This time, we are diving into researching offshore organizations from bunch of leaks like Panama Papers, Bahamas Leaks or Paradise Papers.

In this episode I will present:

  • Structure of offshore organizations of Polish Steamship Company (POLSTEAM)
  • Methods to research offshore leaks
  • Network visualization of offshore companies with connections to Polsteam vessels and key players

In addition, I'm open sourcing my d3js visualization with parsing scripts. It means, you can create cool interactive d3js network without doing much front end. I strongly recommend to use it instead of Gephi. The network is presented at the end of the article.

This article is quite different than previous ones, I want to give you interactive journey over the research and structure of Polsteam. Some visualizations might not work properly on mobile devices, I'm still working on it.

Artykuł po polsku dostępny jest tutaj

Last episode about porn industry organization Mindgeek is available below for free.

Offensive OSINT s01e05 - OSINT & Corporate espionage. Tentacles of Mindgeek part 1.
In this episode we will take a look on corporate structure of Mindgeek - leadingcompany in content delivery, SEO, advertisement, hosting and general techinnovation. They operate worldwide and websites owned by them generate hundredsof millions visits per day and more bandwidth than Twitter, Amazo…

I want to know my fanbase better so I started a subscription. Drop your email at the bottom of the website or sign up here

You will get access to all articles, early access to the newest ones and more with the time.


Anti-money laundering is another field where we can use previously learnt OSINT skills like research into organizations, persons or activities. Money laundering is more common that you might think and leaks from Monsack & Fonseca or other tax management companies just confirm this. Thanks to the hackers that leaked all the material to the Consortium of Journalists, everyone can get insight how rich and powerful individuals evade paying taxes. Basically, it's about creating a companies in tax-heavens countries and tunnel money through these organizations to evade government restrictions and keep more money for private businesses. You can think of almost every position in government, from military officers to prime minsters or presidents. More stories can be found here.

ICIJ Offshore Leaks Database
Find out who’s behind almost 500,000 offshore companies, foundations and trusts from the Panama Papers, the Offshore Leaks and the Bahamas Leaks investigations, and explore the offshore financial data from some politicians featured in the Paradise Papers investigation.

Football is also involved in different tax evasions techniques, you can read about it below

Football Leaks | EIC
The data includes 18.6 million documents, including original contractswith secret subsidiary agreements, emails, Word documents, Excelspreadsheets and photos. The data set extends into the year 2016.EIC partners will publish their findings in the comingweeks, allowing for an unprecedented look i…

Flag of convenience

Maybe, the example I've chosen is not the best to show AML techniques but good one to present distribution of offshore companies. It's quite common that actual owners of the ship register it in countries with looser taxes or work regulations. It allows to bypass regulations established by countries regarding work conditions, environment pollution, money or s In short words, it's just better for organizations but it's not the best solution for ship crew to work under jurisdiction of foreign country. However, you cannot find any polish vessels that operates under polish flag, many of Europen countries have this "issue" and run their steamship companies via offshore organizations located in Malta, Cyprus, Virgin Island, Bahamas etc.

Before we start, I want to say that everything included in this research, companies, names or addresses are legit and have been confirmed in "Offshore Leaks".

I dug through hundreds of documents to draw connections and also offered my help to transcribe these documents for Project X-Ray.

Polish Steamship Company

I'm not going to write about history of Polsteam, what you need to know is they own 59 vessels with 2,2 millions of load in total. All of the ships have been registered under country with "flag of convenience" in the 90' but last registration took place in 2004 for vessel Ziemia Gnieźnieńska. They are also state-owned.

In 2016, when Bahamas Leaks appeared, investigative journalists came across ownership document of POLSTEAM SHIPPING COMPANY LTD, where ZBIGNIEW BRZEZICKI (Deputy Minister of Maritime Affairs and Inland Navigation 2015-2017, Director of Polsteam 1998-2005) was a Director. According Pawel Szynaruk (Director of Polsteam in 2016) he saved company from financial troubles by registering vessels in flag of convencience countries.

First let's meet people that own the most offshore companies.

Polish Steamship Company

Key Players

Click on the image to display details.

I highlighted only 6 individuals with the most amount of appearances in registration papers as officer. Of course, there are more officers as well as different shareholders that are engaged in the business structure that we will meet later. The most interesting persona here is GABRIELE WESTERHAUSEN, I couldn't establish any common points with Polsteam and there is literally nothing significant about here online.

