Forty-Five Shadow Fleet Tankers Link to a Single Hong Kong Nominee

What’s inside?

At a Glance

- Windward identified 45 Russia-trading shadow fleet tankers connected through 45 single-ship Hong Kong companies to one beneficial owner.

- Forty-two of the 45 are sanctioned, and the three that are not have ISM managers in the UAE rather than Azerbaijan.

- All but three share 19 ISM managers with addresses in the same industrial cluster in Sumqayit, Azerbaijan, approximately 30 kilometers north of Baku.

- The cluster only became visible as the vessels shifted ownership to Hong Kong between January and August 2026, having previously sat in Seychelles and Marshall Islands special purpose vehicles.

- The beneficial owner of all 45 is a nominee director who cannot be traced.

One Nominee, Forty-Five Companies, Forty-Five Tankers

Windward’s visual link analysis has identified 45 Russia-trading shadow fleet tankers connected through 45 single-ship Hong Kong companies to one beneficial owner. All but three share 19 different ISM managers with addresses in the same industrial cluster in the Azerbaijani city of Sumqayit. 42 of the fleet are sanctioned, and the three that are not have ISM managers in the UAE rather than Azerbaijan.

An Aging Fleet Under Two Flags

The fleet comprises six Suezmaxes, 33 Aframaxes and six medium-range product tankers, with an average age of 22 years. 34 are flagged with Sierra Leone and nine with Equatorial Guinea.

Shadow Fleet Ownership Is Consolidating in China and Hong Kong

The cluster underscores the accelerating shift in shadow fleet ownership and management structures to China, Hong Kong and Russia across 2026. Windward analysis shows 12% of Russia-trading tankers have registered ownership in China and 10% in Hong Kong, making them the largest and third-largest countries of incorporation, respectively, with the Marshall Islands second and Russia fourth.

The Cluster Only Became Visible This Year

Consolidated into the cluster are tankers that have changed names, flags, and companies as many as eight times since 2023 and only became linked as they shifted ownership to Hong Kong between January and August. They were previously owned by special purpose vehicles in the Seychelles or the Marshall Islands. The beneficial owner of all 45 is a nominee director who cannot be traced, a common tactic used by shadow fleet operators to obscure the identity of the real owner.

Twenty Virtual Offices Across Hong Kong

Registered ownership addresses were tracked to 20 locations across Hong Kong, with 13 addresses hosting between two and five vessels. All addresses given were virtual offices used by corporate service providers. Two of the tankers are owned by companies giving their address as the ninth floor of the McDonald’s building in Hong Kong. Kowloon hosts the largest share with addresses for 19 of the 45 owners, and the largest single address covers five tankers at one room in a building in Admiralty.

Forty Managers in One Azerbaijani Industrial Area

In Azerbaijan, addresses were provided for 19 ISM managers covering 42 tankers, with 40 traced to companies listing flats within an industrial area in Sumqayit, a former Soviet industrial city on the Caspian coast approximately 30 kilometers north of Baku. Two tankers were managed from Baku and three from Sharjah. Azerbaijan has been frequently linked to Russia-trading oil and freight companies, including sanctioned oil traders.

The Company Names Follow a Generated Pattern

The naming of the newly formed Hong Kong companies appears to follow a computer-generated pattern of an invented word following English phonetic patterns, a maritime term, and a company suffix. The prior Seychelles-registered ownership companies were named using English two-word phrases pairing a nature word with a maritime term. Four tankers listed their former commercial controller as a Geneva-based shipping company sanctioned by the UK in May 2025, which was the shipping arm of a Russian oil producer.

Written by Michelle Weise Bockmann, Windward Senior Maritime Intelligence Analyst.

Trending

- The EU’s 18th Sanctions Package Lookback Started. Trading Russian Products? You're At Risk. Nov 24, 2025

- Tanker Freight Rates Hit Five-Year High Amid Russian Oil Sanctions Shake-Out Nov 6, 2025

- Sanctioned, Stateless, and Still Sailing: Expert Insights from the Frontlines of Maritime Sanctions Nov 3, 2025

Vessels Loiter Over Subsea Cables and Pipelines Across Five Theaters

What’s inside?

At a Glance

- Two Chinese state-linked vessels spent September running structured survey grids over separate transpacific subsea cable corridors, one around the Guam cable hub and one over the Japan to U.S. cables east of Japan.

- A third Chinese research vessel has been holding station in the Bashi Channel inside the Philippine EEZ since September 22 while spoofing its AIS position more than 2,000 nautical miles away, with its destination field reading “TOWING 1NM CABLE.”

- Two vessels are holding position over the Bab el-Mandeb cable corridor off Djibouti, one a Russia-linked bulk carrier loitering for more than eight days, the other a zombie identity spoofing its position for six weeks after departing the Houthi-held port of Hodeidah.

- Two sanctioned tankers that loaded at Primorsk a day apart ran matching 40- and 45-hour loiters over the FLAGS and Alwyn-Frigg gas pipelines feeding St Fergus, which supplies 25 to 50% of Britain’s gas.

- Two Russian-flagged tugs, one towing a barge fitted with a seabed-capable excavator, have spent a month over the Kattegat and Skagerrak cable corridors, prompting a Danish municipality to activate its crisis group.

- A Russian trawler with a documented IUU record has been working just outside Canada’s EEZ directly above five transatlantic cables since late August.

- Saudi terminals in the Middle East Gulf loaded 3,911 kbpd of crude between September 1 and 27, more than four times the August figure, with only four of 55 tankers calling with AIS on.

- Roughly 75 high-speed craft were observed swarming off Khasab on September 26, the largest swarm tracked since late June.

- Windward’s visual link analysis has connected 45 Russia-trading shadow fleet tankers to a single untraceable Hong Kong nominee director.

Chinese Survey Grids Converge on the Guam and Japan Cable Corridors

Two Chinese state-linked vessels have spent September running structured survey grids over separate transpacific subsea cable corridors, one around the Guam cable hub and one over the Japan to U.S. cables east of Japan.

A Chinese-flagged fishery patrol vessel operated by a state fishery research institute has run research-pattern grids on both sides of the Guam subsea cable hub for seven weeks. From August 31 to around September 20, it worked a grid east of Guam between the Bulikula and SEA-US cables. After crossing the Guam and CNMI EEZ between September 20 and 22, it began a second grid west of Guam in the Philippine Sea, still running as of September 29. From August 11 to 29, it had conducted similar activity next to the Philippine EEZ. On September 13, it met a Cook Islands-flagged tanker east of Guam for approximately six hours, likely to refuel. AIS has remained on throughout.

This is the first time the vessel has conducted this kind of activity in the region, having previously operated around China and occasionally in the Indian Ocean. The north-to-south legs and repeated slow-speed stops resemble a survey rather than a fishery patrol or a transit. Both grids sit on cable routes landing at Guam, the landing point for 11 subsea cables and a principal link between the U.S. and Asia. The activity fits a wider pattern of Chinese research vessels mapping the seabed around the Philippines, Guam, Hawaii and Wake.

The head of U.S. Naval Intelligence has said this data enables submarine navigation, concealment, and the positioning of seabed sensors or weapons. In mid-2025, a Chinese research vessel ran a comparable lawnmower mapping pattern just outside Guam’s EEZ for more than five weeks. A fishery patrol vessel draws less attention than a declared research ship, and its grids sit directly on the cable routes. Seven weeks of back-to-back activity, most of it around the Guam cable hub, supported by a tanker meeting that allows it to stay at sea, points to possible deliberate mapping of the seabed and cables around Guam.

Separately, a Chinese research vessel owned by a state university has been running a research grid east of Japan in the Northwest Pacific since September 11. Over 18 days, it made 27 low-speed research stops across an area crossed by the JUNO, Jupiter, FASTER, Topaz, Unity, PLCN, Pacific Crossing-1 and TGN-Pacific cables, which link Japan, Taiwan and the Philippines to the U.S. Its AIS stayed on throughout, and it is now heading southwest at 13 knots.

