What is recorded The European Observatory of Drone Incidents records drone incidents in Europe: unmanned aircraft that fly over a facility, enter an airspace from outside or disrupt the operation of an airport.
It covers all European soil, also outside the continent: the Canary Islands, Ceuta, Melilla and the peñones (Spain); the Azores and Madeira (Portugal); Guadeloupe, Martinique, French Guiana, Réunion, Mayotte and Saint Martin (France); Gibraltar and the Akrotiri and Dhekelia bases in Cyprus (United Kingdom); Greenland (Denmark) and Svalbard (Norway). Each territory counts as the country it belongs to. The map opens on Europe: overseas incidents show when you zoom out or filter by country.
Map borders and names follow the position of the European Union.
Drones only. Balloons, missiles, crewed aircraft, laser pointers and signal interference without a drone are not recorded, and neither are authorised flights or accidents involving a force's own drones during exercises.
Each incident is placed as an area, a point with a radius, because the exact position is almost never known. If the source only names the country, the region or the sea, the incident is drawn with its own approximate-location marker (a hollow ring with a dot) at the centre of that area, and its record says the level and where it comes from. If the source does not allow an incident to be placed precisely, it is published at country level with an approximate location. Every piece of data keeps who says it: for each source we store the fact, a short source sentence in its own language and the link, never the full text.
Types
Airport disruption An airport closes or has flights diverted, cancelled or delayed. When it applies, this type takes precedence over the others.
Incursion The drone enters from outside the country and its origin is proven by tracking or by debris. A sighting with no proven origin is never an incursion.
Overflight Any other drone flight over a facility or a town. Statuses
The news reports it. It is the initial status of every incident. In orange.
An authority states that the incident happened. In red. “Confirmed” means that an official authority has stated it, not that public physical evidence exists.
A confirmed incident for which a competent authority (government, ministry, armed forces, prosecutor or police) expressly states, in its own words, who is responsible: a State or a person. A news report saying so without the authority's own words is not enough, nor is an authority investigating, examining a possible link, not ruling it out, finding it possible or suspecting it: that goes in the record as an investigation under way and the incident stays confirmed. The perpetrator is never the authority making the statement. A person only if the authority has arrested, charged or convicted them, and their name only if the authority gives it. If an attribution no longer holds, it is withdrawn with a step in the history saying why. On the map, a circle with a thick red ring, larger than an incident's and drawn on top of everything, centred on the place: inside, the flag of the country the authority attributes it to, the State or the person's nationality (the latter only if the authority states it expressly; it is never inferred from the name, the place or the language). With no country, or a country without a flag on the site, the ring is filled red. When attributed to a person, it also has a fixed dark dot in the centre. The flag is the one the authority gives, not a claim by the observatory. Several attributed incidents together when zooming out are one marker with its number; if they belong to different countries, it is filled red, without a flag. The record shows it as “Confirmed · attributed to…”, with who attributes it and to whom.
An authority denies the incident. It stays published, with the reason. Only another authority of equal or higher reliability can return it to confirmed. Authorities that contradict each other. If two official authorities say opposite things about the same event, the one competent for the airspace (the air navigation service provider, the civil aviation authority, the armed forces) or for the investigation (the police, the prosecutor, the investigating body) prevails. What the other one said stays in the history, with its date and source, and the next step says why the competent one prevails. An airport operator does not monitor the airspace or investigate: saying it received no report does not deny what air traffic control confirms (Brussels, 12 September 2026: skeyes detected the drone; Brussels Airport said it had no record of it). If the one that denies it is the competent one, the incident is denied.
In the scoreboard, “confirmed by an authority” includes the attributed incidents, which are also counted on their own, and leaves out those whose drone presence is not substantiated or ruled out (see “Drone presence”), which still count as incidents. Status is always shown with both colour and text. A circle that groups several incidents is red if it holds any confirmed or attributed incident, purple if there is none and one is not substantiated, and orange if all are reported; an outer purple ring means one has its drone presence not substantiated, and a grey one, ruled out.
