An email error exposed a large network of companies involved in Russian oil exports. Around 48 firms that appeared independent were found using the same private email server named “mx.phoenixtrading.ltd.”
Public records showed hundreds of web domains connected to this server. The shared infrastructure suggested coordinated back-office operations among the companies.
Journalists compared domain registrations with Russian and Indian customs filings. Many firms listed as buyers or sellers of oil matched website domains tied to the same email system.
Entities such as Foxton FZCO and Advan Alliance appeared in trade records. Their domains were linked to the shared server. This showed how oil shipments moved through multiple trading firms instead of direct transactions.
Sanctions and the Rise of New Export Channels
In October 2025, the United States imposed sanctions on major Russian exporters including Rosneft and Lukoil. The goal was to reduce revenue supporting Russia’s war efforts.
After sanctions, trading activity shifted to firms not directly targeted. Redwood Global Supply became the single largest exporter of Russian crude.
Redwood Global Supply is registered in Ras Al Khaimah, United Arab Emirates. The United Kingdom later sanctioned the company.
It is linked to the domain “redwoodgroup.ltd,” which uses the same shared email server. Its registration timing matched the domain creation. It also shared contact details with other firms in the network.
Companies such as Bellatrix Energy and Nord Axis were also connected through the server. These firms had previously appeared in sanctions listings related to Coral Energy.
Company Links, Individuals, and Sanctions
Coral Energy, later renamed 2Rivers, was founded in 2010 by Azeri businessman Tahir Garayev. His name is connected to a domain called “TahirQarayev.com.”
Garayev was sanctioned by the UK but denied involvement in illegal activity. He stated that he did not breach sanctions. The current owners of 2Rivers said the company is inactive and has no link to the network or the named individuals.
Another person linked to domains is Etibar Eyyub. His domain “EEOffice.com” appeared among the shared email registrations.
The European Union sanctioned Eyyub for allegedly helping hide the origin of Russian oil shipments. He rejected the claims and described the sanctions as baseless.
Eight entities on the domain list were already under sanctions from the EU, US, or UK.
Oil Shipments Worth $90 Billion and Shipping Patterns
Customs filings linked to the domain network show Russian oil exports worth more than $90 billion. The total could be higher because records are incomplete and analysis avoided double counting.
Sanctions reset propels BP, Chevron and Shell back into Venezuela’s vast oil reserves
Oil cargoes were often labeled under broad terms like “export blend” instead of listing specific oil grades. This reduced transparency about origin and pricing.
Shipments were sometimes routed through third locations such as the United Arab Emirates before reaching buyers in countries like India and China.
Out of 442 web domains identified, 19 were connected to Russian businesses including energy and real estate firms. Many were run by Azeri nationals.
Most companies in the network operated for about six months before being replaced. This short lifespan made tracking and enforcement more difficult.
Shipping data showed frequent use of vessels linked to Russia’s shadow fleet. Some tankers were previously managed by Gatik Ship Management, an Indian-registered company that briefly controlled dozens of ships.
Experts explained that changing ship names, managers, and trading companies is a common way to hide ownership and cargo details.
European Union officials said the findings could support further sanctions. They stated that enforcement efforts aim to make circumvention harder and more expensive.
The investigation revealed how shared digital systems and trade records exposed a complex structure behind large-scale Russian oil exports.