This is the vessel’s fourth trip to the same area since May 2024 and the first since November 2025. Each trip lasted 18 to 24 days and followed the same route through the Luzon Strait past Japan. Before 2024, the vessel worked mostly in the South China Sea. Returning to the same cable corridor every six to twelve months builds a multi-year record of the seabed and water conditions over these cables, which is the data needed to locate and reach them. A U.S. congressional commission report has warned that China is building dual-use capabilities to target transpacific cables.

A Research Vessel Spoofs Its Position Over the Luzon Strait Cables

A Chinese research vessel has been holding station in the Bashi Channel since 22 September, about 38 nm northwest of Itbayat, Batanes, inside the Philippine EEZ, while its AIS reports it somewhere else entirely.

The vessel left Xiamen on 19 September and sailed south past Taiwan into the strait. Windward data shows AIS spoofing and jamming around it while it loiters in a tight box over the cable routes, its reported track jumping between false positions while the ship itself appears to stay put. Its AIS destination field reads “TOWING 1NM CABLE.” The Philippine Coast Guard says the ship’s AIS placed it off Papua New Guinea, more than 2,000 nm away, that it ignored repeated radio challenges, and that the behavior is consistent with an unauthorized seabed survey.

The loitering box sits over the cables that run through the Luzon Strait: SEA-ME-WE 3, the China-US Cable Network, SJC, EAC-C2C, APCN-2 and the FLAG North Asia Loop, all of which also land in mainland China or Hong Kong. The same corridor carries cables that do not touch China at all: the TPU Taiwan–Philippines–U.S. system, in service since May 2026, and the planned AUG East linking Taiwan, the Philippines, Japan and Southeast Asia. Disrupting those would not affect Chinese traffic.

A vessel holding position over cable routes, concealing its location, and reporting a destination that reads like towed survey gear is consistent with seabed survey work, not transit or routine research. It fits a wider pattern of Chinese research-vessel activity around Taiwan since June, including operations near Taiwan’s undersea cables.

Windward’s MIOC fused AIS, spoofing and jamming detections, and cable-route data to place the vessel where its AIS said it was not. That is the purpose of all-source operational intelligence: establishing the actual position when the reported one is false.

Two Vessels Hold Position Over the Bab el-Mandeb Cable Corridor

An Antigua and Barbuda-flagged bulk carrier has been loitering at the Gulf of Aden approach to Bab el-Mandeb since September 16, off the coast of Djibouti above the India Europe Xpress, AAE-1 and SeaMeWe-5 cables, for more than eight days with no port call, ship-to-ship transfer or cargo activity. It broadcasts underway using engine at under 1 knot with its destination field set to armed guards onboard. The vessel carries a Windward Russia-related compliance flag dating to January 2026 and was re-registered in July 2026 under a new name, manager, and MMSI, its fourth MMSI and third name change since 2021.

The loiter box sits on the route of three cables, one of which was cut in February 2024 when a drifting ship dragged its anchor across the southern Red Sea seabed. Anchors and fishing gear cause most cable faults worldwide. The seabed here is approximately 268 to 1,380 meters deep, too deep for normal anchoring, which fits the vessel staying under power, but the shallower parts are within reach of a bulk carrier’s full anchor chain. Cables are usually buried only down to 1,000 to 1,500 meters, and below that lie exposed on the seabed. A recently re-registered, Russia-linked bulker holding position over this ground for over a week with no commercial activity has no clear reason to be there, and a single anchor let go in the shallower sections would be the same mechanism that cut cables in the area in 2024.

A second vessel, using the identity of a St Kitts and Nevis-flagged container ship reported dead since 2020, appeared on AIS on July 24 as it left Hodeidah, the Houthi-held port in Yemen. It called at Hodeidah twice more, between July 27 and 29 and between August 8 and 13. Since August 14, it has been spoofing its position, broadcasting a looping track in a tight box just off Djibouti directly over where AAE-1, SeaMeWe-5 and IEX approach their landing points. Across those 41 days, it has made no port calls and done no cargo work, with more than 20 AIS gaps, including a 40.5-hour dark period between September 8 and 10.

This comes as Iran has weighed attacks on Gulf undersea cables, while the Houthis have taken Mocha and islands near Bab el-Mandeb and have reportedly threatened to harm underwater telecommunications cables in the region over the past two years. A zombie vessel reappearing out of Hodeidah and then spoofing its location over one of the region’s main cable landing points for six weeks has no clear commercial explanation, and its Hodeidah origin points to a possible Houthi link.

Matching Loiters Over the Pipelines Feeding Britain’s Main Gas Terminal

Two crude tankers under UK and EU Russia sanctions, one Chinese-owned and one commercially controlled by a Russian state shipping company since July 12, 2026, loaded at Primorsk a day apart between September 16 and 18 and both declared Port Said as their destination.

What a 25-Day AIS Blackout Off Libya Tells Us About Mediterranean Narcotics Routes

What’s inside?

At a Glance

- A Mali-flagged general cargo vessel went dark for 25 days off eastern Libya between August 28 and September 23, 2026.

- The vessel sailed from an Albanian port declaring Egypt, went dark in open water, reappeared at nearly the same position, and returned directly to Albania.

- The vessel reflagged to Mali in June 2026 after a renaming and prior identity changes, and Mali has informed the IMO that vessels are fraudulently broadcasting its flag, removing effective flag-state oversight.

- The operational footprint links Albania, a leading European narcotics consolidation hub, to a North African coast heavily exploited for illicit ship-to-ship transfers, fuel smuggling, and arms trafficking.

- The dark period covers waters transited by livestock carriers arriving from South America, creating opportunity for an at-sea drop-off or pick-up while the vessel was untracked.

The 25-Day Gap Between Albania and Libya

In late August 2026, a Mali-flagged general cargo vessel left an Albanian port, declared Egypt as its destination, and switched off its AIS transponder in open water off eastern Libya. For 25 days and 8 hours, nothing was transmitted. When it reappeared on September 23, it was at nearly the same position where it had gone dark. It immediately changed its declared destination back to Albania and sailed directly there.

None of that is impossible to explain. AIS gaps happen, destinations can change, and vessels do turn around in the Mediterranean.

What is harder to explain is all of it, together, on a vessel whose profile reads as the operational signature of a transshipment platform rather than a cargo ship running late. The Albanian base port, the recent reflag to a flag of no effective oversight, and the prior dark periods off Egypt all point in the same direction.

Deliberate and Repeating Dark Activity

The vessel reported normally right up to the moment it switched off, and again immediately after it reappeared. There is no coverage gap on either side of the dark activity. The dark period is assessed as deliberate.

It was also singular. During the 25-day window, the vessel was the only ship in the surrounding area to go dark. If equipment failure or regional interference were the cause, other vessels transiting the same waters would be expected to show matching signatures. None did.

In addition, it was not a first-time behavior. The same vessel went dark twice off Egypt’s northern Sinai coast in March 2026. What happened off Libya in late August was consistent with a pattern the vessel had been establishing for months.

A Flag That No One Is Watching

The vessel reflagged to Mali in June 2026, following a renaming and a series of prior identity changes. On paper, that provides a flag state. In practice, it does not.

Mali has informed the IMO that vessels are fraudulently broadcasting its flag. The registration cannot be taken as a genuine flag state providing oversight. For any vessel operating in a maritime corridor where flag-state inspection is one of the few enforcement levers available to port authorities, a flag that no sovereign is actively administering is a signal, not a technicality.

Repeated identity changes compound the effect. A vessel that cycles through names, broadcast identifiers, and now a flag with no oversight behind it is a vessel whose documented identity has been built to resist persistence-based screening.

The Two Ends of the Voyage

The two ends of the voyage matter as much as the dark period in between.

