Shipping Container: Data Point Intelligence Guide

Eleven characters follow a steel box from a factory yard to a customs hold. The check digit tells you in a second whether the number is even real.

Understanding the Shipping Container as an intelligence artifact

A shipping container identifier follows ISO 6346: a three-letter owner prefix, a category identifier letter for freight containers, a six-digit serial number and a single check digit computed from the preceding ten characters. Owner prefixes are registered centrally with the Bureau International des Containers. A separate four-character size and type code describes length, height and construction, distinguishing dry van, high cube, refrigerated, open top, tank and flat rack units. Containers also carry a safety approval plate and often a continuous examination programme identifier.

The identifier is stencilled on the box and repeated across booking, bill of lading, terminal and customs systems, which is exactly what makes it a reliable join key. Seal numbers are separate and change at every lawful opening. Containers are leased and swapped constantly between operators, so the owner prefix identifies the leasing company or line rather than the cargo owner. Refrigerated units add temperature and power logs with independent analytic value.

Why it matters

The container is the physical unit that customs, terminals and carriers all reference, so it links paperwork to a movable object with a location history. It accumulates events: gate-in, load, discharge, transshipment, gate-out, inspection and demurrage, each with a date and a place testable against vessel tracks and shipping documents. When paperwork is falsified, the container's independently generated event history is frequently the part nobody remembered to adjust.

What analysts actually look for

These are the concrete, observable signals that carry weight in this area of work:

Check digit validation immediately separates genuine identifiers from typographical errors and fabricated numbers on documents.
The owner prefix identifies the leasing company or line, indicating the commercial relationship behind the booking.
The size and type code must match the declared cargo; a tank code against dry goods is an obvious inconsistency.
Refrigerated temperature settings and power logs corroborate or contradict declared perishable or pharmaceutical cargo.
Gate and terminal event timestamps establish physical presence of the box at specific facilities on specific dates.
Seal number changes between origin and destination documents indicate opening, inspection or tampering en route.
The same container recurring across shipments by nominally unrelated shippers links those parties operationally.
Declared verified gross mass measured against the type's tare weight exposes implausible or impossible load figures.

Where the data comes from

Authoritative and openly available collection points. Always confirm licensing and terms before operational or commercial use:

BIC container code register and BoxTech — Registered owner prefixes and technical characteristics for individual container units.
ISO 6346 standard — Identifier structure, check digit algorithm and size and type code definitions.
Carrier track and trace portals — Event history on that line: load, discharge, transshipment and gate movements with timestamps.
Terminal operating system portals — Yard status, availability, customs holds and release information at specific ports.
BIC ACEP register — Approved continuous examination programme records tied to the registered container owner.
MarineTraffic and VesselFinder — Vessel schedules and positions used to test whether the claimed voyage actually occurred.
Terminal49 or project44 (commercial) — Aggregated multi-carrier container event feeds delivered through a single interface.
Customs hold and inspection notices — Published inspection, detention and release information where the authority makes it available.

A working method

A repeatable sequence beats ad-hoc searching. This is a practical starting workflow:

Validate the number — Compute the ISO 6346 check digit and query any identifier that fails before spending further analytic effort on it.
Identify the owner — Resolve the prefix to a leasing company or carrier and record the size and type code characteristics of the unit.
Pull event history — Query carrier tracking for gate, load, discharge and transshipment events with their timestamps and locations.
Cross-check the voyage — Compare those events against the named vessel's track to confirm the box was where the paperwork claims.
Test cargo consistency — Compare container type, verified gross mass and declared goods, flagging mismatches for physical inspection referral.
Link the documents — Join the container to bills of lading, seals and customs declarations to enumerate every party associated with it.
Look for reuse — Search your holdings for the same container across other shipments and shippers to expose operational links.

How this connects across the intelligence taxonomy

Intelligence work does not respect neat boundaries. The mission domain you are working, the disciplines you practise, and the data points you pivot on are one connected system. These are the direct relationships for this entry — every link is also a tag, so you can follow any thread across the whole library.

