC behind a registered agent is the normal arrangement for a private jet, so the registry gives you a company name, not a person. That name goes to corporate records.

# 3. the movement history, from OpenSky (begin/end are 2025-02-27 to 03-01 —
#    two days is the maximum interval /flights/aircraft accepts)
TOKEN=$(curl -s -X POST \
  'https://auth.opensky-network.org/auth/realms/opensky-network/protocol/openid-connect/token' \
  -d 'grant_type=client_credentials' -d 'client_id=ID' \
  --data-urlencode 'client_secret=SECRET' | jq -r .access_token)

curl -s -H "Authorization: Bearer $TOKEN" \
  'https://opensky-network.org/api/flights/aircraft?icao24=a8a2b5&begin=1740614400&end=1740787200' \
  | jq '.[] | {dep:.estDepartureAirport, arr:.estArrivalAirport, off:.firstSeen, on:.lastSeen}'
# three legs across the window; the second shows estDepartureAirport "KVNY"
# and estArrivalAirport null

A leg with a departure and no arrival is the pivot. Either the aircraft left coverage, or the transponder stopped.

# 4. the raw track for that leg, to find where the positions stop
curl -s -H "Authorization: Bearer $TOKEN" \
  'https://opensky-network.org/api/tracks/all?icao24=a8a2b5&time=1740671000' \
  | jq '.path[-3:]'
# last point 31.2N 118.4W at FL410, over open water south-west of San Diego

# 5. was that a coverage hole? ask what else reported in the same cell
curl -s -H "Authorization: Bearer $TOKEN" \
  'https://opensky-network.org/api/states/all?time=1740671400&lamin=30&lomin=-120&lamax=33&lomax=-116' \
  | jq '[.states[] | {icao:.[0], alt:.[13]}] | length'
# 0 — nothing at all reported in that box at that minute

Zero other aircraft in a box that size over a busy approach corridor is a coverage answer, not an evasion answer: the aircraft flew out of the receiver network’s reach over the Pacific. Checking adsb.lol for the same window returns nothing either, from an independent receiver population — which confirms coverage rather than contradicting it.

What you can assert: a type, a hex, a registered owner to take into company records, three dated legs, and a documented reason to not report a dark period. What it does not give you is who was on board, which no transponder feed ever will — that needs a stand photograph with a timestamp, a flight-plan filing, or a planespotter’s log, and the second independent source is what would make it defensible.

What would falsify it: another receiver network showing continued positions through the alleged coverage gap, the registration-to-hex mapping changing before the flight, or the OpenSky track belonging to a reused callsign rather than hex a8a2b5. The no-evasion conclusion rests on the empty comparison cell across independent receiver populations, not on the missing arrival alone.

Broader catalogues

• Transport OSINT

More tools

Further tools for this area from the OSINT Newsletter Tools Library (Transport OSINT), excluding those already listed above.

Sources

Both catalogues below are maintained by other people and are considerably larger than this page. Use them as the canonical index; this sheet is a working route through them.

• Bellingcat’s Online Investigation Toolkit — ~340 tools, each with its own review page covering cost, difficulty, requirements and limitations.
• OSINT Newsletter Tools Library — ~280 tools, organised by investigative goal.

Neither publishes a licence, so nothing here is copied from them: tool names, one-line descriptions, cost flags and links are catalogue facts, and the method and commentary are this site’s own. See credits.