Albania has emerged in recent years as a leading European narcotics hub and consolidation point. Powerful domestic organized crime groups control trans-Atlantic and trans-Mediterranean cocaine and heroin routes through the country. A vessel whose operating base is in Albania, with long port stays between voyages, is operating from the center of that network rather than the edge of it.

The waters off eastern Libya are the other half of the geography. The area is heavily exploited for illicit ship-to-ship transfers, fuel smuggling, and arms trafficking. The specific stretch where this vessel went dark is also transited by livestock carriers arriving from South America. For 25 days, a vessel with a documented pattern of deliberate dark periods was positioned in waters where South American livestock traffic passes through.

No at-sea encounter or cargo transfer has been observed. No satellite imagery is currently held for the dark window. What is known is the geometry of the operation.

What One Voyage Says About Mediterranean Narcotics Routes

What makes this case worth attention is not the single dark activity, but the repeatability built into it.

A vessel that returns consistently to the same Albanian base, under a flag with no oversight behind it, with a documented history of going dark off the same coasts, is a vessel whose operational pattern can be run again. The March 2026 Sinai gaps and the August–September Libya gap are consistent with a methodology, not an improvisation.

For interdiction and compliance stakeholders tracking Mediterranean narcotics routes, the question is not whether this specific voyage carried something. The question is how many vessels operating out of Albanian ports fit the same behavioral profile — recent reflag to a problem registry, documented identity changes, repeat dark periods along North African coasts — and whether that fleet-level pattern is visible before an interdiction opportunity closes.

The vessel that vanished for 25 days off Libya may be one example of a wider operational practice. Behavioral intelligence is the layer that turns one suspicious voyage into a fleet-level pattern before the next interdiction opportunity closes.

Written by Maya Romi, Windward Senior Maritime Intelligence Content Manager. Analysis by Windward’s MIOC team.

War-Diverted Traffic Is Reshaping NEOM’s Port. What Happens If Hormuz Reopens?

What’s inside?

At a Glance

- RoRo vessel calls at the Port of NEOM have climbed from a pre-war average of 17 per month to 30 in September 2026, almost all on the Safaga shuttle route, approximately 70% above the pre-war baseline.

- Bulk carrier calls rose from 1 in October–April to 25 between May and September, with ships of mostly 52,000-82,000 DWT frequently staying for weeks.

- Container calls have decreased. 7 in five months before the war, only two between March and July, and none since mid-July.

- Saudi-flagged port-service vessels went dark over a four-day window in late July 2026, with pilot boats and tugs ceasing AIS transmission between 20 and 23 July.

- Netherlands- and France-flagged construction and dredging vessels departed after Boskalis completed the port’s channel works in early March 2026, with monthly calls falling from a peak of 69 in November 2025 to under 10 across every month since.

A Port Not Behaving Like the Megacity It Was Built For

By any reasonable metric, 2026 should have been a difficult year for the Port of NEOM. The megacity it was built to serve has been through a visible contraction. The Public Investment Fund wrote down the giga-projects by $8 billion at the end of 2024 and ordered spending cuts of more than 20%. The Line was paused in September 2025 and later deprioritized beyond 2030. In early October 2026, the $2.5 billion NEOM Stadium planned for the 2034 World Cup was shelved. Each cancellation reduces the construction demand that was supposed to drive the port’s traffic.

Yet the port’s traffic is up. Not slightly up, but significantly, and across the vessel categories you would least expect given the megacity’s contraction.

The explanation is not NEOM itself. The explanation is the war.

What the War Did to Red Sea and Gulf Shipping

On 28 February 2026, the conflict in the Red Sea and Gulf escalated into direct targeting of commercial shipping across the broader Saudi coast. Houthi declarations that Saudi shipping was a legitimate target followed, with the explicit 20 July 2026 declaration announcing a campaign against Saudi-affiliated vessels.

The response from commercial shipping was predictable. Routes diverted. Saudi Arabia’s Gulf-coast ports, including Dammam and Jubail, were cut off from normal routes, and cargo shifted west to the Red Sea. Saudi Red Sea exports increased from 29.6M tons to 54.8M tons year on year in April–May, while Gulf cargo fell by 41.2M tons. Vessels that could not viably reach their original destinations needed alternative discharge points.

The Port of NEOM, geographically positioned at the northern end of the Red Sea near the mouth of the Gulf of Aqaba, became one of those alternatives.

The Three Shifts in NEOM’s Traffic Profile

What Windward’s data shows is not a single category of displaced traffic, but three distinct shifts, each with a different operational signature.

RoRo Calls Climbed 70% Above Pre-War Baseline

Monthly RoRo vessel calls at the Port of NEOM averaged 17 before the war. In September 2026, they reached 30. Almost all of the increase runs on the Safaga shuttle route, connecting NEOM with Safaga across the Red Sea on the Egyptian coast. The increase likely reflects the corridor NEOM launched with Pan Marine and DFDS in April 2026, which pairs the Safaga ferry with trucking onwards to Gulf markets, giving cargo a route that avoids both Hormuz and Bab el-Mandeb.

Bulk Carrier Calls Went From 1 to 25

The pre-war bulk carrier picture at NEOM was nearly non-existent. Between October 2025 and April 2026, the Port of NEOM recorded a single bulk carrier call. Between May and September 2026, it recorded 25, peaking at 9 in September. The vessels calling NEOM are mostly in the 52,000–82,000 DWT range — handysize to Kamsarmax bulkers, most of the supramax and ultramax size, moving dry commodities — and many are staying for weeks.

The extended port stays matter. Most of these ships arrive from the Black Sea, Turkey, and Asia, then leave for Indian ports, suggesting they are likely discharging cargo at NEOM that would have otherwise gone to Saudi Arabia’s Gulf ports. These multi-week stays indicate a slow discharge, so a vessel that lingers for weeks after arrival is not using NEOM as a destination of choice — it is using NEOM as a safer location to hold cargo while route decisions are worked out further downstream.

Container Calls Disappeared

In the five months before the war began, the Port of NEOM recorded seven container calls, mostly regional feeders linking it with Aqaba, King Abdullah, and Jeddah. Between March and July 2026, only two container calls were recorded. Since mid-July 2026, container calls have been zero.

Until NEOM’s new container terminal opens, container cargo diverting across Saudi Arabia will likely flow via Jeddah and King Abdullah, where MSC launched a land-bridge service in May. This will likely shift after NEOM’s terminal opens by the end of 2026 and ramps up through 2027.

The Service Fleet Tells Its Own Story

Two secondary data signatures from the Windward dataset add important context to the main picture.

The first is the Saudi-flagged port-service vessel pattern. Through late 2025 and into mid-2026, Saudi pilot boats and tugs operating in the NEOM port area logged between 42 and 155 calls a month, averaging about 80, before this traffic went dark between 20 and 23 July. Following this period, August and September 2026 showed zero Saudi-flagged service-vessel calls. The four-day cessation window is consistent with a deliberate operational decision to stop AIS broadcasting rather than a gradual decline, likely in response to the escalating targeting environment.

The second is the departure of the Netherlands-flagged construction and dredging fleet. These service vessels peaked at 69 calls in November 2025 and held at 42–44 a month through February 2026. In March, as Boskalis completed its channeling contract, calls dropped to 4, and they have stayed under 10 a month since.

Together, these two signatures tell a specific story. The port’s main channel works concluded in early March 2026. The Saudi port-service vessels that support commercial operations stopped broadcasting their positions as the security environment deteriorated, while the ships they supported kept calling. Moving through infrastructure that was built out just before the construction fleet departed and the pilot boats stopped transmitting, war-diverted commercial traffic is contributing to the port’s recent growth

Two Scenarios for What Comes Next

Much of the recent growth at the Port of NEOM depends almost entirely on the war continuing to disrupt alternative Red Sea and Gulf shipping routes. When that disruption ends, the port’s traffic will respond. Two scenarios appear operationally plausible from the current data.