Collected by these disciplines

Logistics Intelligence — Cargo, Freight, and Physical Movement
Maritime Intelligence — Vessels, Shipping, and the Maritime Domain
Geospatial Intelligence — Intelligence Derived from Place
Criminal Intelligence — Intelligence Supporting Criminal Investigation
Sanctions Intelligence — Screening, Designations, and Evasion Detection
Technical Intelligence — Technology Capability, Design, and Exploitation

Investigated in these domains

Pivots to these data points

HS Commodity Code — The Harmonized System code classifying a traded good — the key to trade-flow analysis.
Shipment / Bill of Lading — A consignment record linking shipper, consignee, goods, and route.

Inside the platform: where Shipping Container lives

The Quantus platform is 204 pages behind a 147-item sidebar organised into six working groups: Command (24 items), Dashboards (15), Threat Theaters (14), Intelligence Domains (15), Investigate (34), and Administration (45). This entry is not a page in isolation — it is a thread running through several of them.

The modules that matter most here:

datapoint.php?dp=dp_container — Data point hub
domain.php?d=drugs — Drug Trafficking dashboard
domain.php?d=weapons — Weapons Trafficking dashboard
domain.php?d=supply — Supply Chain Security dashboard
domain.php?d=mar — Maritime Security dashboard
search.php — Advanced search, filter and pivot
correlate.php — Correlation graph
cases.php — Case management

Each dashboard is local-first: it renders from the platform’s own database rather than depending on a live third-party call, so it still works when an upstream API is unreachable or rate-limited. Heavy aggregates are cached with a hard query time cap and degrade to the last good value instead of hanging the page.

Automation, playbooks and AI skills

Analysis that only happens when someone remembers to run it is not a capability. The platform ships a 30-step automation pipeline (cron.php) that collects, ingests, resolves, enriches, correlates and scores on a schedule — 25 seeders, 11 resolvers and 7 enrichment runners, all idempotent and cursor-based so a run can be interrupted and resumed without duplicating or losing work.

AI skills that apply

The 16 one-click operations in ai-skills.php are deterministic jobs, not free-text generation. The ones that matter here:

Enrichment Runner
Enrichment → Local
Correlate Infrastructure
Summarise (Copilot)
Generate Report

Alerting closes the loop: rules in alerts.php fire on new indicators matching a saved query, so a first sighting in this area raises a notification rather than waiting to be noticed at the next review.

Feeds, data sources and the API

The collection layer runs a feed registry of free, machine-readable sources — bulk blocklists and trackers (Maltrail, IPsum, FireHOL, the full abuse.ch corpora, phishing databases, Emerging Threats, Spamhaus, DigitalSide, ThreatView), authoritative government feeds (CISA KEV, OFAC, UN and EU sanctions lists), and reference datasets (RIR allocations, ip-to-ASN and geolocation tables, MITRE ATT&CK, EPSS). collect.php pulls them server-side on a schedule; feeds.php and source-catalog.php show what is registered, what it covers and when it last ran.

Anything the platform holds is reachable programmatically. The REST API in api.php exposes 11 endpoints — status, stats, search, lookup, recent, export, bulk_check, top_threats, by_category, categories, check — and export.php streams 18 formats in bounded chunks, so a million-row export neither exhausts memory nor times out:

STIX 2.1, MISP, OpenIOC 1.1, CEF (ArcSight), LEEF 2.0 (QRadar), Zeek/Bro intel, Snort/Suricata rules, Palo Alto EDL, BIND RPZ, hosts blackhole, iptables, CSV, JSON, NDJSON/JSONL, XML.

That covers the CTI standards (STIX 2.1, MISP, OpenIOC), SIEM ingestion (CEF, LEEF, Zeek), detection engines (Snort/Suricata), and direct enforcement (Palo Alto EDL, BIND RPZ, hosts, iptables) — so intelligence developed here can be actioned in the tools you already run, without a manual reformatting step. A TAXII 2.1 server and a MISP/RSS feed are also served for pull-based sharing.

