Technical trace that opens the system

Financial Times identified 48 seemingly independent companies that are likely part of a single network helping Rosneft evade sanctions. The connecting element is a single private mail server, mx.phoenixtrading.ltd, through which 442 web domains were registered — a key to the investigation.

"Financial Times identified 48 seemingly independent companies that are likely part of a single network helping Rosneft evade sanctions"

— Financial Times

Who appears on the list

Journalists cross‑checked domains with customs documents and found matches. Examples include: Dubai’s Foxton FZCO (purchases of Russian oil worth $5.6 billion) corresponding to the domain foxton-fzco.com, and Advan Alliance, which supplied oil to India worth $1.5 billion, corresponding to the domain advanalliance.ltd. The domain TahirQarayev.com is linked to Azerbaijani businessman Tahir Garayev and, because of that, journalists infer ties to the company Coral Energy. The list also mentions the domain EEOffice.com, associated with Etibar Eyub — a person the EU considers a close associate of Rosneft’s leadership.

Why this matters for sanctions policy

FT estimates the volume of oil moved through this network at at least $90 billion, although the real sum may be higher due to incomplete customs data. This is not just numbers: networks like this undermine the effectiveness of sanctions by allowing firms to conceal cargo origins and financial flows.

Identification through technical traces — such as a shared mail server or domains — provides a tool for targeted action: blocking domains, making requests to registrars, international cooperation among law enforcement and bank tracking of transactions.

Context and consequences for Ukraine

This investigation appeared against the backdrop of strengthened sanctions: on December 13 Ukraine implemented its largest package to date against the shadow fleet — 656 vessels. The discovery of such networks underscores that sanctions must work not only declaratively but technically: we need rapid data exchange with partners and coordinated responses from domain registrars, hosting providers and financial institutions.

"The presence of a technical trace gives a rare opportunity to move from suspicion to the evidentiary basis needed for sanctions and legal investigations"

— Financial Times (report)

What can be done next

Short term: international partners can target and block domains, initiate legal requests to registrars, and strengthen control over shipping routes. Medium term: new transparency standards are needed for company and domain registration, as well as enhanced monitoring of financial flows linked to oil trade.

Conclusion

The technical lapse identified by FT is not just a scoop but practical proof that a sanctions regime must operate at the level of domains, servers and logistics. The question now is whether partner countries will turn this information into concrete pressure tools and legal responses — because the effectiveness of restrictions and our ability to disrupt the aggressor’s economic channels depend on it.