If Hormuz Transits Recover

If Gulf shipping routes widen and Hormuz transits approach anything near pre-war levels, bulk calls at the Port of NEOM are likely to fall first. The vessels discharging diverted cargo at NEOM will have less commercial reason to continue doing so once their intended discharge ports become accessible. RoRo traffic would likely settle back toward its pre-war baseline of approximately 17 calls per month rather than disappearing entirely, since the Safaga shuttle has an underlying trade logic independent of the war.

Under this scenario, the port’s current September traffic profile is a wartime peak that will decline rather than a new baseline.

If Transits Remain Low

If the current security environment persists through the end of 2026 and into 2027, bulk calls are likely to continue climbing past September’s figure of 9. Container carriers may begin testing calls as the port’s new Terminal 1 ramps up through 2027 after its expected opening by the end of 2026, particularly if the operational calculus of calling at the Port of NEOM becomes favorable relative to the risk environment at other Red Sea or Gulf ports.

Under this scenario, the war-diverted traffic becomes the port’s actual customer base, and the port’s commercial identity will see an eventual shift from “logistical convenience” to “security-essential corridor”.

What This Means for Red Sea Shipping Intelligence

The Port of NEOM story is a reminder that major port traffic can shift substantially in months, not years, when the regional security environment changes. The September 2026 picture at NEOM does not look like the port’s projected plan described a year ago, and the next twelve months are likely to look different again.

For analysts tracking Red Sea and Gulf shipping, the Port of NEOM is now a leading indicator of regional route decisions. When bulk calls at NEOM fall, it signals confidence returning to Gulf transits. When they rise, it signals the opposite. When container carriers finally test calls, it signals that at least one segment of global shipping has made its risk assessment of the current environment and found the port workable.

What makes any of this visible is the ability to track port-call activity, vessel classes, flag populations, and length-of-stay patterns at polygon-level resolution over time. The service-vessel going-dark pattern, the construction-fleet departure signature, and the three traffic categories moving in different directions are observable only through continuous, multi-source monitoring at the port level.

Analysis by Zane Amundsen, Windward MIOC Middle East Desk Lead. Reviewed by Matthew Mueller, Windward MIOC U.S. Team Lead

Trending

- The EU’s 18th Sanctions Package Lookback Started. Trading Russian Products? You're At Risk. Nov 24, 2025

- Tanker Freight Rates Hit Five-Year High Amid Russian Oil Sanctions Shake-Out Nov 6, 2025

- Sanctioned, Stateless, and Still Sailing: Expert Insights from the Frontlines of Maritime Sanctions Nov 3, 2025

Tanker Attacks Spread Beyond the Strait of Hormuz as Gulf Freight Costs Soar

What’s inside?

At a Glance

- A tanker struck by multiple projectiles off Qatar on October 7 marks the first attack outside the Strait of Hormuz since September 9.

- UKMTO has reported 16 attacks on ships in the Middle East Gulf in 10 days, and all 12 vessels Windward confirmed were transiting dark through the U.S. military-assisted southern corridor.

- National oil companies are paying tankers $50 million per transit and offering discounts of $35 per barrel off the official sale price to secure sales.

- The Saudi Arabia to China VLCC rate has passed $1.3 million per day, pushing freight above 25-30% of the cost of Gulf crude compared with 1-3% in normal market conditions.

- Risk is spreading to GCC ports and anchorages, with tankers reportedly turning around mid-transit after being hailed by the IRGC.

A Tanker Is Struck Off Qatar as Gulf Attacks Surge

An unnamed tanker was struck by multiple projectiles 51 nautical miles off Madinat ash Shamal, Qatar, according to an October 7 report from UK Maritime Trade Operations.

UKMTO has reported 16 attacks on ships in the Middle East Gulf in the past 10 days, and this is the first outside the Strait of Hormuz since September 9.

Windward has identified and confirmed 12 of the vessels, noting all were using the U.S. military-assisted southern corridor and transiting dark, and 11 were tankers.

National Oil Companies Pay Unprecedented Sums to Keep Crude Moving

Maritime security is now at its most perilous in the region since the early days of the conflict, lifting freight costs to unprecedented levels and driving steep discounts on oil prices offered by national oil companies in order to secure sales.

National oil companies are paying tankers $50 million per transit to ship crude to ship-to-ship transfer areas off Fujairah and Oman, with discounts now at $35/barrel of the OSP (official sale price), Windward has been told.

The benchmark rate to ship crude on a VLCC to China from Saudi Arabia has surpassed $1.3 million per day; the Iran attacks intensify pressure on the logistics chain already under severe pressure to find tankers willing to undertake risky transits. The freight component of crude shipped from the Middle East Gulf now exceeds 25-30% of the cost of the commodity. In normal market conditions, this is between 1-3%.

Attacks Push Risk Into GCC Ports and Anchorages

The latest attack now extends and accelerates risk at GCC ports and anchorage areas where tankers are loading oil and gas for coordinated transits through the southern corridor. The last attack outside the Hormuz area was a Greek-owned very large crude carrier, struck in Iraqi waters on September 9.

One attack reported on October 6 (ON PEACE, IMO 9893204) injured 12 Indian seafarers.

There are now reports of tankers turning around mid-transit after being hailed by the Iranian Revolutionary Guard Corps.

In early September, U.S. CENTCOM disabled or destroyed eight Iran-trading tankers in what was attributed to a “tanker for tanker” policy on Iran in response to strikes on ships using the southern corridor.

Written by Michelle Weise Bockmann, Windward Senior Maritime Intelligence Analyst.

Security Worries Reshape Russia’s September Oil Exports

What’s inside?

At a Glance

- Russia shipped 142.7 million barrels of crude and oil products in September, with crude holding steady at about 3.7 million barrels per day.

- No cargo was loaded on falsely flagged tankers for the third consecutive month, as tankers shifted to other flags and record numbers moved to the Russian flag.

- Sanctioned vessels carried 55% of all Russian oil and 63% of the crude, while EU-owned tankers carried 22%.

- EU-owned loadings fell 46% between the first and second halves of September, and nine in ten EU-owned barrels were loaded at Baltic ports.

- All Russian crude from Novorossiysk’s Sheskharis terminal moved on sanctioned ships as EU-owned tankers pulled back from the Black Sea.

- 33 cargoes totaling 11.6 million barrels went through at least one ship-to-ship transfer, and none of the five VLCCs carrying Russian crude loaded directly at a Russian terminal.

- Russia now flags 46 of the 101 sanctioned tankers tracked.

Russia Holds Crude Exports Steady as Falsely Flagged Tankers Disappear

Russia shipped 142.7 million barrels of crude, clean petroleum products (CPP) in September, according to Windward analysis using Vortexa data. Crude made up 110.4 million barrels, a pace of some 3.7 million barrels per day, broadly level with the prior month, which the IEA reported as 3.78 million bpd. CPP accounted for 14.9 million barrels, mostly naphtha (9.8 million), plus 17.4 million barrels of fuel oil and feedstocks.

For the third consecutive month, no cargo was loaded on falsely flagged tankers, confirming that Russia has discontinued their use. Tankers have shifted to other flags, with record numbers moving to Russia over the third quarter in what is one of the most significant developments seen for the shadow fleet since early 2023.

Sanctioned Tankers Carry More Than Half of Russia’s Oil

Sanctioned vessels carried 78 million barrels, 55% of the total, and 63% of the crude. EU-owned tankers carried 31.5 million barrels, which is 22%, and the remaining 23% moved on unsanctioned shadow fleet or other tonnage. The split varies sharply by product: EU-owned ships carried 57% of fuel oil and 41% of CPP, but only 14% of crude. This reflects the higher price of Urals, which is well above the $44.10 EU and UK price cap level.

EU-Owned Tankers Retreat to the Baltic and Pull Back Through September

Nine in ten EU-owned barrels (28.8 million of 31.5 million) were loaded at Baltic ports, including Primorsk, Ust-Luga, St. Petersburg and Vysotsk. There, EU-owned ships carried 37% of everything lifted. Elsewhere they barely featured, with 3% of Far East volumes and nothing on Arctic crude.