Use cases

Three ways this entry earns its keep in day-to-day work:

Triage under time pressure. An artifact or report lands and you need a defensible read in minutes, not days. Validate the number is the first move; the platform pre-computes the enrichment so the analyst spends the time on judgement rather than lookups.
Building the picture. A single indicator is rarely the story. Pull event history turns one artifact into a network — shared infrastructure, repeated selectors, the same operator behind different names — via the correlation graph and the cross-entity link engine.
Producing something actionable. Analysis that ends in a document nobody can use is wasted. Look for reuse feeds the case file, the detection rule, the block list or the referral — with sourcing attached so the recipient can verify it.

Case management (cases.php), watchlists, saved searches and scheduled reports mean the work persists between sessions and survives an analyst leaving the team.

How each sector uses Shipping Container

The same entry is worked very differently depending on who you are, what authority you hold, and what you are ultimately producing. A military analyst is supporting a commander’s decision; a journalist is meeting a publication standard; an NGO caseworker is protecting a person. The underlying artifacts are shared — the constraints, outputs and thresholds are not.

🎖 Military and defence

Container identifiers matter to defence logistics assurance and to counter-proliferation. In a joint operations area, tracking the boxes carrying sustainment stock through commercial terminals identifies where a supply chain is exposed to interference or diversion, and validating identifiers on inbound cargo prevents contaminated or substituted consignments entering a base. For interdiction, a container number ties a declared cargo to a physical object aboard a named vessel, which supports boarding and search planning under a proper legal authority. The constraint is that the box evidences movement and declaration, never contents, and a hold or search requires the customs or coalition authority that owns that power.

🕵 National intelligence

The container is the physical unit that links documentation to a movable object with an independently generated event history, which makes it valuable for corroborating or refuting a paper narrative. Where a bill of lading has been switched or a route disguised, terminal and carrier events frequently retain the original sequence because nobody thought to adjust them. Analysts use container identifiers to fuse shipment records, vessel movements and terminal activity into a single verifiable movement. Collection is time-sensitive: carrier tracking data expires within weeks, so a requirement touching a live consignment must be actioned immediately rather than queued behind slower work.

👮 Law enforcement

For customs and law enforcement the container is the object of the search and the anchor of the evidential chain. The identifier appears on the booking, the bill of lading, the terminal record and the customs declaration, and consistency across those systems is a checkable fact. Seal numbers and their integrity are central to establishing whether the box was opened between origin and inspection, and seal records should be captured before any lawful opening. Carrier and terminal records normally require a production order or a customs power. Physical examination, weighing and scanning belong to the authority, and the resulting continuity record is what makes the seizure survive challenge.

🔍 Private investigation and corporate security

Corporate investigators use container data for cargo loss and insurance claims, counterfeit source tracing, demurrage and detention disputes, and verification that a supplier actually shipped what was invoiced. The lawful sources are the client's own booking and tracking records, carrier portals accessed under their terms, and public shipping data. What a private actor may not do is access a terminal operating system without authorisation, break or inspect a seal, obtain customs hold information by pretext, or scrape carrier portals in breach of terms. Where an examination is needed, the route is the client's contractual rights, a surveyor or a referral to customs.

📰 Journalism and OSINT media

Container identifiers let reporters verify that a specific consignment existed and moved, which is much stronger than relying on a document alone. The verification standard is to validate the check digit, resolve the owner prefix, and match terminal and carrier events against the vessel's actual voyage. Do not publish live container numbers where the shipper or crew could be identified and endangered, and be careful with descriptions of contents, since a container record evidences a declaration only. Where a story alleges smuggling, seek comment from the carrier, the terminal and the named traders, and preserve tracking screenshots because carrier portals overwrite history quickly.

🌍 NGO, humanitarian and human rights

For organisations investigating waste dumping, illegal timber, wildlife trafficking or goods made with forced labour, the container is what connects an origin facility to a destination market with dates. It supports referrals to customs authorities and to port state enforcement. Do no harm applies at origin: naming a specific consignment can identify the workers, inspectors or port staff who provided information, so consider whether the shipment can be described at a coarser level. Preserve records to accountability standards with retrieval timestamps, and route enforcement requests to the authority holding the power to inspect rather than acting on the quayside.

