48 Hours Into the Iran War: A Maritime Intelligence Breakdown

At a Glance

• U.S. strikes under Operation Epic Fury immediately altered maritime risk calculations across the Gulf.
• Western-affiliated tankers and LNG carriers paused or reversed course before entering the Strait of Hormuz.
• Windward detected a more than 200% increase in dark vessel activity during the first night of escalation.
• Over 1,100 vessels were affected by GPS interference within 24 hours across the Middle East Gulf.
• Red Sea traffic shows defensive AIS messaging and reduced transits amid elevated targeting concerns.
• Commercial vessel strikes off Oman underscore the growing kinetic exposure for shipping in contested waters.
• Belgium seized a sanctioned shadow fleet tanker M/T Ethera in the North Sea, marking the first interdiction of a vessel tied directly to Iranian-linked maritime networks outside the Middle East since the operation began.

Escalation in the Strait of Hormuz

At 01:15 ET on February 28, U.S. and partner forces began coordinated strikes against Iranian military targets under Operation Epic Fury. Within hours, missile exchanges followed across the Gulf, placing one of the world’s most critical maritime chokepoints inside an active conflict zone.

Forty-eight hours later, vessel traffic continues to move through the Strait of Hormuz, while behavior, visibility, routing decisions, and navigational reliability have shifted sharply.

The sequence below outlines the events and the maritime signals Windward has identified in the first forty-eight hours.

Operation Epic Fury Begins

U.S. Central Command confirmed strikes targeting IRGC command facilities, missile and drone launch sites, air defense systems, and military airfields. It also reported successfully defending against subsequent missile and drone attacks, with no reported U.S. casualties and minimal installation damage.

Within hours:

• Airspace closures were reported across parts of the Gulf region.
• Iranian missile launches targeted installations in Qatar, Kuwait, the UAE, and Bahrain.
• The UK Maritime Trade Operations (UKMTO) warned of “significant military activity” across the Arabian Gulf, Gulf of Oman, North Arabian Sea, and Strait of Hormuz.
• The U.S. Maritime Administration (MARAD) directed U.S.-flagged vessels to maximize distance from Iranian waters and maintain AIS transmissions.

The strikes immediately altered risk calculations for vessels operating in and around the Strait of Hormuz.

Western-Affiliated Tankers Shift Course

By mid-day February 28, Windward’s Maritime AI™ platform identified the first signs of energy flow disruption.

At least a dozen tankers and cargo vessels bound for Arabian Gulf ports paused voyages or executed U-turns in the Gulf of Oman rather than transit the Strait of Hormuz. Western-owned and Western-flagged vessels were disproportionately represented among the reversals. Among them were Suezmax tankers chartered to load crude for Asian and Indian destinations.

Roughly 20% of global oil and petroleum exports transit the Strait of Hormuz, amounting to approximately 20 million barrels per day.

Windward data shows traffic did not halt entirely, with eastbound vessels continuing to exit the Gulf, while Western-affiliated vessels were disproportionately represented among those reversing course or pausing before transit.

As of 11:30 GMT on March 1, 20 vessels with identified U.S. ownership or management linkages were actively transiting with declared destinations in Gulf countries. Vessels were classified as U.S.-linked where at least one of seven levels of corporate ownership or management ties was traced to a United States-based entity.

In parallel, Windward’s MIOC report shows a measurable reduction in commercial vessel traffic through the Bab el-Mandeb following escalation, as major container carriers activated contingency routing plans to avoid misidentification and retaliatory targeting risk in the Red Sea corridor.

As of March 1, Windward data indicates more than 1,000 vessels present within the Red Sea Area of Responsibility. While traffic has not collapsed entirely, AIS data shows commercial operators broadcasting defensive messaging in destination fields to signal neutrality and reduce perceived U.S. or Israeli affiliation exposure. Observed transmissions include phrases such as “ALL MUSLIMS ON BOARD,” “ALL CHINESE,” and “NO IL LINK.”

The pattern suggests preemptive risk mitigation by crews anticipating potential coordinated targeting activity.

This behavior illustrates how AIS is being used not only for navigational reporting but also as an active signaling mechanism in a live threat environment where perceived affiliation may influence targeting decisions.

Despite elevated risk, vessel density remains high, reinforcing the importance of real-time behavioral monitoring as the situation evolves.

LNG Flows React Immediately

Liquefied natural gas movements responded within hours.

Windward tracked at least eight LNG carriers abruptly changing course within a four-hour window before entering the Strait of Hormuz on February 28.

All but two LNG carriers sailing to load at Qatar or the UAE turned around in the Gulf of Oman. The last LNG carrier to transit the Strait did so at 21:00 UTC on February 28, signaling Ras Laffan as its next port of call. The vessel had no Western affiliation.

The speed of deviation suggests immediate counterparty and charterparty risk reassessment.

Visibility Degrades While Traffic Continues

Initial satellite-derived vessel activity through the Strait, compared against February 14 baselines, showed export traffic broadly continuing, while signal reliability and AIS integrity deteriorated across the surrounding waters. 

Windward Remote Sensing Intelligence detected a more than 200% increase in dark activity across waters off Oman, the UAE, and the wider Gulf during the first night of escalation.

The likely driver is vessels switching off transponders to reduce exposure to potential targeting or security threats.