EU-owned loadings also fell through the month, from 20.5 million barrels in September 1–15 to 11.1 million in September 16–30, a drop of 46%. The steepest fall was in clean products, from 5.2 million to 1.0 million barrels, reflecting the ongoing export ban on gasoline and diesel following Ukraine attacks on refineries. On Baltic crude, dark-fleet volumes rose from 3.6 million to 5.6 million barrels in the second two weeks as EU-owned volumes fell.

Russia banned exports of gasoline in April, and introduced the first-ever bans on jet fuel in mid-June, with diesel following in mid-July and extended to September 30. Russia previously exported about half its diesel and gasoil, according to the IEA.

Sanctioned Ships Take Over Russia’s Black Sea Crude

68% of the 7.4 million barrels of Russian oil lifted from the Black Sea was on sanctioned tankers. All 4.3 million barrels of Russian crude, Urals and Siberian Light from Novorossiysk’s Sheskharis terminal, moved on sanctioned ships.

EU-owned tankers carried only diesel, with 1.2 million barrels in six cargoes on five medium-range tankers. None of them loaded after September 12, and later diesel cargoes went to sanctioned vessels. The deteriorating security in the area is seeing fewer EU-owned tankers willing to work in the area.

Sanctioned Tonnage Dominates Arctic and Far East Loadings

Arctic crude moves almost entirely on sanctioned tonnage, which carried 84% of Murmansk crude loadings. In the Far East, sanctioned ships carried 61% and unsanctioned shadow fleet tankers 32%. In Kozmino, 30 tankers loaded 33.4 million barrels of ESPO crude, most delivered to China.

Ship-to-Ship Transfers Obscure the Trail of 11.6 Million Barrels

Nakhodka Bay handled 8.7 million barrels via ship-to-ship transfer. Every barrel of Sokol crude loaded at De-Kastri (5.7 million) was transferred there. Two shuttle tankers owned by Sovcomflot handed cargoes to larger ships.

Port Said handled 2.3 million barrels, including almost half of the Russian crude loaded at Novorossiysk. Ceuta saw small naphtha parcels go through as many as three transfers, which makes their origin harder to trace.

33 September cargoes, totaling 11.6 million barrels, went through at least one ship-to-ship transfer.

Five VLCCs Load Russian Crude Without Calling at a Russian Terminal

Five VLCCs carried 8.5 million barrels of Russian crude, and none of them loaded directly at a Russian terminal. Four of the five, carrying 85% of the VLCC volume, are shadow fleet tankers that have not been sanctioned.

Russia Flags a Growing Share of the Sanctioned Fleet

The sanctioned fleet is increasingly Russian-flagged. Russia flags 46 of the 101 sanctioned tankers tracked.

55% of all Russian oil loaded in September went on sanctioned ships, totalling 78.0 million bbl. Meanwhile, 43% of that sanctioned volume was on Russian-flagged ships, making up 33.4 million bbl.

Sierra Leone, Cameroon, Oman, and Equatorial Guinea flagged most of the rest.

Written by Michelle Weise Bockmann, Windward MIOC Senior Maritime Intelligence Analyst.

Trending

- The EU’s 18th Sanctions Package Lookback Started. Trading Russian Products? You're At Risk. Nov 24, 2025

- Tanker Freight Rates Hit Five-Year High Amid Russian Oil Sanctions Shake-Out Nov 6, 2025

- Sanctioned, Stateless, and Still Sailing: Expert Insights from the Frontlines of Maritime Sanctions Nov 3, 2025

Undersea Cable Security in the Indo-Pacific Starts With Vessel Behavior

What’s inside?

At a Glance

- Hawaii and Guam concentrate Pacific undersea cable risk, and Honolulu sits directly on that infrastructure.

- Most cable faults are accidental, so a damaged cable alone says little about intent.

- Behavioral history is what separates routine traffic near a cable route from activity that warrants attention.

- With few specialist repair ships in the region, early warning is the most practical form of undersea cable security.

- All-source intelligence gives decision-makers the picture before the fault.

Undersea Cable Security in the Pacific Runs Through Hawaii and Guam

Undersea cable security in the Indo-Pacific comes down to a handful of islands. Hawaii and Guam anchor the trans-Pacific links that connect the continental U.S. to its forces, allies, and partners across the theater. Honolulu itself sits on that infrastructure.

The exposure is measurable. In Q1 2026, Windward recorded 27 slow-speed service and research vessel events near cable routes around Hawaii and 5 around Guam and the Northern Marianas, in a U.S.-connected cable region where research and survey vessels made up 13.4% of activity. A September 2026 report for the U.S.-China Economic and Security Review Commission found that continental U.S. connections to Hawaii and Guam are particularly vulnerable to gray-zone sabotage, with few redundancy options.

None of those events proves hostile intent. What they show is where to look. Cable protection is decided long before a fault, by knowing which vessels are doing what near the cable route. That takes intelligence, not tracking alone.

Pacific Cable Hubs Concentrate Risk in a Few Places

Geography makes the Pacific cable network efficient and fragile at the same time. Hawaii and Guam host landings for trans-Pacific systems linking the continental U.S. with Asia, and a report found that the continental U.S. connections to both have few redundancy options.

Guam shows the pattern in miniature. The island was the landing point for 11 subsea cables as of 2023, and every landing site sat on its western coast. Clustering keeps costs down for operators. It also means one incident in the shallow approaches to those landings can touch several systems at once.

The U.S.-China Economic and Security Review Commission report modeled what that concentration means for capacity. Disruption to even a single cable could overwhelm available capacity on direct routes between the U.S., Taiwan, Japan, and the Philippines, forcing traffic onto slower and less direct paths. Several cables cut together could overwhelm trans-Pacific capacity as a whole.

For a joint force that relies on those links for command and control, logistics, and coalition coordination, that is an operational problem, not a telecom one.

Most Damage Is Accidental, Which Makes Intent Hard to Read

Most undersea cable damage has nothing to do with sabotage. A March 2026 CSIS analysis of Indo-Pacific cable frameworks notes that the majority of faults come from natural disasters, fishing, and genuine maritime accidents. Windward’s Q1 2026 Undersea Cables Risk Report reaches the same conclusion from vessel data, ranking trawlers as the highest-priority accidental damage risk because their steel ground gear and weighted otter boards can snag, drag, or sever a cable.

That baseline is exactly what makes intent hard to read. CSIS points out that a deliberate cut is low probability but high impact, and that the sheer volume of accidental damage gives a malicious actor plausible deniability. A sabotage event can hide inside the statistics.

Taiwan shows how this plays out. In February 2025, Taiwan’s coast guard detained HONG TAI 58, a Togo-flagged cargo vessel with a Chinese crew, after a cable to the Penghu Islands was disconnected near where the ship had dropped anchor. Prosecutors charged its captain in April 2025.

By then, Taiwan had reported five cases of seabed cable damage in 2025, compared with three in each of 2023 and 2024. That same month, INDOPACOM commander Adm. Samuel Paparo acknowledged to lawmakers that there had been attempts to sabotage undersea cables, particularly around Taiwan.

The takeaway for undersea cable protection is that the fault itself is weak evidence. An anchor drag looks the same on the seabed whether it came from negligence or a decision. What differs is everything the vessel did before it reached the cable.

Vessel Behavior Separates Routine Traffic From Cable Risk

Not every vessel near a cable route is a concern, and treating them all the same buries the signal. Windward’s cable reporting separates two categories of risk that can show up on the same stretch of seabed.

The first is slow-speed activity by service and research vessels, defined as holding slow speed for more than an hour near a known cable route. Some of it is legitimate repair, survey, or scientific work. It warrants closer scrutiny when the vessel is flagged to, operated by, or affiliated with a state of concern, or sails under a flag of convenience that obscures ownership, and especially when that combines with repeated activity or extended presence. The second is fishing and trawling, where the risk is physical and usually accidental.