🎓 University and research

Researchers use container movement data for logistics network analysis, port efficiency studies and illicit trade detection modelling. The methodological issues are coverage and decay: carrier event feeds are proprietary, expire quickly and differ in completeness between lines and terminals, so any dataset is a biased sample of movements. Document the collection window, the carriers covered and the event types available. Terms of service for carrier portals commonly prohibit automated collection, so obtain data through a licensed aggregator or a research agreement rather than scraping. Personal data is limited but driver and agent names do appear, and should be excluded before sharing.

Playbook: working Shipping Container end to end

A repeatable sequence, from the moment the requirement lands to the moment a product is delivered and the case is closed out. Each phase states what you are trying to establish, not merely what to click — the point is a defensible chain of reasoning, not a checklist.

Phase 1 — Validate the identifier

Compute the ISO 6346 check digit before spending any further effort. A failed check means transcription error or fabrication, both of which are findings. Record the validation result rather than silently correcting a character, since the wrong version as written may match another document. A good output states valid or invalid with the computed digit. Stop when you know whether the number could exist at all.

Phase 2 — Resolve the owner and type

Look up the three-letter prefix in the container code register to identify the registered owner, typically a leasing company or a shipping line, and decode the size and type code for length, height and construction. A good output names the prefix holder and describes the unit type in plain terms. Stop when you know what kind of box this is and who registered the prefix, while remembering that neither identifies the cargo owner.

Phase 3 — Collect events immediately

Query carrier track and trace and any terminal portal for gate-in, load, discharge, transshipment, gate-out, hold and release events with timestamps and locations, and capture the results with retrieval time. This data expires within weeks of delivery, so collection precedes analysis. A good output is a timestamped event log with screenshots or exports preserved. Stop when the available history is captured, not when you have understood it.

Phase 4 — Rebuild the movement chain

Order the events into a physical narrative: where the box was stuffed, how it reached the port, which vessel carried it, where it transshipped and where it was released. Note gaps and unattributed periods explicitly. A good output is a chronology with locations and gaps marked. Stop when the sequence is either continuous or its discontinuities are documented. Record the source system for each event, because carrier and terminal feeds disagree more often than analysts expect.

Phase 5 — Cross-check against the vessel

Compare load and discharge events against the named vessel's actual position history for those dates. A box loaded at a port the vessel never called at, or a transshipment at a hub the vessel did not visit, contradicts the paperwork directly. A good output pairs each maritime event with the vessel's tracked position. Stop when the physical voyage and the documented voyage are reconciled or the conflict is stated.

Phase 6 — Test cargo consistency

Compare container type against declared goods, verified gross mass against the type's tare and payload, and package count against the internal volume. A refrigerated unit against dry goods, or a declared mass exceeding the unit's rating, is an inconsistency that justifies referral. A good output is a consistency table with each check and its result. Stop when every physically checkable declaration has been tested.

Phase 7 — Examine the seal record

Compare seal numbers recorded at stuffing, on the bill of lading, at transshipment and at destination. A change indicates lawful inspection, transhipment repacking or tampering, and the distinction matters. Remember that transcription errors are common, so a mismatch is a question rather than a conclusion. A good output is a seal history with each source document referenced. Stop when each change is either explained or flagged.

Phase 8 — Use reefer data where available

For refrigerated units, temperature setpoints, power connection logs and alarm records corroborate or contradict declared perishable or pharmaceutical cargo. A unit declared for frozen goods but never powered on the voyage is telling you something. A good output is a temperature and power history aligned to the movement chain. Stop when the reefer record is either consistent with the declaration or clearly not.

Phase 9 — Link every document

Join the container to bookings, master and house bills, customs declarations, delivery orders and equipment interchange receipts, enumerating every party named across them. This is where the box becomes a network node rather than a logistics fact. A good output is a party list with the document each name came from. Stop when no document referencing the container remains unread.

Phase 10 — Search for reuse

Look for the same container across other shipments in your holdings, particularly by nominally unrelated shippers. Boxes cycle constantly so most reuse is meaningless, but repeated pairing with the same trader, route or forwarder is operationally significant. A good output distinguishes routine circulation from a repeated pattern. Stop when the reuse is characterised rather than merely counted. Filter out routine circulation by volume before reporting any link, or the graph will fill with meaningless edges.

