DANUBE - AIS Spoofing

The Strait of Hormuz effectively closed to commercial traffic following the start of hostilities between the USA, Israel, and Iran on 28 February 2026. AIS indicates that the flow of tankers through this critical energy chokepoint has all but stopped. However, Iranian-linked vessels continue to traverse the Strait to maintain oil exports. These vessels use a combination of AIS spoofing and other techniques to hide cargo loading points and movements through the Persian Gulf.

On 2 February 2026, the US Office of Foreign Assets Control (OFAC) sanctioned the 180m product tanker OCEAN GUARDIAN (IMO 9267948) for its links to Manarat Alkhaleej Marine Services FZE. Based in the United Arab Emirates, Manarat Alkhaleej Marine Services operated OCEAN GUARDIAN and another tanker, AL SAFA (IMO 9222649); together, these vessels completed at least 30 shipments originating from Iran in 2025.

AIS data indicates that OCEAN GUARDIAN unloaded cargo (evidenced by a reduction in broadcast draught) before entering the Persian Gulf on 3 February 2026. However, on 4 February, Sentinel-1 synthetic aperture radar (SAR) imagery confirmed the vessel was transmitting a spoofed location on AIS. This behaviour is consistent with shadow-fleet tankers involved in the trade of sanctioned Iranian oil.

Vessel's AIS transit through the Strait of Hormuz, and Sentinel imagery showing the vessel spoofing its location.

Satellite imagery and AIS behaviour analysis further confirmed the spoofing. While its AIS position remained stationary in the Northern Persian Gulf from 5 February to 12 March, SAR imagery revealed its true location elsewhere.

Vessel's AIS position in the Northern Persian Gulf, confirmed as spoofing through behaviour analysis and satellite imagery.

On 20 February, OCEAN GUARDIAN changed its name to DANUBE and its AIS-transmitted flag from Panama to Guinea. This aligns with Panama’s policy of de-registering sanctioned vessels.

Between 12 and 13 March, DANUBE reported multiple draught changes via AIS, starting at 7.5m and ending at 10.5m. This indicates the vessel loaded cargo despite AIS not showing the vessel coming alongside—further evidence of identity manipulation and spoofing.

Vessel AIS position shows the vessel entering the Strait of Hormuz before going dark on AIS.

On 13 March, DANUBE’s AIS signal showed the vessel departing the northern anchorage before entering the Strait of Hormuz on 14 March. The vessel then moved rapidly south, a pattern often associated with vessels operating in areas of intense GPS jamming.

Starboard continues to monitor DANUBE using the 'Starts transmitting AIS' alert. This feature provides immediate notification when vessels that have "gone dark" resume transmissions. The vessel is likely to be travelling east in to maintain fuel supply to buyers in Asia.