However, increased dark activity creates secondary exposure, as AIS silence in congested chokepoints complicates collision avoidance, regulatory compliance, and insurance reporting.

By March 1, the disruption extended beyond routing decisions to widespread degradation of GPS and AIS reliability.

As of March 1, more than 450 vessels operating in the Gulf of Oman were observed at slow speed (below 3 knots) or drifting, indicating elevated caution, holding patterns, or delayed entry decisions pending further clarity.

Electronic Interference Expands Across the Gulf

Windward tracked more than 1,100 vessels affected by GPS interference within a 24-hour window across the Middle East Gulf.

AIS signals were diverted:

• Onto airports in the UAE.
• Over the Barakah Nuclear Power Plant.
• Into Iranian inland locations.
• Into circular “crop-pattern” distortions off the UAE, Qatari, and Omani waters.

The platform also detected at least 21 new jamming clusters during the same period.

A very large crude carrier waiting to load off Qatar had its AIS position diverted to six separate inland locations within 24 hours.

Electronic interference in the region predates Operation Epic Fury, but the geographic clustering and scale expanded immediately after escalation.

The operational implications are twofold:

1. Navigational risk: Congested waters require precise positioning for safe transit.
2. Compliance risk: False AIS positioning in Iranian territory can trigger automated sanctions alerts, compliance holds, and contractual disputes.

Windward analysis tracked just under 100 Hormuz transits in the past 24 hours, which is approximately one-third lower than typical levels. Tankers were observed transiting without AIS transmissions, limiting the reliability of position-based monitoring across the Strait.

Commercial Vessel Strikes Off Oman

Reports indicate that the Palau-flagged chemical tanker SKYLIGHT (IMO 9330020) was struck near Duqm, Oman, amid military activity.

SKYLIGHT was added to the OFAC SDN list on December 20, 2025, under Executive Order 13902 for involvement in transporting Iranian petroleum products.

Windward platform data shows the vessel exhibited multiple identity changes and opaque ownership structures over time, patterns commonly associated with sanctions-evasion networks.

On March 1, the Marshall Islands-flagged crude oil tanker MKD VYOM (IMO 9284386) was also reportedly struck by a projectile off the Omani coast, marking the second reported attack on commercial shipping in the region within 24 hours.

The UK Maritime Trade Operations (UKMTO) confirmed an incident involving the vessel. The 229-meter tanker experienced a fire on board following the strike, though the crew was successfully evacuated and reported safe.

If confirmed, the strike illustrates a secondary risk dynamic: sanctioned and gray-network vessels operating in contested waters face elevated exposure, whether kinetic or regulatory.

Verification of the strike remains ongoing.

European Enforcement Targets Iran-Linked Tanker in the North Sea

On March 1, Belgian special forces boarded and seized the oil tanker ETHERA (IMO 9387279) near Ostend after determining it was operating under a fraudulent Guinean flag and could be treated as stateless. The vessel, previously designated under EU, U.S., and UK sanctions regimes, was escorted to Zeebrugge under EU enforcement authority.

Windward had assessed ETHERA as high risk due to repeated AIS dark activity, totalling approximately 141 hours, more than 40 documented ship-to-ship engagements with Russian-linked tankers, and persistent calls at major Russian crude export terminals. Its management structure included links to an OFAC-designated entity under Executive Order 13902 related to Iran sanctions activity. 

The vessel is further linked to a commercial tanker network associated with Mohammad Hossein Shamkhani, the son of senior Iranian political figure Ali Shamkhani, who until recently served as chief political advisor to Iran’s Supreme Leader Ayatollah Ali Khamenei and was reportedly killed in the recent bombings.

The interdiction marks the first reported seizure of an Iranian-linked maritime network vessel outside the Middle East since Operation Epic Fury began. It occurred within the broader operational environment of Operation Epic Fury, where maritime enforcement posture has already escalated, and sanctions designations are increasingly translating into direct, at-sea interdictions in European waters. 

What This Means for Maritime Stakeholders

Forty-eight hours into Operation Epic Fury, six structural shifts are visible:

1. Traffic remains selective, not frozen: Energy flows have slowed and rerouted, particularly among Western-affiliated vessels, with LNG movements reacting faster than crude.
2. Visibility is degraded: Dark transits and AIS unreliability undermine cooperative monitoring systems, increasing reliance on multi-source verification.
3. Electronic interference is now a primary risk vector: GPS denial is affecting both navigation and compliance systems simultaneously.
4. Insurance markets will shape routing: War risk premium adjustments early this week will influence whether deviations become sustained avoidance.
5. Enforcement and exposure now intersect operationally: Sanctioned vessels remain active in the region, where kinetic risk, sanctions exposure, and counterparty risk are converging in real time.
6. Regional spillover is evident: Red Sea defensive AIS messaging and destination rewrites indicate precautionary behavior extending beyond Hormuz.

Live Security Briefing: Navigating the Strait Under Escalation

As Operation Epic Fury enters its next phase, Windward’s Michelle Wiese Bockmann will host a live security briefing tomorrow focused specifically on developments in and around the Strait of Hormuz.

This session will assess what is unfolding at sea, how retaliatory activity is affecting regional port operations, and the indicators shaping near-term maritime risk.

Register here to attend the live briefing.