Drone presence Event status says whether the incident happened; drone presence says whether the authority attributes it to a drone. If the competent authority takes it as a fact, it is confirmed: it is enough for the airport operator, the air navigation service provider, the police, the armed forces, a ministry, the public prosecutor or the civil aviation authority to act or state that the event was caused by a drone (a closure because of a drone, a drone report it passes on, a police response to a drone). No debris, footage or sensor detection is required. It stays not confirmed if the authority itself leaves it open («possible drone», «unidentified object», «investigating whether it was a drone») or if only the press or witnesses report it.
An official authority closed its investigation without evidence of the drone, or withdrew its statement without saying it was something else. In purple. It is not a denial: not finding evidence is not the same as proving there was no drone.
An authority says it was something else (a plane, a helicopter): it is the denial of the drone presence, not of the incident. In a filled grey circle, the grey of “Denied”; a denied incident is a dashed ring with no fill. Neither erases anything. The incident happened even if its cause is later rectified: if an airport closed, it closed. A rectification changes the drone presence, not the incident or its effect (the closure, the diversions, the duration), and nothing disappears from the map: it stays in place with its full history. The event status does not change either: a confirmed incident stays confirmed, with its drone presence not substantiated. In the figures, “confirmed by an authority” leaves out those whose presence is not substantiated or ruled out, which still count as incidents.
The change to not substantiated is only made with an official source and after expert review. The record shows the whole sequence, each step with its date, who states it and the link to its source: “Confirmed on 23/09/2025 by Copenhagen Police · Not substantiated on 25/06/2026 by Copenhagen Police, after the investigation”. A partial official correction is noted in that history without changing the value.
The Liège case shows it. In November 2025 the air navigation service provider halted traffic at the airport after a drone report: the authority attributes the event to a drone and presence is confirmed. The headline of each record says the same as this field: it states the drone when it is confirmed and presents it as possible when it is not.
Admiralty code Each source carries a two-character code, for example B2. The letter rates the reliability of the source, from A (authority with direct competence) to F (cannot be judged). The number rates the credibility of the information, from 1 (confirmed by independent sources) to 6 (cannot be judged).
A Official statements from the competent authority.
B Official statements quoted in a news report, and Ukrainian Air Force reports.
C News media.
D Russian Ministry of Defence statements. Sources rated E and F are not published. When sources give different figures, the record shows the range covered by sources rated A to C.
How news reports are grouped News reports are read by automatic extraction validated by rules: a record that does not match the schema, or whose source sentence is not in the report, is discarded. Copies of the same story count once and are shown as reprints.
Two reports are the same incident if they refer to the same target, or to points closer than the sum of their radii plus 10 km, and their start times are less than 6 hours apart or, when only the day is known, fall on the same day or the next. More than 12 hours without activity start a new incident. Two closures of the same site on different nights are always two incidents.
An episode links the incidents at two or more targets in the same country during the same night, from 16:00 to 06:00 UTC. On the map they are joined by a thin line.
Official statements quoted When a news report quotes an authority, the statement is recorded as a source of its own, rated B, with the link to the report that carries it. It confirms the incident if the authority states that it happened, and with it drone presence, unless the authority itself leaves it open; and it denies or attributes the incident if that is what it says.
Nothing is deleted No record is removed. Every change of status is added to the history with its date and the source behind it, and a denial does not erase what came before. If the change was caused by a source that is not published, the history keeps the change and omits the source.
Sources
Official statements Police forces, air navigation providers, airports and defence ministries that publish their statements openly.
Ukraine layer Ukrainian Air Force reports and Russian Ministry of Defence statements. They are claims by a party to the war: each attack aggregates what one of the two sides declares, usually per night, with no other source confirming it.
Places hit, from Russia against Ukraine Official channels of the Ukrainian regional military administrations and of Kyiv, identified from each one's official website: reliability B, official source.
Places hit, from Ukraine against Russia The Ukrainian General Staff channel (its claims of strikes on refineries, depots and airfields) and the channels of Russian governors and regional governments linked from their official websites (the damage they admit on their territory). They are parties to the war: reliability C, claim by a party. Areas occupied by Russia always carry their Ukrainian code; authorities installed by Russia are marked as such.
