Mystery Flight From Rome to Tehran Puts Aircraft Tracking Deception in the Spotlight

An unidentified business jet flying from Italy to Iran under an apparently fictitious identity offers a glimpse into the techniques used to conceal sensitive aircraft movements from public flight trackers.

On Nov. 3, 2026, an unidentified business jet departed Rome Ciampino airport shortly after 01:10 UTC and flew to Tehran Mehrabad Airport, arriving at approximately 04:30 UTC after a flight of about three hours and 20 minutes. The aircraft remained on the ground for approximately eight hours before departing again.

The unusual flight was first reported by Italian military aviation tracking website ItaMilRadar which followed the aircraft using publicly available data from Flightradar24 and ADS-B Exchange.

An unidentified Italian aircraft, possibly operated by the intelligence services, flew to Tehran today using a fake identifier. The reason behind the flight remains unknown, but it is still interesting to retrace the investigative process that allowed us to establish a few key points about this flight, while leaving many questions unanswered.

https://t.co/gbjxYjRXpY

— itamilradar (@ItaMilRadar) November 3, 2026

What made the flight particularly interesting was not simply its destination, but the aircraft’s apparent identity.

According to ItaMilRadar, the jet transmitted the ICAO 24-bit address 300AB4 and the callsign ICVMN with the first falling within the block allocated to Italy, and the latter resembling an Italian civil registration (I-CVMN).

However, neither appear to be linked to any known aircraft: searches of public aircraft databases and registration records failed to identify any aircraft using either the hex code or the callsign/registration before Nov. 3, 2026. While the purpose of the mission has not been disclosed, the use of a registration and Mode S hex code never previously observed on public flight trackers, combined with the potentially sensitive nature of the mission, suggests that the aircraft may have operated with a deliberately altered electronic “signature” to conceal its true identity.

A mysterious flight from Italy to Iran

An unidentified Italian aircraft using Mode S ICAO hex code 300AB4 and callsign ICVMN has just landed at Tehran’s Mehrabad Airport after departing Rome Ciampino Airport. https://t.co/nI9MjuKCL9

— Egypt’s Intel Observer (@EGYOSINT) November 3, 2026

A possible connection with Italian Government aviation

ItaMilRadar investigated a possible connection with Compagnia Aeronautica Italiana (CAI), an Italian operator, based in Rome Ciampino, whose business jets, sporting an all-white livery that makes them virtually indistinguishable from ordinary civilian business aircraft, have been associated with sensitive government and secret service missions.

Among the aircraft known to be operated by CAI are Dassault Falcon 900 and Gulfstream G600 business jets. The flight parameters observed during the Nov. 3 flights are consistent with both types of aircraft, although a clear identification is not possible. Not even the Mode S addresses of the aircraft associated with CAI found any direct match with the unidentified jet’s hex code.

Dassault Falcon 900LX, Compagnia Aeronautica Italiana, at Budapest-Ferenc Liszt/Ferihegy Inter’l,Hungary on 15/06/11. | Source: Alex Wilson/Wikipedia This would not be the first time a sensitive mission was flown by a CAI aircraft using a “fake” registration and hex code: in January 2025, a Falcon 900 flew the same route, from Rome Ciampino to Tehran, to bring home Italian journalist Cecilia Sala, who had been detained in Iran. In that case, the Falcon also operated under a temporary identity, I-TWOW, different from those normally associated with CAI aircraft, possibly to make the mission more difficult to identify and track. In that case too, the aircraft was spotted by OSINT observers and aviation enthusiasts monitoring its movements through public flight-tracking platforms.

Beyond the speculation and theories surrounding the Nov. 3 flight, the mission raised an interesting question: how difficult is it to conceal the identity of an aircraft from the growing community of aviation enthusiasts and OSINT (Open Source Intelligence) analysts monitoring aircraft movements worldwide?

As we have reported in details previously, changing the electronic identity transmitted by an aircraft is not unprecedented. In 2020, we documented the use of unusual or bogus Mode S hex codes during operational missions by U.S. military reconnaissance aircraft.

One particularly interesting example occurred on Sept. 7, 2020, when a U.S. Air Force RC-135W Rivet Joint operating near China changed its ICAO 24-bit address from AE01CE to 750548, a code falling within the range allocated to Malaysia.

Other similar occurrences involving American reconnaissance aircraft had already been documented, including RC-135 missions near Venezuela.

