Evidence Detection & scoring

No black box. Named risk.

A compliance team can’t act on a number it can’t explain. Every point in a Peloryn rating is attributed to a named signal — so a reviewer sees exactly why a vessel scored the way it did.

An explainable rating

The score is just the signals, added up in the open.

MT Arendal Spirit · IMO 9514306
41Review
AIS gap near Skaw behavioural+18
STS contact, counterpart unlit behavioural+14
Ownership opacity at layer 3 ownership+9
Sanctions screening officialNo match

Three named behavioural and ownership signals raised this vessel to Review. The sanctions screen returned no match — so the score reflects conduct and structure, not a listing.

Open any point and you reach its source, its timestamp, and its confidence. There is no hidden weight, no proprietary number you can’t question.

How each signal is sourced

The decision

One vessel. One label. Defined, not vibes.

Clear

No major active risk signals from the available evidence. Normal due diligence still applies.

Review

One or more signals worth awareness before exposure — not yet enough to escalate.

Investigate

Strong or combined behavioural signals that warrant a deeper look before you commit.

Reject

A direct official-source match. The hard stop — driven only by the published record.

Peloryn Protect uses Clear · Review · Investigate · Reject. Peloryn Verify reports decision support as Clear · Review · Elevated — never an automatic go / no-go.

The signal catalogue

What detection is actually looking for.

Each is a reviewable indicator, weighed in context — a single one rarely means much; several together build a picture.

AIS gaps & dark activity

Unexplained silence in a high-coverage zone — assessed by duration, location, and reappearance.

Ship-to-ship transfers

STS behaviour weighed by vessel type, proximity, and context — with ARA-barge false positives suppressed.

Kinematic spoofing

Movement that is physically implausible — too far, too fast — flagged against real-world limits.

MMSI conflicts

One identifier in two impossible places at once — a sign of bad data, misuse, or cloning.

Reflagging & identity change

Name, flag, or operator changes that don’t add up — the shadow fleet’s favourite move.

Suspicious loitering

Waiting outside normal operating areas — possible rendezvous staging.

Destination swaps

A declared destination changed mid-voyage, near a sensitive route or alongside other signals.

Tainted vessel contact

A clean-looking vessel that recently met one already carrying active risk indicators.

Sanctioned-zone activity

Entering, exiting, or going dark near a monitored or sanctioned area.

Risk you can explain

See a scored vessel, point by point.

Run a real vessel through Protect, or request a sample Verify report with the full behavioural breakdown.