Scoring of a place hit Messages from the same channel are not independent sources. A single official source gives “probable”; a claim by a party, “possible”. It rises if another independent source confirms it, if both sides say so (at least “probable”) or if the satellite detects a new thermal hotspot at the place, which counts as measured data. The same treatment for both parties. Missiles and bombs in the same messages are not recorded. Thermal hotspots from satellites Each declared impact (a drone that exploded or crashed, with its place known to within 10 km) is checked against the thermal anomalies detected by the satellites of NASA FIRMS↗ (external link, opens in a new tab) (VIIRS on Suomi NPP, NOAA-20 and NOAA-21, and MODIS on Terra and Aqua). The mark means there were at least two hotspots within its precision radius (between 2 and 10 km) from the start of the attack until 36 hours after it ended.
Refineries and plants have flares the satellites always see: a hotspot only counts if it is new compared with the previous 30 days or more than four times as powerful as usual for that spot. As some flares go unseen for months, a new hotspot at a spot that already burned in the previous year only counts if it is more than four times as powerful as that spot in the year, unless one satellite pass sees three or more. Low-confidence hotspots are discarded. Impacts known only by region are not assessed; places hit from the regional channels and the General Staff are, except those in the daily front-line reports and FPV attacks, where artillery causes hotspots every day. Nor is a place assessed whose radius burned on half or more of the previous 30 days at many spots: a new hotspot there says nothing.
The satellites pass over each place several times a day and every pass leaves its detections. The mark appears when there is a hotspot: a measured physical fact, a fire within the radius in the attack window, shown alongside what the sources say.
War seen from space In the war layer, four pieces come from satellites and from the official reports. Before and after images: for each strike with a detected thermal hotspot and for each strike on an installation, the last cloud-free Sentinel-2↗ (external link, opens in a new tab) image before the attack and the first one after it, cropped over the site in natural colour with the same brightness adjustment. Cloud is measured over the crop itself with ESA's scene classification: an image with 3% cloud or less over the installation is used even if the whole scene is cloudy. A pair is published only if the change can be seen: both images are brought to the same 10 m grid, and the difference of the burn index (bands B8A and B12) and the darkening in natural colour are measured, without clouds, shadows, snow or water, and above what changes in the rest of the crop (season, crops, light). The patch touching an 800 m circle around the strike counts, and the pair is published if it reaches 10 hectares; if the first clear image after the attack does not show it (smoke or thin cloud cover it), the next ones are tried for 15 days. The changed area is outlined and the image is framed on it. Everything from the satellite is switched on with «With satellite»; the corridors, with their own button.
Night lights: after each attack on energy targets (a strike on the power grid or an official regional message naming it), the brightness of the affected cities and regions in the VIIRS day-night band (NOAA-20), from the NOAA open archive↗ (external link, opens in a new tab) . Brightness is the city's light above the surrounding background, measured in the same satellite pass (which removes moonlight reflected by the ground); only nights with 70% cloud cover or less count (Open-Meteo, at the time of the pass) with the satellite close to overhead. The reference is the median of the valid nights of the previous three weeks; there is a loss of light when two or more nights of the following week lose half or more, in cities with a reference of 0.5 nW/(cm²·sr) or more. The thresholds were set with 20 documented blackouts from 2024 to 2026, 9 controls and 411 windows without attacks (3 showed a loss).
Permanently reduced street lighting: a city whose brightness stays below 0.5 nW/(cm²·sr) above the background cannot show a blackout with this rule, so it is marked on the map with its own sign instead. It is marked when the median of its last 10 valid nights is below that minimum and, going back month by month (months with 3 valid nights or more), the monthly median stays below it too; a single month above (snow reflects the city light, as in January 2026) does not break the run, two measured months in a row do. Its card gives the date since when (or «at least since» the first night measured), the current brightness and the earliest measured, each the median of 10 valid nights, and the number of nights it is based on. It is computed from all the nights measured by NOAA-20.
Confirmed fire hotspots: of the NASA FIRMS hotspots of the last 24 hours over Ukraine and European Russia, with the same filters as the strike cross-check (refinery flares and plants with habitual heat, low confidence and areas that burn every day, such as front-line cities, are left out), only those within the radius of a reported strike within 36 hours are published. In «With satellite» they count as strikes with a hotspot as soon as they are confirmed, together with those of the historical cross-check. The rest (crop burning, industry, wildfires) are still downloaded and cross-checked, but not drawn.