File photo of an RC-135 Rivet Joint, assigned to the 763rd Expeditionary Reconnaissance Squadron, flies over Afghanistan in support of Operation Enduring Freedom. | Source: U.S. Air Force photo by Master Sgt. William Greer In our 2020 article, former RC-135 aircraft commander Robert Hopkins suggested that the use of random Mode S codes could be intended to confuse amateur OSINT observers and flight-tracking enthusiasts rather than deceive an adversary’s military surveillance systems.

An aircraft’s ICAO 24-bit address is a unique identifier assigned under a system intended to associate each address with a specific aircraft. Mode S transponders use this address in their replies, while ADS-B transmissions can provide additional information, including position, altitude and other flight data.

Public flight-tracking platforms use these signals, along with other sources of information, to display aircraft movements and associate them with registrations, types, operators and previous flights.

However, the information broadcast by an aircraft is not necessarily immutable.

For example, a flight may use different callsigns on different missions, while its Mode S address normally remains unchanged. In certain circumstances, however, the address itself can be reconfigured, potentially preventing a tracking platform from automatically associating the flight with the aircraft’s established history.

Needless to say, changing the transmitted identity does not make an aircraft disappear from primary radar, nor does it necessarily prevent air traffic controllers or military operators from identifying it through other means. However, it may make it more difficult for enthusiasts and researchers relying on public tracking databases to associate a flight with a particular aircraft, its operator or its previous movements.

It is also important to highlight that an unexpected hex code does not automatically mean “deception.” Incorrect transponder configuration, database inconsistencies and other technical or administrative issues might produce discrepancies between an aircraft’s transmitted identification data and the information available to the public, even though, considering all the available details don’t seem to suggest the Nov. 3, 2026 “weird” hex code and callsign being mistakes.

In the wake of the media frenzy following the appearance of the mysterious Rome-Tehran flight, we received a lot of questions regarding the aircraft’s identity and the tactics/methods used to conceal some sensitive details about a flight. Here they are:

Are the hex code and registration observed on the Nov. 3 flight actually unusual? Could they indicate the use of a temporary electronic identity to make the aircraft more difficult to recognize?

They are unusual because, as explained, they do not correspond to any known aircraft. Both the callsign ICVMN, which resembles an Italian registration (I-CVMN), and the Mode S hex code are new and do not appear in publicly available databases, suggesting that they may have been used to conceal the true identity of the aircraft and its operator.

Is it plausible that the aircraft was a Falcon 900 operated by Compagnia Aeronautica Italiana, similar to the one used in January 2025 to bring Cecilia Sala back to Italy?

It is plausible. During particularly sensitive operations, when it is necessary to conceal the identity of an aircraft or the organization operating it, deception techniques can be employed, using identifiers different from those normally associated with the aircraft.

This can involve both the aircraft’s external registration markings and the electronic identifiers transmitted by its transponder, including its ICAO 24-bit address. The latter can be changed by replacing the original transponder or, under certain circumstances, reprogramming it without necessarily replacing the onboard equipment.

Once the mission is completed and the need for secrecy no longer exists, the aircraft can be returned to its original configuration.

Some observers have noted that I-NEMO, one of the Falcons historically associated with sensitive missions, has not appeared on public tracking platforms for months. Is there any technical evidence suggesting that it may have operated under different identifiers or been replaced?

It is certainly possible, but we must be cautious about linking any specific aircraft to the one that carried out the Nov. 3 flight.

The fact that an aircraft does not appear on public flight-tracking platforms does not necessarily mean it has not flown. Visibility depends on several factors, including receiver coverage, the information transmitted by the transponder and the way individual tracking platforms process and display that data.

We therefore cannot rule out that I-NEMO has continued operating under different procedures or identifiers, just as we cannot rule out the possibility that it has been replaced by another aircraft.

What information would allow the aircraft to be identified with greater certainty?

In the most recent mysterious flight, the callsign, hex code and registration are not, by themselves, sufficient to identify the aircraft with certainty.

Without official confirmation or documentation, the most reliable approach would be to cross-reference these electronic identifiers with historical flight-tracking data and any available photographic evidence.

Photographs may reveal distinctive features of the aircraft and, where possible, help establish its Manufacturer Serial Number (MSN), which uniquely identifies the airframe regardless of the registration it carries.