An IT misconfiguration has exposed an apparent network of oil traders that has helped move at least $90 billion of Russian crude and has become central to keeping export revenues flowing to the Kremlin, the Financial Times reported Friday. 

The newspaper identified 48 seemingly independent companies, operating from different physical addresses, that appear to work in concert to disguise the origin of Russian oil linked to state-controlled Rosneft. The network was discovered because the entities share a single private email server, making internal linkages visible through publicly registered web domains.

To map out the network, FT connected 442 web domains whose public registrations showed they all used the same email server, “mx.phoenixtrading.ltd,” suggesting shared back-office functions. The news outlet then matched domain names to entities appearing in Russian and Indian customs records for Russian oil shipments. 

Examples cited in the report include Foxton FZCO, a Dubai-based buyer listed in Russian export filings as purchasing $5.6 billion of oil, and Advan Alliance, linked in Indian filings to $1.5 billion of Russian oil sales into India.

Since the U.S. imposed sanctions on Rosneft and Lukoil in October, an otherwise little-known firm in the network, Redwood Global Supply, has become the single largest exporter of Russian crude, the FT said, citing shipping and market data. The 48 companies are linked to a group of Azeri businessmen with strong ties to Rosneft, according to the report. 

The network includes traders linked to Coral Energy, founded by Azeri businessman Tahir Garayev, who has been blacklisted by the UK. Two other domains identified by the FT matched Bellatrix Energy and Nord Axis, both of which are subject to EU sanctions. 

Latvia’s foreign minister Baiba Braže argued that the “ecosystem needs to be sanctioned” because the structure makes enforcement of the oil price cap “nearly impossible” by obscuring true transaction prices and helping to disguise sanctioned producers, according to the report. 

EU sanctions envoy David O’Sullivan told the newspaper that the bloc was seeing “increasingly complex patterns and new actors” trying to bypass measures, and that each sanctions package aims to make circumvention “harder, less predictable, less reliable and more expensive.” 

Read more at the Financial Times