Phase 11 — Refer for physical action

Where the analysis supports it, package the inconsistencies for the authority with the power to inspect: customs, port state control or law enforcement. Include the validated identifier, the event chain, the document discrepancies and the vessel comparison. A good output is a referral that can be acted on without reconstruction. Stop when the referral is submitted and acknowledged. State plainly what you assess and what you have documented, so the recipient can weigh the referral properly.

Phase 12 — Preserve with retrieval context

Archive tracking outputs, portal screenshots and exports with retrieval timestamps and the access method used, because carrier systems overwrite history and what you saw will not be reproducible. Record the terms under which the data was obtained. A good output is an evidential package with provenance for every event. Stop when the archive would stand on its own if the portal went dark tomorrow.

The platform ships this as a step-checked workflow in playbooks.php, so progress is recorded against a case rather than held in someone’s head.

Source register: what to collect from, and how

Sources are listed with their access model so you can plan around cost and licensing before you build a dependency on them. Open means no account required; registration means a free account or API key; licensed means paid or institutional access. Always confirm current terms — licensing changes, and a source that was free for research may not be free for commercial or evidential use.

Source	Access	What it gives you	How it is used here
BIC container code register	Open	The official register of three-letter owner prefixes allocated under ISO 6346, naming the registered owner and its country.	Resolves the prefix on any container number to the registered owner, usually a leasing company or shipping line.
BIC BoxTech technical database	Registration	Technical characteristics of individual container units including type, tare, payload, dimensions and construction details.	Provides the unit-level specification needed to test declared mass and cargo type against physical capability.
ISO 6346 standard	Licensed	The international standard defining container identification structure, the check digit algorithm and size and type code definitions.	The authority for validating an identifier and for decoding the four-character size and type code correctly.
Carrier track and trace portals	Registration	Line-operated systems reporting gate, load, discharge, transshipment and release events for containers on their services.	Primary source of the independently generated event history that a falsified document set rarely accounts for.
Terminal operating system portals	Registration	Port and terminal systems showing yard status, availability, customs holds, examination status and release information.	Confirms physical presence in a yard and reveals holds or examinations not visible in carrier data.
BIC ACEP register	Open	Approved continuous examination programme records tied to container owners, evidencing the safety inspection regime applied.	Confirms that a registered owner maintains an approved examination programme, and links plate markings to the owner.
MarineTraffic and VesselFinder	Registration	Vessel positions, schedules and port call histories derived from terrestrial and satellite automatic identification system reception.	Tests whether the vessel carrying the box actually called where and when the container events claim.
Terminal49	Licensed	Commercial aggregation of container tracking events across many carriers and terminals through a single interface and API.	Collects multi-carrier event history without maintaining credentials for every line portal, useful under time pressure.
project44	Licensed	Commercial multimodal visibility platform aggregating ocean, rail and road milestone data for shipments and equipment.	Extends the movement chain inland, where container events beyond the port are otherwise very difficult to obtain.
IMO GISIS and Equasis	Registration	Official and consolidated vessel identity, ownership, management and inspection records for the carrying ship.	Identifies who actually controls the vessel on which the container moved, which the carrier brand may obscure.
Customs hold and examination notices	Open	Published detention, examination and release information issued by customs authorities where public disclosure is practised.	Confirms official intervention on a consignment, which is a dated fact rather than an inference from missing events.
SOLAS verified gross mass requirements	Open	International requirement that the shipper declares a verified gross mass for every packed container before loading.	Establishes that a declared mass exists for comparison against the unit tare and the plausible payload for the goods.

Prefer sources that publish a methodology and a revision history. A dataset that changes silently is a liability in any product that has to survive challenge.

Tooling

Tools commonly used against Shipping Container. None of these replace judgement, and each carries its own failure modes — know what a tool infers versus what it observes.