Attack corridors: arcs from the launch zones named by the Ukrainian Air Force reports (with the point from the deduction engine's zone catalogue) to the regions reached, with the width given by the drones of those attacks in the selected period. For attacks on Russia, whose report gives shoot-downs by region, the arc starts at the point of the Ukrainian border closest to each region and its figure is those shoot-downs.
Route of the incursions For incidents in Romania, Moldova and Poland where the authority names the places the drone passed, the record draws that route when opened, with the sentence it comes from: the places in order, located with the gazetteer, and a band joining each pair.
Drone type Each incident says which class of drone it may have been only when there is a basis for it. If an authority names the model (for example, the debris of a Gerbera identified by the army), the record says so and where it comes from. Otherwise the observatory deduces it and shows it separately, as “compatible with”, always with the reasons. When what has been published does not tell the long-range attack drone from the decoy, the record only says “Compatible with a long-range drone of the war (attack or decoy)”, without percentages.
Described features The sources’ sentences are read for the shape (multirotor, fixed-wing, delta wing), the sound (propeller, combustion engine, jet), the size, lights, the number of aircraft, duration, altitude, speed, time and behaviour (hovering, circling, passing through, in formation). Each feature keeps the literal sentence and its source. What the text does not say is not assumed.
Calculation It starts from how often each class appears in the cases of the same area (border or inland) where an authority identified the drone. Each feature raises or lowers the classes according to what the performance catalogue says about them, and physical constraints weigh in: the distance to Ukraine, Russia and Belarus (and to the coast) against each class’s range; the wind and temperature at that time and place; duration and altitude against endurance and ceiling; and speed: below 230 km/h, propeller; above 300 km/h, jet; in between it does not decide.
Check The calculation is repeated with each case of known answer held out (debris and official statements in Romania, Moldova, Poland, Lithuania, Latvia, Bulgaria and Turkey, and drone encounters classified by the UK Airprox Board) and compared with always saying the most frequent class. Only classes with at least 5 checked cases that beat that reference and give probabilities that hold are published. On 6 October 2026 the propeller long-range attack drone and the long-range decoy pass, at the border. Percentages for each class are only shown if the most likely one doubles the second and, in the cases of known answer where the method said so, it was right at least 8 times in 10 (with 5 cases at least). On 7 October 2026 no border case passes: attack drone and decoy cannot be told apart, so no percentages are shown. What does pass is that it was one of the two: in 22 of 24 cases. The calculated probabilities remain in the data export.
No basis Without features that weigh in or an entry from outside at the border, without any reason to show, with the drone unconfirmed or with a most likely class that has not passed the check, the row does not appear. Measured air traffic For incidents at airports with scheduled flights, the closure is measured with real traffic: the daily archive of adsb.lol↗ (external link, opens in a new tab) , an open network of ADS-B receivers. Landings and take-offs by airliners and business jets are counted in 15-minute slots and compared with the same slot on the same weekday of the four previous weeks. A measured closure is a stretch with 30% or less of the usual traffic that matches the incident; its start and end are the last movement before the gap and the first one after.
A diverted flight is one that was descending towards the airport and landed at another, or one that landed at another airport with a flight number that arrived there at that time in previous weeks. A holding flight is one that flew holding patterns, found with the detector of the open traffic library. If the measurement differs from what the sources say, both are shown.
Coverage: each day what adsb.lol sees at each airport is compared with EUROCONTROL's reference IFR flights, and gaps are read at the airports and on the days where half or more is seen. Each gap is checked against the airport's METARs: those explained by the weather (fog, thunderstorm, snow, strong wind or a contaminated runway) are set aside. The measured closure is shown next to the incident it matches.
The record carries the measured closure when the incident is at an airport with scheduled flights, adsb.lol published the full day, coverage at that airport that day is sufficient, there are four weeks of baseline and a gap matches the incident. Every value comes from the measurement; none is estimated.