But lets do not forget about range of the businesses, they own many vessels and transport goods worldwide. Every vessel is managed by offshore companies and some of them connected to CYFADACO SHIPMANAGEMENT which director is Zofia Galka. We can track each ship, based on it's name, number or company and is perfect placeto start. I gathered photos for eight ships that have more than 18 t gross load. Statistics for every vessel are available in the network graph.

Click on the ship to display photo

Information about vessels was collected from Maritime Directory. Below you can find all vessels that belong to Polsteam (POLSKA ZEGLUGA MORSKA). It also shows which organization is under control over the ship makes it easier to connect them to Polsteam.

Maritime Directory – Polska Zegluga Morska P.P.–…

Photos and positions have been taken from Marine Traffic, it's mostly known from showing real live ships position around the world. Below you can find information about SUDETY vessel.

If we are talking about sources, first thing to visit during offshore research is of course ICIJ website where you can search database by name, jurisdiction or country. Not all documents have been transcribed and some of them contain spelling errors. I came across this situation with Jan Rutkiewicz (POLSTEAM USA). I did not find anything in ICIJ database under his name, however he is listed as Jan Rutkiewiez.

Rutkiewiez instead of Rutkiewicz

Second example is "ZEGLUGA POLSKA S.A." (shipping) is listed as "ZEGULGA POLSKA S.A.". Letter U and L are substituted.

To search for proper person, you need to search every possible mistake or look up by his name. To search for documents, I used Hunter from DDoS project.

The structure of Polsteam (PZM) is not a secret, it's public data and one of my starting point was website

Worldwide vessels and companies, shipowners and managers
Detailed vessel data and company directories with crosslinks and contact details, for everyone.

It already gives us around 70 companies owned by Polsteam (POLSKA ZEGLUGA MORSKA PP) and thanks to Offshore Leaks we can go deeper and find owners of the companies registered in tax haven countries. Having these names, we can lookup them in DDoS Hunter or offshore database to discover owners and draw new connections. It was quite time consuming work to check all the companies and new individuals appeared often which made research harder and more confusing - probably I still haven't discovered all the connections.

As you can see, network graph is quite big and messy on first look. To make it more readable I customized it to highlight hovered nodes and all connections associated. Also images size indicates how many connections the node has. Visualization allows to group as many records as  you like, this way graph will be even more clear thanks to images and colors for each group. Moreover, tooltips give flexibility to put information about the node, (it might be a Twitter bio for example) they are also accessible over nodes that describes relationship. I wrote this d3js vizualition by merging couple from into the one that will be suitable for task and flexible for other investigations. Having simple connections in csv file like this


script with translate it to new data format

    "nodes": [
            "name": "a",
            "group": 1,
            "id": 1,
            "photo": "",
            "size": 50,
            "info": ""
            "name": "b",
            "group": 2,
            "id": 2,
            "photo": "",
            "size": 50,
            "info": ""
            "name": "c",
            "group": 3,
            "id": 3,
            "photo": "",
            "size": 50,
            "info": ""
            "name": "d",
            "group": 4,
            "id": 4,
            "photo": "",
            "size": 50,
            "info": ""
    "links": [
            "source": 1,
            "target": 2,
            "value": 2
            "target": 3,
            "source": 4,
            "value": 2


then you can adjust viz to your needs by reading json and add photos based on group or put additional info about nodes. To fully customize your visualization, you need to play with d3.forceSimulation() options.

const simulation = d3.forceSimulation()
    // .force("forceX", d3.forceX().strength(.1).x(width * .5))
    // .force("forceY", d3.forceY().strength(.1).y(height * .5))
    // .force("collide",d3.forceCollide( function(d){ return d.r + 8 }).iterations(1) )
    // .force("y", d3.forceY(0))
    // .force("x", d3.forceX(0))
    .force('collision', d3.forceCollide().radius(55))
    // .force('center', d3.forceCenter(-50, 100))
    .force("link", d3.forceLink().id(function(d) { return;}).distance(500))
    // .force('charge', d3.forceManyBody(-100))
    .force('center', d3.forceCenter(width / 2, height / 2))
    .on('tick', ticked);

I recommend to adjust your data from the beginning i.e. scraping information and calculating values on the way.

That's just couple examples, full documentation is accessible below

Force-directed graph layout using velocity Verlet integration. - d3/d3-force

Script and visulization is on my github.

Scripts related to Contribute to woj-ciech/offensive-osint development by creating an account on GitHub.