ISO 6346 check digit calculators — Validate identifiers in bulk against the published algorithm; a valid digit confirms structure only, never that the unit exists or is in service.
Carrier API clients — Retrieve event history programmatically where the line offers an interface; coverage and event granularity differ sharply between carriers.
Terminal49 or project44 APIs — Normalise multi-carrier events into one schema; normalisation can smooth away carrier-specific detail that mattered to the analysis.
Vessel tracking platforms — Cross-check maritime events against actual ship movement; gaps in reception at sea are routine and must not be read as evasion.
Web capture with timestamping — Preserves portal output before it expires, with retrieval metadata; automated capture may breach portal terms, so access method must be documented.
pandas or spreadsheet reconciliation — Aligns events, documents and seal records into a single timeline; date and time zone handling is the usual source of a false discrepancy.
Graph tooling — Links containers, shipments, parties and vessels into a navigable network; container reuse creates dense but meaningless edges unless filtered by pattern.

AI skills and automation in detail

These are deterministic jobs with defined inputs and outputs, not open-ended prompting. Each is idempotent and cursor-based: interrupt one and it resumes where it stopped rather than duplicating work or losing progress.

Enrichment Runner — Walks the indicator set through a chosen provider in time-boxed, cursor-based batches that resume rather than restart.
Enrichment → Local — Materialises enrichment into the local store so dashboards render from your own database instead of a live third-party call.
Correlate Infrastructure — Builds the cross-entity link graph: shared hosting, reused certificates, overlapping registrants, repeated selectors.
Summarise (Copilot) — Produces a narrative summary beside the underlying records. It explains; it never creates indicators or assigns attribution.
Generate Report — Assembles a sourced product from the current case or query, with provenance attached to each element.

A note on the boundary: the only skill that involves a language model is Summarise (Copilot), and it writes prose about records that already exist. Nothing else on this list involves generation of any kind. No indicator, relationship or attribution in the platform originates from a model. See the full skill list.

Tradecraft notes

The distinctions that separate a competent analyst from a fast one:

Collect the event history before you analyse anything. Carrier portals purge within weeks of delivery, so an elegant analysis of a consignment whose tracking has expired is worth less than a crude screenshot taken in time.
The owner prefix is a leasing relationship, not a cargo relationship. Reading the prefix as an indicator of who shipped the goods is one of the most common beginner errors in maritime analysis.
Events are generated by different systems than documents, which is exactly why they are useful. When paperwork has been switched, the terminal and carrier records usually retain the original sequence because nobody thought to adjust them.
A seal mismatch is a question, not a conclusion. Numbers are transcribed by hand at multiple points, transhipment can involve lawful reseal, and customs opening generates a new seal. Establish the reason before implying tampering.
Verified gross mass against unit tare and payload is a cheap, powerful physical check. A declared mass that the box could not carry, or that is implausible for the described goods, justifies referral without any access to the cargo.
Transshipment gaps usually reflect incomplete third-party terminal reporting rather than concealment. Establish which terminals in the chain report to your source before treating a silent period as significant.

Measuring whether it is working

Capability claims should be falsifiable. These are the measures that show whether work on Shipping Container is producing anything, and they are worth baselining before you change process or tooling.

Proportion of container identifiers validated against the check digit on ingest, with failures investigated rather than silently corrected to a plausible value.
Median time from identifying a container of interest to capturing its complete available event history.
Rate at which document-versus-event discrepancies referred for physical inspection resulted in a customs or enforcement finding.
Share of maritime container events cross-checked against independent vessel position data rather than accepted from the carrier feed alone.
Proportion of tracking evidence preserved with retrieval timestamps and a recorded access method before the carrier portal purged the history.
Number of operational links between traders established through container reuse patterns rather than through named parties.

Beware of measuring volume alone. Indicator counts and report counts rise easily and say little; time-to-attribution, proportion of findings that survive review, and how often a product changed a decision say a great deal.

Common pitfalls

Containers are leased and cycled constantly, so the owner prefix says nothing about who booked or filled the box.
Carrier tracking data expires quickly, often within weeks of delivery, so it must be collected while the record is live.
Documented seal numbers are frequently transcribed wrongly, so a mismatch may be clerical rather than evidence of tampering.
Numbers can be reissued after a container is scrapped, creating spurious matches against historical shipment records.
Transshipment gaps in event feeds look like disappearance but usually reflect incomplete third-party terminal reporting.
Nothing in the container record evidences contents; it evidences a declaration and a sequence of physical movements.

