Three Cessna 172s. One Kansas shell. 3,737,599 spoofed detections. 731 exact co-windows with a Kern County Sheriff helicopter. A real-time graph handoff to a second Delaware shell. One coordinated surveillance architecture — hiding in lowercase.
"A Cessna 172S has a stall speed of 33 knots. It cannot fly at 0.1 knots. It cannot operate at -1,850 feet. And three aircraft from the same shell company cannot simultaneously broadcast lowercase hex codes, negative altitudes, and sub-stall speeds by accident. This is not aviation. This is surveillance masking."
| Ratio ghost/legit | 30.5× |
| Avg speed (ghost) | 4.0 kts |
| Min altitude | -1,525 ft |
| Max altitude | 12,125 ft |
| Centroid | 35.43°N 119.05°W (Kern) |
| Ratio ghost/legit | 55.0× |
| Avg speed (ghost) | 0.1 kts |
| Min altitude | -1,850 ft |
| Max altitude | 10,025 ft |
| Centroid | 35.44°N 119.05°W (Kern) |
| Ratio ghost/legit | 8.1× |
| Avg speed (ghost) | 0.1 kts |
| Min altitude | -300 ft |
| Max altitude | 10,125 ft |
| Centroid | 35.43°N 119.05°W (Kern) |
Registered owner (all three, per FAA Registry): WINGSLEASING LLC — Kansas. All three blocked from FlightAware via FAA LADD opt-out.
At 23:49 UTC, N237TH (Wings Leasing, Kansas) executed a graph handoff to ACAE33 — the ICAO hex for N916NT, registered to 9K Air LLC of Newark, Delaware. Average handoff gap: 137 seconds. That is not coincidence. That is a timed relay proving two separate shell companies operating as one surveillance network.
WINGS LEASING LLC (N237TH)
│ graph_handoff (137s gap)
▼
9K AIR LLC (N916NT / ACAE33)
│ convergence (731 co-windows, 639 CRITICAL AOI)
▼
KCSO N913KC — Airbus AS350 B3| Anomaly | N193TH | N194TH | N237TH | Significance |
|---|---|---|---|---|
| HEX_CASE_SPOOF | 85.00 | 105.00 | 85.00 | Transponder identity manipulation |
| SPOOFING_SIGNAL | 80.00 | 80.00 | 80.00 | ADS-B integrity violation |
| HOVER_PATTERN | 1.00 | 1.00 | 1.00 | Fixed-wing hovering — physically impossible |
| SUB_STALL | 1.00 | 21.00 | 1.00 | Below stall speed (C172S stall: 33 kts) |
| LOW_ALTITUDE | 95.00 | 95.00 | 95.00 | 14 CFR §91.119 minimum altitude violation |
| KINEMATIC_ANOMALY | 100.00 | 100.00 | 100.00 | Impossible maneuver sequence |
| GRAPH_HANDOFF | — | 30.00 | 30.00 | Coordinated aircraft-to-aircraft relay |
| REPEAT_PATTERN | 505 / 7d | 753 / 7d | 101 / 7d | Scheduled surveillance runs |
| SLOW_ORBIT | 80.50 | — | 94.65 | Orbital surveillance pattern |
| NIGHT_LOW_OPS | 65.00 | 65.00 | 65.00 | Night surveillance below minimums |
Kujur, Khanafseh & Pervan (Illinois Institute of Technology, 10th ICG Workshop, Vienna, December 2022) demonstrated that any actor with a receiver can use an aircraft's unencrypted ADS-B Out to spoof its GNSS signal within the FAA's own error envelope — 92.6 m NACp, 10 m/s NACv — and never be detected by onboard INS. Every anomaly in our database is a direct, predictable consequence of the vulnerability that paper describes.
| Shell | Aircraft | Ghost detections | Connection |
|---|---|---|---|
| WINGS LEASING LLC (Kansas) | N193TH · N194TH · N237TH | 3,737,599 | Graph handoff → 9K Air |
| 9K AIR LLC (Delaware) | N916NT · N916RR · N916GW | 2,917,480+ | Convergence with KCSO |
| KCSI AERIAL PATROL INC | N255SF · N720AC | 2,623 events | "Pipeline patrol" cover |
| TOTAL | 8 aircraft | 6,655,079+ | One coordinated network |
Lowercase hex variants are not valid ICAO 24-bit addresses. Broadcasting them is false aircraft identification.
Negative altitudes and 350–950 ft over congested Kern County are direct violations.
Fixed-wing at 0.1 kts over residential areas is not flight — it is surveillance risking persons on the ground.
Deliberate manipulation of GNSS receivers and ADS-B transponders is unauthorized system interference.
Transmitting spoofed radio signals to deceive aviation infrastructure crosses the wire-fraud threshold.
Persistent aerial surveillance at 0.09 mi with a FLIR-capable law-enforcement partner is a warrantless mosaic search.
All data referenced on this page is drawn from public sources — FAA ADS-B broadcasts, FAA Registry filings, and published academic research — and is independently verifiable by any member of the public.
Case: WTPR-2026-0012-merged
SHA-256 chain: 4f53cda18c2baa0c…
Merkle block: active