Russian oil smuggling network exposed by email server leak: report

A technical error uncovered a large network of companies allegedly involved in moving Russian oil while avoiding sanctions, according to a Financial Times investigation.

The discovery centres on a private email server, mx.phoenixtrading.ltd, used by hundreds of domains linked to oil trading entities.

Investigators traced connections between domain registrations, customs filings, and shipping records, revealing how Russian oil continued flowing globally despite sanctions imposed after the Ukraine war.

The findings suggest coordinated operations behind companies that appeared unrelated, allowing sanctioned oil producers to sustain exports and revenue.

Companies moved Russian crude

The Financial Times identified 48 companies operating from different locations that appeared independent but shared email infrastructure and back office systems.

Public records showed that 442 domains linked to these entities used the same email server.

Customs filings connected to companies in the network showed oil exports exceeding $90 billion. The total may be higher because records are incomplete and investigators avoided double-counting.

Companies such as Dubai-based Foxton FZCO and Advan Alliance appeared in Russian and Indian customs records and were linked to matching web domains.

Foxton FZCO purchased $5.6 billion in Russian oil, while Advan Alliance sold $1.5 billion into India.

Many companies operated briefly, with an average lifespan of six months. This rapid turnover made it harder for sanctions authorities to identify and restrict their activities.

Sanctions reshaped exports

The network expanded after the US sanctioned Rosneft and Lukoil in October 2025. Previously unknown intermediaries replaced sanctioned exporters.

Redwood Global Supply, incorporated in Ras Al Khaimah in the UAE, became the largest exporter of Russian crude after sanctions. The UK sanctioned the company in December.

Domain records showed Redwood shared the same email server and contact details with other network entities. Traders familiar with the market believed Redwood was linked to Etibar Eyyub.

Shipping analysis showed more than 80% of Rosneft’s shipborne exports passed through the network in November 2024, the latest month with full Russian data.

Companies often routed shipments through third locations such as the UAE and labelled crude as an export blend to obscure origin.

Shipping patterns also showed links to Rosneft-connected tankers, including vessels previously managed by Gatik Ship Management.

Azeri traders linked

The network included traders connected to Coral Energy, founded by Azeri businessman Tahir Garayev, who was sanctioned by the UK.

Domain records included TahirQarayev.com, linked to Garayev, and EEOffice.com, linked to Azeri businessman Etibar Eyyub.

EU officials identified Eyyub as a close associate of Rosneft chief executive Igor Sechin.

The UK sanctioned him for controlling or directing companies involved in Russian oil exports and concealing the origin.

Sanctions listings also identified Bellatrix Energy and Nord Axis as part of Coral’s network.

Coral, now renamed 2Rivers under new ownership, said it is inactive and has no involvement in the network.

Many entities had no websites or contact information, making tracing difficult.

Of 442 domains identified, 19 were linked to Russian businesses, including energy and real estate firms run by Azeri nationals.

EU officials said the findings could support new sanctions.

EU sanctions envoy David O’Sullivan said enforcement efforts aim to disrupt circumvention and increase risks and costs.

Garayev denied involvement in any coordinated oil trading network or sanctions evasion. Eyyub could not be reached and previously described sanctions against him as baseless.

The investigation showed sanctioned exporters redirected oil through intermediaries, using short-lived entities, shared infrastructure, and shipping networks to sustain exports.