The Pacific shows why the distinction matters. In Q1 2026, the region logged only 19 state-of-concern service vessel events, all Chinese or Russian, yet 20% of its cable-proximate activity lasted longer than 24 hours, the highest extended-presence rate of any region. On the fishing side, the Pacific recorded just 12 trawler events. More than half of Pacific fishing activity, 54.4%, came from Chinese-flagged vessels operating around Kiribati, the Solomon Islands, and Fiji, all of which host landing stations tied to U.S. Pacific communications.

A single position report cannot tell these patterns apart. A survey vessel at four knots and a fishing vessel at four knots look the same in one snapshot. The difference shows up over time.

A recent case near Guam shows what that looks like. From August 31 to approximately September 20, 2026, a Chinese-flagged fishery patrol vessel ran a grid east of Guam between the Bulikula and SEA-US cables. After crossing the Guam and CNMI EEZ from September 20 to 22, it started a second grid west of Guam in the Philippine Sea, still running as of September 29. On September 13, it met a Cook Islands-flagged tanker for about six hours, likely to refuel, which let it stay at sea. Its AIS stayed on throughout.

Read as a string of position reports, this is a fishery patrol vessel at sea. Read against its behavioral history, the picture changes. This was the first time the vessel had done this kind of activity in the region, since it usually operates around China and occasionally in the Indian Ocean. Its north-to-south legs and repeated slow-speed stops match a survey pattern, not a patrol or a transit. Windward analysts assessed the activity as consistent with possible mapping of the seabed and cables around Guam. That is a risk indicator worth tracking, not proof of intent.

Behavioral history lets an analyst read a vessel’s activity against its own past and the past of its ownership network. None of these indicators proves intent. Each one tells a watch floor where to point the next sensor.

Thin Repair Capacity Makes Early Warning the Real Defense

Repair is the slowest part of undersea cable protection. A May 2025 RSIS commentary, citing the International Cable Protection Committee, counts just 16 specialist repair vessels based in the Indo-Pacific. Around 200 cable faults occur worldwide each year, and roughly two-thirds of them are caused by ships. The same commentary notes that a 2024 repair to the SEA-ME-WE 5 cable was held up for two months by permitting rules alone.

The fleet is not growing to match demand. CSIS counts 62 vessels globally that lay and maintain cables, only 19 of them contracted for maintenance, and notes that new cable ships are not entering service as fast as old ones retire. The forecasts it cites expect cables in the Southwest Pacific to need 141 repairs in 2040, nearly half of all faults worldwide. The USCC report describes global repair fleets as aging and thinly stretched.

The arithmetic points one way. When a fault can take weeks to clear and the ships that clear it are shared across an ocean basin, the most useful defense is knowing which vessels are working near the route before anything breaks. Adm. Paparo made a similar point in his April 2025 testimony, naming intelligence that gets inside an adversary’s targeting chain, and the presence that follows it, as the first countermeasure to cable sabotage.

All-Source Operational Intelligence Gives Decision-Makers the Picture Before the Fault

Tracking tells you where a vessel is. Intelligence tells you what it is doing and whether that should change your next decision. Undersea cable security depends on the second.

AIS alone cannot carry that load. It is self-reported, it can be switched off, and vessel identities can be manipulated. Windward’s Q3 2026 Maritime Risk Report shows how far that has gone. The IMO’s list of falsely flagged ships reached 613 by the end of September, up 39% since January, and 84 dark fleet tankers changed MMSI numbers to reflag to Russia in a single quarter.

The broadcast picture also misses whole streams of traffic. In the Strait of Hormuz, Windward estimates that 52% of September transits were invisible to AIS and satellite observation, measured as the gap between UKMTO’s total count and visible traffic.

If half of a chokepoint’s traffic can drop out of view, so can a single vessel working slowly over a cable. All-source operational intelligence closes that gap by fusing AIS with SAR and EO satellite imagery, RF detection, and years of behavioral history, as well as any other source that sharpens the picture. Every vessel is then read against its ownership network and the cable routes beneath it.

Trade Data vs. Maritime Intelligence: What Customs Agencies Actually Need

What’s inside?

At a Glance

- Trade data was built to answer commercial questions about flows, volumes, and counterparties, not enforcement questions about concealment.

- The vessel a customs agency needs to stop is the one that declared inaccurately and transmitted dishonestly, which is precisely the vessel both trade data and AIS describe least well.

- Satellite imagery, RF, behavioral analytics, and ownership resolution are generated independently of what a vessel or operator chooses to declare.

- Container targeting is where the gap is sharpest, because a clean declaration says nothing about the three voyage legs that preceded it.

- The test for any enforcement data source is what it still shows when the vessel switches off.

Trade Data Was Built for Commercial Visibility

Cargo manifests, customs declarations, shipping records, and import and export filings exist to describe commerce. They do that well.

How much crude moved through Yanbu last month? Which companies are shipping dry bulk into Rotterdam? What do the dominant trade flows look like across the Red Sea corridor this quarter? These are real questions with real answers, and the platforms built to answer them serve commodity traders, banks, and supply chain managers properly.

Those are not the questions customs enforcement asks.

Enforcement Asks a Different Set of Questions

Which of the 15,000 containers arriving at this port today holds something that was not declared? Which vessel took a detour through a sanctioned port before arriving here? Which manifest is fraudulent? Which operator has a behavioral history that signals concealment?

Trade data does not answer any of these, and the reason is structural rather than a matter of coverage or refresh rate. Trade data is a record of what parties declared. The enforcement problem begins at the point where the declaration stops being true.

AIS does not close the gap either. A vessel running dark produces no AIS record to check. A vessel broadcasting manipulated positions produces a record that is worse than nothing, because it looks complete. In both cases, the vessel most worth examining is the one generating the least usable data.

That is the shape of the enforcement problem. The subject of the investigation controls the inputs.

Intelligence Starts Where Declarations Stop

All-source maritime intelligence fuses the layers that exist independently of what a vessel or operator chooses to declare.

EO and SAR satellite imagery sees a vessel whether or not it is transmitting. SAR works through cloud and darkness, so coverage does not depend on conditions. RF detection identifies a vessel’s emissions signature when AIS is off, because a ship running dark is still operating equipment that radiates.

Behavioral analytics built on years of vessel activity flag deviations no single manifest could reveal. A route that does not match the stated voyage. A loitering pattern in a corridor associated with transfer activity. A dark period that begins and ends in places that make the gap itself the signal.

Ownership and entity resolution surfaces the beneficial owner behind layers of flag hopping and shell structures, which is how an operator with a history of concealment appears as the same operator rather than as a new company with a clean record.

Fused, these produce an intelligence picture rather than a data feed. The distinction matters operationally. A feed tells an officer what was reported. A picture tells them what happened, with enough specificity to justify an inspection.

Container Targeting Shows the Gap Most Clearly

Container targeting is the sharpest illustration.

Trade data can tell you that a container is declared as machine parts from a legitimate exporter with a clean filing history. Every field checks out. On a declaration-based targeting model, it ranks low and passes.

When UK authorities seized roughly $100 million of cocaine from a container ship at London Gateway, the public reporting named almost nothing. A container vessel, a Panama port call, a June arrival. Those three details were enough to run a search, returning three vessels that matched the profile during the relevant window. One carried a documented history, surfaced automatically through adverse media screening, of a 2016 case in which approximately 200 pounds of cocaine were found concealed in a container loaded at Santos.

The routing is the part a declaration cannot show. Panama in early June, across the Atlantic, Antwerp on June 21, Rotterdam on June 23, London Gateway on June 25, then onward to Germany. Each leg generated its own paperwork, and each set of paperwork was accurate. The shape of the voyage, and the vessel’s own history, are what carried the signal.

