Many Iran-flagged tankers simultaneously ended a sustained period of dark activity for three days, starting October 12, only for most of the fleet to resume the deceptive shipping practice 48 hours later.

Of the 88 tankers flying the Iranian flag (most belonging to the National Iranian Tanker Company (NITC), 52 were transmitting AIS signals between October 12–14. Their reported positions spanned from Iran’s Kharg Island and the Riau Archipelago to ports near China and routes through the Singapore Strait. This marked an abrupt pause in the prolonged “dark” operations typical of many Iran-flagged vessels, which often last 30 days or more.

Notably, at least nine of NITC’s largest tankers were actively broadcasting AIS while clustered within Malaysia’s Exclusive Economic Zone (EEZ), a known hotspot for floating storage and ship-to-ship (STS) transfers of U.S.-sanctioned oil.

This simultaneous AIS resumption by NITC-owned VLCCs and other tankers across multiple regions is unprecedented.

But days later, AIS signals were visible for only 25 of the 88 ships.

The reason for this brief visibility window remains unclear, though it occurred less than three weeks after UN sanctions on Iran were reactivated under ‘snapback’ provisions. Until now, NITC tankers have been among the darkest and hardest to track, as they typically switch on their AIS briefly during key voyage segments, only when absolutely necessary. They are most often visible when crossing the Singapore Strait, before going dark near the Riau Archipelago.

During the short period of AIS activity, Iran-flagged VLCCs were observed sailing westbound through the Singapore Straight since October 12, heading for the Middle East Gulf. The coordinated action marked a significant departure from normal practice and came amid a renewed Malaysian crackdown on unregulated STS operations.

NITC tankers have long exploited the regulatory ambiguity surrounding unilateral U.S. sanctions to use the waters off eastern Malaysia for the storage and transfer of Iranian oil, as part of a complex logistics chain shipping oil to China.

There are as many as 80 dark fleet tankers in the area at any given time, many of which switch off their AIS or use location (GNSS) manipulation to obscure the destination and origin of oil cargoes.

Iranian cargoes can be shipped through four or five VLCCs via a series of STS operations off the UAE, Sohar, and Malaysia.

Windward’s Early Detection solution tracked this coordinated AIS behavior between October 12-14, revealing a rare moment of transparency in an otherwise opaque network.

Windward’s anomaly detection was the first to track the unusual AIS activities of the Iran-flagged fleet.

Of the 54 Iran-flagged tankers broadcasting AIS between October 12-15, 28 were VLCCs, the workhorses of the NITC fleet. By October 16, only nine VLCCs remained visible.