Email Server Blunder Exposes $90 Billion Russian Oil Smuggling Network
An IT blunder has revealed a massive smuggling ring that has moved at least $90 billion worth of Russian oil, playing a central role in funding the Kremlin's war in Ukraine. The Financial Times investigation identified 48 seemingly independent companies operating from different physical addresses that appear to be working together to disguise the origin of Russian oil, particularly from Kremlin-controlled Rosneft.
Network Discovered Through Shared Email Server
The network was discovered because all these companies share a single private email server, mx.phoenixtrading.ltd. This shared back-office function exposed their interconnected operations. The FT identified 442 web domains whose public registrations show they use this server, linking them to entities involved in carrying Russian oil as per customs records from Russia and India.
For instance, Foxton FZCO, a Dubai-based entity listed as the buyer of $5.6 billion of oil in Russian export filings, matches the domain foxton-fzco.com. Similarly, Advan Alliance, an entity listed in Indian filings as having sold $1.5 billion of Russian oil into the country, can be linked to advanalliance.ltd. Filings associated with these domains show oil exports from Russia totaling more than $90 billion.
Sanctions Evasion and War Funding
Routing oil through third parties can mask blacklisted entities involved in trades and the prices paid. The incentive to hide the precise origins of Russian crude intensified in October 2025, when the U.S. placed Rosneft and Lukoil—Russia's two biggest exporters—under sanctions. Since then, an otherwise unknown company in the network, Redwood Global Supply, has become the single largest exporter of Russian crude. The companies are linked to a group of Azeri businessmen with strong ties to Rosneft.
Baiba Braže, foreign minister of Latvia, stated: "These smugglers make the enforcement of the oil price cap nearly impossible by making it hard to figure out the true price of transactions—and now they are helping to disguise sanctioned Russian producers. That's why all the ecosystem needs to be sanctioned to save lives of Ukrainians."
Potential for Fresh Sanctions
Three EU officials said the findings could be used as evidence to impose fresh sanctions. One official told the FT that entities in this network were already "well on our radar." David O'Sullivan, the EU sanctions envoy, commented: "We see increasingly complex patterns and new actors emerging that try to bypass our measures. What we try to do with every sanctions package is to make circumvention harder, less predictable, less reliable and more expensive."
The exposure of this smuggling ring highlights the challenges in enforcing international sanctions and the critical role of digital footprints in uncovering illicit activities. As the war in Ukraine continues, such networks remain a key focus for global policymakers aiming to curb Russia's war funding.