All-source intelligence can tell you that the vessel carrying it called at a sanctioned port three legs ago with AIS switched off, that the declared exporter shares ownership infrastructure with entities already under sanctions, and that the vessel’s behavioral pattern in the week before loading matches a known concealment sequence.

None of that is visible in the declaration. All of it is available before arrival.

That is the difference between a declaration and an intelligence product. A declaration describes an intention. An intelligence product describes a history. Customs officers allocating finite inspection capacity need the second one, because the first was written by the party they are assessing.

The timing compounds the advantage. Declarations arrive close to arrival, leaving a narrow window to act. Vessel behavior accumulates across the entire voyage, which means the risk picture can be built while the ship is still at sea.

What Do You See When the Vessel Switches Off?

That is the test, and it is worth applying to any source an agency relies on.

Trade data sees nothing. The declaration describes the leg that was filed, not the voyage that happened, and it arrives regardless of what the vessel did in between.

AIS sees nothing. That is the point of switching it off.

All-source intelligence still has a picture. Satellite detection places the vessel. RF confirms it. Behavioral models read the gap itself as an indicator rather than a blank. Ownership intelligence connects the operator to everything else it controls. With all-source operational intelligence, whatever an agency needs to complete the picture comes in alongside the rest, whether that is national holdings, partner reporting, industry data, or a source specific to the mission.

Concealment is not an edge case in customs enforcement. It is the case. A targeting model that performs well on cooperative vessels and loses sight of uncooperative ones is optimized against the wrong population.

The vessels that matter most are the ones that stopped reporting. What an agency can see during those windows determines what it can stop.

Written by Maya Romi, Windward Senior Content Manager. Reviewed by Inbar Tropen, Windward Product Marketing Manager.

From Dark Voyages to Defensible Claims: How Marine Insurers Are Closing the Evidence Gap

What’s inside?

At a Glance

- Marine insurance claims teams own the loss investigation and the pay-or-reject decision, but their work now depends on forensic reconstruction of vessel activity in periods when AIS records are compromised or missing.

- The AIS record claims teams have historically relied on to establish what a vessel did before, during, and after a loss has been structurally compromised by GPS jamming, with 124,235 vessels affected globally in Q3 2026 and more than 3.35 million false ship-to-ship meetings recorded since Operation Epic Fury began.

- More than half of September 2026 Hormuz transits were dark convoy passages, meaning the majority of traffic through the corridor now generates no self-reported position record.

- Vessels stranded during the Hormuz closure earlier in 2026 have created a new claims environment, with constructive total loss questions, loss of hire claims, and dark period disputes all requiring reconstruction of what actually happened.

- The Court of Appeal ruling in the CATALAN SEA on May 22, 2026 clarified that the threshold for invoking sanctions clauses is a reasonable judgment of a real risk of sanctions, signaling how courts are calibrating the evidential threshold for sanctions-related decisions.

- Claims decisions based on AIS position alone are increasingly vulnerable to challenge when the AIS record operated in jamming-affected regions or included dark periods.

- All-source intelligence combines satellite imagery, radio frequency detection, behavioral intelligence, and any other source necessary to provide the sensor-verified activity record that claims investigations need to establish what a vessel actually did during a contested period.

Claims Teams Are Now Reconstructing, Not Just Investigating

Claims teams in marine insurance own two things: the loss investigation and the pay-or-reject decision. In the pre-2022 environment, both were largely a matter of establishing what happened, verifying that the loss fell within the policy’s coverage, and processing accordingly. AIS records, cargo documentation, and standard loss adjustment supported the investigation without requiring extensive forensic reconstruction.

In 2026, that has shifted. Claims investigations increasingly begin with the question of what actually happened during a defined period, because the AIS record from that period may not answer it reliably. Vessels operating in jamming-affected regions may have broadcast injected coordinates rather than actual positions. Vessels that were dark did not broadcast at all. Reconstructing the actual voyage is the analytical work claims teams now do before the pay-or-reject decision becomes possible.

Four operational realities define the environment.

1. The AIS Reliability Problem at Claims

The historical premise of AIS-based loss investigation is that AIS records reflect what vessels actually did. That premise has been under pressure since 2022 and has become materially unreliable in 2026 for specific regions and activity types.

Windward’s Q3 2026 Maritime Risk Report tracked 124,235 vessels affected by GPS jamming at least once globally, with jamming running at an average of 5,131 incidents per day across the quarter, broadly unchanged from Q2. Since Operation Epic Fury began in February 2026, Windward has recorded more than 3.35 million false ship-to-ship meetings, in which injected positioning coordinates made vessels appear to rendezvous when no meeting took place. Jamming is persistent in the Middle East Gulf, the Black Sea, the Mediterranean, and other high-exposure regions, which are exactly where marine insurance claims from the current environment concentrate.

For a claims team investigating a loss involving a vessel that operated in a jamming-affected region during the relevant period, the AIS record includes potentially injected coordinates, potentially missing intervals, and potentially false event records. A vessel that appears to have transited a specific route may have taken a different one. A vessel that appears to have made no port calls may have made calls the AIS record does not show.

The compliance evidence base that claims rely on to establish whether the vessel was engaged in sanctionable activity at the time of loss depends on this AIS record being accurate. When it is not, the compliance evidence base becomes vulnerable to challenge. When the evidence base is vulnerable, the claims decision made against it is also vulnerable.

2. The Hormuz Stranded Vessel Environment

The operational environment produced by the Hormuz closure earlier in 2026 has created a distinct claims scenario many teams are still working through.

Following the outbreak of the Iran conflict on February 28, 2026, and Operation Epic Fury the same day, vessel traffic through the Strait of Hormuz collapsed. February recorded approximately 3,750 AIS-visible monthly transits. March fell to 450. Even after a partial recovery, June remained approximately 83% below pre-conflict baselines.

Traffic briefly rebounded following the June 17 Memorandum of Understanding between Iran and the U.S. and the formal lifting of the blockade on June 18, before Iran reimposed closure on June 20 and reinstated the Persian Gulf Strait Authority toll and clearance system. Traffic has not recovered since. Windward counted 55 AIS-visible transits between September 16 and 23, approximately 94% below pre-war levels, and attacks on shipping in the corridor continued through the quarter.

For claims teams, the Hormuz situation has generated several specific claim types.

Constructive Total Loss Questions

Many war risk clauses set a 12-month detention period before a constructive total loss can be declared, with some policies operating on a 6-month period. Vessels stranded during the closure raise the question of whether extended detention in the Middle East Gulf may qualify for constructive total loss even without sustaining physical damage. Investigating these claims requires establishing the specific detention timeline, the operational conditions during the detention, and whether the vessel is genuinely constructively total loss or eventually recoverable.

Loss Of Hire Claims

Vessels unable to complete voyages during the closure have generated loss of hire claims, though not every loss of hire policy responds without physical loss or damage. Claims teams are working through the specific policy language and operational circumstances that determine whether coverage applies.

Dark Period Disputes

Many vessels transiting the Hormuz war-risk zone did so with AIS switched off, in some cases with owner and flag state consent for safety and security reasons. This is now the majority practice rather than the exception. Windward estimates that dark convoy passages accounted for 47% of Hormuz traffic in August 2026 and 52% in September. When a loss occurred during a dark period, or when the vessel’s activity during a dark period is contested by the charterer, cargo interest, or insurer, the investigation depends on reconstructing what happened during a window when the vessel was not self-reporting.

Each of these claim types requires forensic work that goes beyond AIS records.

3. The Legal Environment Is Calibrating

The English Court of Appeal ruling in Tonzip Maritime (Singapore) Pte Ltd v 2 Rivers Pte Ltd, The CATALAN SEA, handed down on May 22, 2026, clarified how courts are approaching contested contractual terms in the current environment. The Court held that the threshold for invoking sanctions clauses is a reasonable judgment of a real risk of sanctions, not proof that a breach would probably occur.