Legal and ethical considerations

Container event data is usually obtained under carrier terms of service that restrict automated collection and redistribution, so respect them and document your access method. Records may name individual drivers, agents and contacts, which is personal data requiring minimisation. Physical inspection, opening or seal examination is a matter for customs and law enforcement, not private analysts. Preserve tracking outputs with retrieval timestamps, since carrier portals overwrite history and what you saw may not be reproducible later.

Data integrity: no fabrication, no drift, no hallucination

Intelligence that cannot be traced back to a source is not intelligence, it is assertion. Everything in this entry — and everything in the platform behind it — is built on a small number of non-negotiable rules.

Provenance on every record

Every indicator carries the source that supplied it, a first-seen and last-seen timestamp, and a sighting count. Where several feeds report the same artifact, each contribution is recorded separately rather than collapsed, so you can see whether a finding rests on one source or twelve. Source attribution travels with the data into every export, so a recipient can audit a claim without asking you for the working.

Nothing is invented to fill a gap

If the platform has no data for Shipping Container, it says so. Empty is displayed as empty — never padded with plausible-looking placeholder values, sample records or illustrative examples that a reader might mistake for observations. A dashboard with no rows is a true statement about collection coverage, and it is treated as a gap to close, not a blemish to hide.

Scoring is deterministic and reproducible

Threat scores, reputation grades and risk tiers are computed from stated inputs with fixed weights, not estimated. The same inputs always produce the same output, and the formula is visible rather than a black box. Aggregates are cached with an explicit time-to-live so a figure on screen is never silently stale — and when a heavy query exceeds its time budget the platform serves the last known-good value and labels it, rather than inventing a fresh number or hanging.

Where AI is used, and where it is not

Language models summarise and explain. They do not create indicators, assign attribution or manufacture relationships. No IP address, wallet, hash or identity in the platform originates from a model — every one is ingested from a named feed, resolved from a reference dataset, or entered by an analyst with a source recorded. Copilot output is presented as narrative alongside the underlying records, never in place of them, so a reader can always check the summary against the evidence.

Guarding against drift

Enrichment is additive and timestamped rather than overwriting. Reference data — sanctions lists, allocations, taxonomies — is re-synchronised from the authority on a schedule instead of being edited in place, so local copies cannot quietly diverge from the source of truth. Attribution is recorded with a confidence level and the reporting it rests on, and inferred relationships are labelled as inferred. When a source retracts or corrects, the correction propagates rather than leaving a stale assertion behind.

What this means for you

You can put a finding from this platform in front of a regulator, a court, a board or a partner agency and show where each element came from. That is the standard the tooling is built to — because in this work, being confidently wrong is more damaging than being usefully uncertain.

By the numbers

The taxonomy this entry belongs to is not a marketing list — it is the actual structure of the platform: 52 mission domains, 52 intelligence disciplines and 65 data points, each with a live dashboard behind it. Supporting that: 18 indicator types, 14 playbooks, 16 AI skills, 18 export formats and a 30-step automated pipeline.

This particular entry connects directly to 6 intelligence disciplines, 4 mission domains, 2 closely related entries — every one of them a tag you can follow, and a dashboard you can open.

Questions analysts actually ask

The check digit fails. Is the number fake?

Possibly, but transcription error is far more likely. Characters are commonly misread between zero and O, one and I, five and S, and eight and B, particularly from photographs of a weathered box or from a scanned document. Try the plausible single-character substitutions and see whether any yields a valid identifier that also matches a real prefix and a plausible unit. If several do, you cannot resolve it from the number alone and need another document. If none do, and the prefix is not in the register either, you are probably looking at a fabricated number, which is itself a significant finding about the document.

What does the owner prefix actually tell me?

It tells you which company registered the prefix with the international container bureau, which is almost always a leasing company or a shipping line. It tells you nothing about who booked the box, who filled it, or who owns the cargo, because containers are leased, sub-leased, swapped and interchanged constantly across operators. Its analytic value is contextual: it indicates the commercial relationship behind the booking, and a shipper consistently using boxes from one lessor or line has a relationship worth noting. Treating the prefix as an indicator of cargo ownership will produce confidently wrong attribution.

Carrier tracking shows a gap of two weeks. Is the box missing?

