The shadow fleet exists because it isn’t easy to know who is who.

I see an easy fix. Most of the time these Shadowfleet tankers are turning off their AIS beacons to hide their movements. Step one is for Starlink operators to collect lists of active Starlink connections that exist without a cosponsoring realtime AIS signature. You've now got a list which contains nearly all of the shadowfleet vessels with Starlink (and some bad data from a handful of legit ships that were having communication difficulties or maintenance occurring during Starlink use). This would be fantastic targeting data for Ukraine!

If Starlink wanted a denial effect, they could simply bake in a pseudo AIS signal (not the traditional VHF transmission) derived from Starlink posiioning data into the Starlink product so that as soon as Starlink is used, it itself is broadcasting your position into AIS through a proxy server.