But let's back to the main topic and analyze the network a little bit. The biggest nodes are people mentioned in Key Players and have the most companies under control. TOMASZ KAMINSKI has a lot of connections and example can be NERO FOUR SHIPPING LTD, where he is listed as a Director together with 4 other persons - SLAWOMIR JACEK BALAZY, ARTUR WITKOWSKI, PIOTR WASZCZENKO and DARIUSZ CZAJKOWSKI. This company, registered in Bahamas, is responsible for WADOWICE II vessel. Analyzing is easy as that when you prepared correct visualization.

I also specified Tax advisories firms that are being used by Polsteam.

Click on the menu on the left side to display information and network.

We can create smaller networks from the big one and present specific cases like these above.

They show associations with Law & Tax Advisors in Malta and Cyprus. LAKE ST. CLAIR LTD has been registered in Malta in '98 and was liquidated by IVAN FSADNI from Ivan Fsadni AID Compliance. I did not find any connections to actual vessels or shipping relations so it might be a good starting point for deeper research.

What's interesting to highlight here, is a connection between POLSTEAM and ORLEN (oil refiner and petrol retailer) established through VITORINE BAJADA from Dingli & Dingli Law Firm Malta.


For people that looks for offshore topic to investigate, I found ex vice president of Szczecin ELZBIETA MALANOWSKA listed as a director in company SAIL AFRICA INTERNATIONAL MALTA LIMITED. It's another steamship(?) like company.

Sail Africa International Malta Limited | ICIJ Offshore Leaks Database
Paradise Papers - Malta corporate registry Entity: Sail Africa International Malta Limited

CARMEL CHIRCOP is a shareholder of POLMICO LTD and Director and judical representative of CYFADACO (MALTA) LIMITED. He was murdered in October 2015 but new facts came out recently. Official investigation is still going on but new line opened by police is related to property dealings

Informed sources speaking to The Malta Independent have claimed that Dr Chircop, like so many others, had found ways to under-declare the value of property transactions in order to reduce the amount of tax payable.

In addition, Malta Today announced his relations to More Supermarkets and $750k interest-free loan.

Now, from information seen by MaltaToday, it transpires that Chircop had loaned a substantial sum to people connected to the More Supermarkets bust, where millions are said to have been lost after director and owner Ryan Schembri fled the island.
Murdered lawyer gave More Supermarket directors €750,000 interest-free loan
Carmel Chircop had loaned a substantial sum to people connected to the More Supermarkets bust, where millions are said to have been lost after director and owner Ryan Schembri fled the island

According ICIJ data he is connected to 106 entities, besides POLSTEAM related assets. It's another lead to check for properties owned by any director of tax heaven company.  The most popular way of spending money are real estates, expensive assets (yachts, cars), weapons (financing terrorism) or drugs.

If you:

  • know structure of Polsteam
  • know who is Gabrielle Westerhausen
  • want to go deeper with the research

contact me.

For the people reading this, I have been looking for a cyber security/OSINT/Intelligence job for some time. If you know someone who's hiring or can help, please do let me know.


Even if structure of Polsteam is already known, it was fascinating journey to discover owners of these offshore companies. Gathered this and similar data/charts can be used for corporate espionage, white collar investigations or law enforcement to track the smugglers or pirates.

Apart from Polsteam assets, we dive little bit into d3js visualizations and now it's piece of cake for you to make the same network relationship graph as I did.

Skok na PŻM
- Teraz rozumiem, dlaczego odwołany przez ministra dyrektor tak kurczowo trzymał się fotela - mówi jedna z urzędniczek. - Jak zwykle chodzi o kasę. Cały czas tłumaczył nam, że to SLD robi skok na firmę, tymczasem okazuje się, że zrobił sam.
MGMiŻŚ o Bahamas Leaks: decyzje Brzezickiego zażegnały problemy finansowe PŻM |
Ministerstwo w komunikacie przesłanym w odpowiedzi na pytanie PAP, dodało, że Brzezicki, obecnie wiceminister gospodarki morskiej, podejmo...
Tanie bandery, dlaczego polskie statki nie pływają pod polską banderą?
Chcę rozwinąć ten temat i spróbować odpowiedzieć na pytanie dlaczego polskie statki nie pływają pod polską banderą.Powodów przenoszenia statków pod tanią banderę jest wiele. Jak sama nazwa wskazuje chodzi o pieniądze.
Rafał Zahorski: Może kawy panie ministrze? [KOMENTARZ]
W całej gospodarce morskiej nie ma osoby, która nie chciałaby aby statki polskich armatorów pływały pod polską banderą. Tym bardziej nie znam żadnego armatora czy marynarza, który by nie chciał by statki naszych armatorów pływały pod biało-czerwoną - komentuje dla Onetu ekspert branży morskiej Rafał…