Almost certainly not. Event feeds are assembled from carrier and terminal systems that report unevenly, and transshipment hubs in particular often do not push events to the carrier's public portal. Rail and inland moves frequently generate no public events at all. Before treating a gap as significant, establish which parties in the chain report to your source, check whether the vessel schedule accounts for the period, and look for the box reappearing at the expected downstream point. Genuine anomalies look different: a reappearance at an unexpected port, or events inconsistent with the vessel's track.

Can container data prove what was in the box?

No, and this is the boundary that matters. Container records evidence a declaration and a sequence of physical movements. The declared goods, weight and commodity code are assertions made by the shipper, and the verified gross mass is a weight, not a description. What container data can do is establish that the physical object existed, moved on specific dates through specific places, and was or was not aboard the vessel the paperwork names. Only inspection, scanning or a controlled delivery establishes contents, and those are powers held by customs and law enforcement rather than by analysts.

How should I handle scraping carrier portals?

Carefully, and usually not. Most carrier and terminal portals prohibit automated collection in their terms of service, and breaching them can create contractual and in some jurisdictions computer-misuse exposure, as well as damaging your organisation's access. The compliant alternatives are commercial aggregators licensed to redistribute event data, direct carrier APIs where offered, and for law enforcement a production order. If you do collect manually, record the access method and retrieval time, keep volumes reasonable, and do not use credentials belonging to someone else. Document the basis for access as part of the evidential record.

How long do container numbers stay unique?

Long enough to be useful and not long enough to assume. Numbers are allocated within an owner prefix and are not reissued while a unit is in service, but after a container is scrapped a number can eventually reappear, and prefixes themselves can change hands. For contemporary analysis uniqueness holds. For historical work spanning decades, a match between an old record and a current unit should be corroborated with the size and type code, the owner prefix status at the time, and the route plausibility before being treated as the same box.

Standards, frameworks and further reading

Work that references a recognised framework is easier to defend, easier to hand over, and easier for a partner to consume:

ISO 6346 defines container identification, the check digit algorithm and the size and type coding used on every box.
ISO 1496 specifies container construction, ratings and testing, which underpins tare and payload figures used in plausibility checks.
The International Convention for Safe Containers governs the safety approval plate and the approved continuous examination programme.
SOLAS Chapter VI requires the shipper to declare a verified gross mass before a packed container is loaded.
The WCO SAFE Framework of Standards sets advance cargo information and risk-assessment expectations that generate container-level records.
ISO 17712 specifies mechanical seals for freight containers and the classification of high security seals.
The Container Security Initiative and equivalent programmes define pre-arrival screening arrangements between customs administrations.
The International Ship and Port Facility Security Code governs terminal access control and security arrangements around container handling.

References

Primary sources and authoritative references for this entry. Publishers revise and retire material, so treat the retrieval date as part of the citation and re-check before relying on any of it in a formal product.

BIC container code register and BoxTech — Bureau International des Containers. Official owner prefix register and container technical database.
ISO 6346 freight container coding and marking — International Organization for Standardization. The standard defining container identifiers and their validation.
SOLAS verified gross mass requirements — International Maritime Organization. The obligation generating a declared mass for every packed container.
Equasis vessel information system — Equasis, hosted by the European Maritime Safety Agency. Ownership and inspection data for the carrying vessel.
Cargo security and examination programmes — United States Customs and Border Protection. Published information on holds, examinations and container screening.
SAFE Framework of Standards — World Customs Organization. Advance cargo information and risk assessment standards for container traffic.
MarineTraffic vessel tracking — MarineTraffic. Position and port call data used to cross-check container maritime events.
Global Integrated Shipping Information System — International Maritime Organization. Official ship particulars for vessels named in container movements.

Link integrity: every reference above was verified with a live request when this page was generated. Where a publisher had moved or withdrawn a document, the link was repointed at a preserved copy in the Internet Archive and marked as archived. Anything with no reachable copy anywhere had its link removed rather than left to rot — the source is still credited, it simply cannot be linked.

Put it into practice

The Quantus Intel threat intelligence platform operationalises this entry: validates box identifiers and stitches carrier events to shipments, vessels and consignees. Explore the platform, or browse the rest of the library by following any tag above.