Live closure detection Every 80 seconds the positions of aircraft around the monitored airports (those with high coverage on all four days of their baseline in the daily archive) are requested from adsb.lol↗ (external link, opens in a new tab) ; if it does not answer, the service switches by itself to adsb.fi↗ (external link, opens in a new tab) . From those positions arrivals and departures are rebuilt, with the same rules as the measured traffic and a delay of 4 minutes so that each movement is complete, and compared with the median of the same weekday and the same local time over the four previous weeks.
Possible closure in progress Since the last movement at least 12 expected movements are missing, at most 10 % of them are seen, the shortfall grows by at least 0.5 movements per minute of gap, no aircraft is taking off or landing, all of it for 4 minutes, and no METAR since one hour before explains it (fog, visibility, ceiling, thunderstorm, snow, strong wind or a contaminated runway).
Closure confirmed An official source or an incident in the database reports the closure.
Operations resumed At least 2 movements return and half or more of the expected traffic is seen over the last half hour. The alert stays on the map for 12 hours. Each alert keeps its detection time, its evidence (expected and seen movements, missing arrivals and departures, aircraft holding and diverted flights) and, once it arrives, the time of the first news, which gives the detection's lead. An alert triggers the directed news search; once confirmed, the incident enters the database through the normal flow with the measured closure.
GPS interference Every ADS-B position carries its integrity (NIC) and accuracy (NACp). An aircraft has a degraded position in a zone on a day if any of its positions there has NIC below 7 or NACp below 8, the minimums of the ADS-B Out rule. Zones are H3 hexagons at resolution 4 (about 1,770 km²), the grid of gpsjam.org. The share of aircraft affected subtracts one degraded aircraft, so that a single faulty unit does not colour the zone: (degraded − 1) / aircraft.
Each zone on the map gathers 20 or more aircraft in the day. Levels: under 2% no interference, 2 to 10% medium and over 10% high, in grey that gets lighter with the share and the high level in red. For a period, aircraft and degraded aircraft are added up per zone over each day (each month for periods longer than 7 days). It is computed on the server from the daily adsb.lol archive. “Europe now” counts the zones with high interference on the latest published day; the layer legend counts, with the same calculation, those of the chosen period.
Pressure by country Each country is filled in grey by its incidents in the selected period, with the active filters: five steps relative to the country with the most. The trend compares with the previous period of the same length: stable if the difference is zero, or one and no more than 10% of the previous figure; otherwise up or down, with the figure. Tapping a country shows its figures by type and by status and its incidents.
The figures per country count the incidents recorded from what each country's media and authorities publish openly, in the languages the collection reads.
Border or interior The map shows two different things: war drones crossing or falling near the border with Ukraine, Russia (including Kaliningrad) or Belarus or on the Black Sea coast, and drones over airports, bases and facilities in the interior of Europe. The “Where” filter shows all of them, only those on the eastern border or only those in the rest of Europe; the header figures follow it. In the countries of the eastern flank (bordering Ukraine, Russia or Belarus or with a Black Sea coast), each incident’s card shows its group and the rule that decides it; in the rest of Europe and overseas all are interior and the card does not repeat it.
1. Attack If the incident is linked to that night’s Russian attack on Ukraine, it is a border incident.
2. Distance With a point: border if it is 150 km or less from the land border with Ukraine, Russia or Belarus, or 50 km or less from the Black Sea coast; otherwise interior. The cut comes from the data: of the incidents with a point, those in the band reach 144 km (incursions into Poland, Romania and Lithuania) and the next one is at 191 km (Bucharest airport).
3. Named place Without a point, the same distance from the place in the country named by its locality, its region or its headline; a headline placing it in the Black Sea makes it a border incident.
4. No place Border if the drone came from outside (incursion, entry from abroad or a state drone) into a country bordering Ukraine, Russia or Belarus or with a Black Sea coast, or if the whole country is 150 km or less from that border (Moldova). Otherwise interior. Forecast and trends The “Forecast” button says what is happening more than usual and what is likely to happen. Only what has passed a check against the past is published: each figure is computed with the data before a date and compared with what happened afterwards, moving forward in time, never using future data. It is compared with two simple references, the country’s usual frequency and “tomorrow same as today”, and published only if it does better than both and the improvement holds when the check is repeated with randomly drawn weeks. What does not pass is not shown. With little data nothing is claimed.