The case is a charterparty dispute, not directly an insurance case, but the ruling has implications for how sanctions clauses in insurance policies will be interpreted. The lower evidential threshold gives insurers, owners, and their counterparties more flexibility to invoke sanctions clauses to decline coverage, refuse claims, or terminate policies. It also raises the standard for the underlying evidential basis. A sanctions clause invoked under the “reasonable judgment of real risk” threshold still requires evidence sufficient to support that judgment.

For claims teams, this means the evidence base supporting a claims decision, particularly a decision to decline a claim on sanctions-related grounds, needs to be defensible in a legal environment actively calibrating the standards. A claims decision made on AIS position data from a jamming-affected region may be vulnerable to challenge if the AIS record itself is not defensible. A claims decision made on multi-sensor reconstruction that verifies actual vessel activity is materially more defensible.

The OFAC-OFSI Comparative Overview published on June 23, 2026 documents the differences between U.S. and UK sanctions frameworks across ownership calculations, terminology, jurisdictional reach, and enforcement mechanics. Claims teams operating across multiple sanctions regimes need to structure their evidence base to satisfy the more demanding standard in each regime. Both OFAC and OFSI apply strict liability for civil penalties, meaning claims decisions that inadvertently touch sanctioned activity can create enforcement exposure even without knowledge that the transaction was prohibited.

4. What Forensic Reconstruction Actually Requires

Reconstructing vessel activity during a contested period is an all-source intelligence exercise. It draws on whatever independent evidence exists for that vessel in that window, selected for what the specific question requires rather than from a fixed list of feeds. What those sources have in common is that none of them depends on the vessel’s own broadcasts.

Maritime Domain Action in the Indo-Pacific Needs One Shared All-Source Picture

What’s inside?

At a Glance

- Information advantage and allied interoperability only mean something when partners work from the same picture.

- Dark fleet activity crosses combatant command boundaries, so each partner sees only a slice of it.

- AIS shows what a vessel says about itself, not what it is doing.

- Fused intelligence shared at the insight level lets partners act on the same facts.

- A picture only gets fielded if it fits the C2 and mission network workflows teams already run.

Information Advantage Starts With a Picture Allies Can Share

Talk of information advantage and allied interoperability comes down to one practical question: Can partners act together on a trusted picture of what is moving at sea, and why?

Most do not, at least not yet. Each navy, coast guard, and agency holds its own slice, built from its own sensors and its own rules. The gaps between those slices are exactly where gray-zone shipping operates.

No Single Navy Sees the Whole Dark Fleet Route

The dark fleet does not respect command boundaries. Russia reflagged 84 dark fleet tankers to its own registry in Q3 2026, more than four times the Q2 figure, according to Windward’s Q3 2026 Maritime Risk Report. Russia now flags 223 Russian-flagged tankers, 18% of the total. One in three Aframaxes worldwide now sits in the dark fleet.

Those vessels cross theaters as a matter of routine. Iranian crude loaded in the Gulf is commonly moved ship to ship in waters off Malaysia’s Johor coast, roughly halfway between Iran and China, which buys about 90% of Iranian oil.

Malaysia’s maritime agency has said Iranian-linked tankers exploit jurisdictional gaps near its waters. One cargo can pass through CENTCOM and INDOPACOM and several national jurisdictions before it discharges, and no single partner sees the whole route.

A recent case shows how fragmented that picture gets. A UK-sanctioned LNG carrier, now owned by a single-ship company in China and reflagged from Panama to Sierra Leone in March, loaded Russian LNG at a sanctioned plant in December 2025. India refused the cargo in May. The vessel then spent months drifting and anchoring in the South China Sea and off Johor. In September it entered the Andaman Sea for the first time in Windward’s records, went dark twice near a cluster of subsea cables, and has since sailed repeated straight lines over them.

Each partner holds one fact. The UK listed the vessel. India turned the cargo away. Coastal states from Malaysia to Thailand watched it pass. Only the full history, fused across sources and jurisdictions, shows a sanctioned vessel holding its cargo for more than nine months with no commercial reason to be where it is.

Tracking Alone Cannot Tell Partners Whether to Act

AIS shows what a vessel says about itself. It does not show what the vessel is doing. Every identity field in the broadcast, from name and flag to destination, is entered by the crew or the operator.

The Q3 2026 report shows how far that self-report can drift from reality.

By the end of September, the IMO list of falsely flagged ships had reached 613, up 39% since January. In the Bab el-Mandeb, about one in three AIS-visible transits used the destination field to broadcast crew nationality or a political message instead of a port. GPS jamming affected 124,235 distinct vessels worldwide, roughly one in nine ships in the world fleet losing reliable position data at some point in the quarter.

A gray-zone decision cannot rest on that. Whether to shadow a vessel, board it, or flag it to a partner depends on who owns it, where it has actually been, what it has done before, and whether its behavior fits its declared purpose. Tracking answers none of those questions on its own.

A Shared All-Source Picture Lets Partners Act on the Same Facts

The fix is not more data passed around. It is one assessment that every partner can trust and act on.

All-source operational intelligence fuses AIS with whatever sources the mission requires. That can mean SAR and EO satellite imagery, RF detection, dark vessel detection, ownership and sanctions data, years of behavioral history, or any other source that sharpens the picture.

The output is a judgment about each vessel, not a stack of feeds. Windward’s Maritime Intelligence Operations Center (MIOC) works this way, combining sensors and sources into a single operational picture and verifying findings against open reporting.

Sharing at the insight level is what lets that picture travel. Partners do not need to exchange raw collection, sensor feeds, or methods to agree that a vessel is sanctioned, has gone dark twice near a cable corridor, and has no commercial reason to be there. They need the same assessment, with the evidence behind it. Commercial, unclassified intelligence can move between allies faster than national collection because it does not carry the same release restrictions.

When the UK, India, and the coastal states along that LNG carrier’s route all see the same history, the question changes from whether anyone noticed to who acts first.

Integration Feasibility Decides What Gets Fielded

A picture that cannot reach the people who act on it does not change outcomes. For a component CIO, the first question about any new capability is not what it shows but where it lives. Technical evaluators ask the same thing in more detail. Does it run inside the systems the command already operates, or does it need another screen, another login, and another data silo?

That test decides what gets fielded. A capability that demands rip-and-replace will usually lose to one that drops into existing C2 and mission network workflows, even if the first looks better on paper.

Windward’s intelligence is built to be consumed outside its own interface. Its API is GraphQL-based, so integrators request exactly the fields a workflow needs in a single call instead of pulling whole feeds.

Webhooks push events such as risk score changes, deceptive shipping detections, and alerts on vessels of interest straight into internal systems. Risk indicators and scores are traceable to the underlying evidence, so an assessment stays auditable after it leaves the platform. The API is also designed to sit alongside a customer’s own data, so external intelligence is correlated with what a command already holds rather than replacing it.

Questions about specific mission networks and accreditation are environment-specific, and they are the right ones to raise early with any provider.

The Handoff to Decisions Is Where Intelligence Earns Its Place

Defense planners often break the mission into three layers, written together as C5ISRT.

The handoff from ISR to a decision is where intelligence earns its place. An assessment that arrives late, sits in a separate tool, or cannot show its evidence will not survive that handoff. One that reaches the operator inside the workflow they already use, explains why a vessel matters, and is shared across partners can.

That is the line Windward draws. It provides the picture and the reasoning behind it. The decision, and anything that follows from it, belongs to the people accountable for it.

Bring the Integration Questions to Booth TB113

Maritime domain action is not a slogan. It starts with a picture partners trust, built from all-source intelligence and delivered into the systems they already run, so they can act on it together.

Windward is at TechNet Indo-Pacific through October 29 at booth TB113 in the Tapa Tower. Bring the architecture and workflow questions, and see how fused intelligence on dark fleet and gray-zone activity fits into what your command already operates. Book a meeting at the booth.

Written by Maya Romi, Windward Senior Maritime Intelligence Content Manager.