Tonight at the border Probability that a war drone crosses into or falls in the country the next night (at least one border incident that night). It is computed before the night, using only what is already known: the drones launched at Ukraine on average over the last three nights (Ukrainian Air Force reports), how many of the last seven nights had drones launched from Crimea and the country’s border incidents in the previous seven days. It is a logistic regression refitted every month. It is said as “2 in 10 nights like this one (20%)”, with the country’s usual rate (nights with a drone among the nights checked, the same figure as in the check) and the factors that raise or lower today’s risk against their usual value; those that do not change it are not listed. The check says how many of the nights with a drone were among the quarter of nights with the highest risk, and is folded under “How it is checked”. It is shown for each country where it passes the check.
Second night After a large wave over Ukraine (drones launched reach the 90th percentile of the previous 60 nights), the probability that the next night is large too. It is shown only on those nights and only while its check supports it.
Streaks by country A country’s normal is the average of its weeks over the last year without the last four. There is a streak when the last four weeks add up to more than normal gives 1 time in 20 (negative binomial with the country’s own dispersion), with at least 3 incidents on 2 or more different days. It counts events, not news: each incident once, on the date it happened. A country with fewer than 5 incidents in its normal year has no streak. It says since when, how many incidents against the usual and whether it is growing (the last two weeks exceed the two before) or fading. The check: after a streak is flagged, the following week looks more like the streak than like normal.
What has changed The share of each target type among the impacts on Ukraine with a known target (only from the official channels that give impacts in every quarter since January 2025, so that a channel that starts or stops naming places does not change the mix) and the share of each incident type in Europe, over the last three closed months against the previous twelve. Only what has really changed is listed: outside what the usual share gives 1 time in 20, with a difference of 3 points or more. The share is used, not the count, because the count for a month depends on how many sources are read. Check: after a change is flagged, the following month looks more like the recent months than like the usual. Not by region of Ukraine: each region is counted by a single channel, and a regional change cannot be told apart from a change in coverage.
Mix of each wave In the Ukraine layer, each attack’s sheet and “Night by night” say how many of the drones launched were Shahed or Geran and how many were jet-powered when the Ukrainian Air Force report says so; the rest are Gerbera decoys and other types. They are minimums and come only from the official reports. The Ukraine text page has the mix month by month.
How it is scored Probabilities with the Brier score (the squared error between the probability and what happened). In each part, “How it is checked” says how many nights or weeks it was checked against and, at the border, what happened in each probability band. Forecasts for the nights before publication are reconstructed as they would have been made then.
Live record Since 6 October 2026 each forecast is stored with its time before the result is known (the border one, at the first update from 17:00 UTC) in a record that admits no changes or deletions, and scored once the result is known (3 days after the night). It is in the published file prevision.json and in the data export, with its method and date. Licences and attributions
Code Apache-2.0 (open source). Open data The data can be downloaded and reused with attribution. It is rebuilt with every update.
Attacks in the Ukraine layer JSON CSV Incidents with an approximate location JSON Version of 16/10/2026 · 12:17 UTC
Licence: CC BY 4.0↗ (external link, opens in a new tab)
The observatory’s compilation (the incidents, their statuses, their classifications and their figures) is published under the CC BY 4.0 licence: it can be copied, transformed and reused, also for commercial purposes, citing the source as shown below. Quoted sentences remain their authors’ and are used as quotations, with their source and link. The measured air traffic block (trafico_aereo) derives from the adsb.lol archive and is offered under its licence, ODbL 1.0.
Authorship
Author: Lucas Alaniz Pintos, PhD · ORCID 0009-0008-5179-2534↗ (external link, opens in a new tab) · Contact: lucasalanizpintos@gmail.com
Recommended citation
Alaniz Pintos, L. (2026). European Observatory of Drone Incidents. Version 2026-10. https://droneobservatory.eu. Licence CC BY 4.0.
Citable versions On the 1st of every month a version of the open data is frozen: the same files, with their date and fingerprint, at an address that does not change. A published version is never modified or deleted: it is there to cite exactly the data that was used.
