Hodeida Under the Ceasefire: Inside the Iran-to-Houthi Supply Network

This analysis was produced by Windward’s Maritime Intelligence Operations Center (MIOC) — a mission-critical operations center powered by Windward’s maritime intelligence experts, operating as a seamless extension of your team. This is a sample of what we deliver. Vessel identifiers and ownership entities referenced in the underlying MIOC investigation have been redacted for external distribution. The behavioral findings reflect AIS data, multi-source signal fusion, and Windward’s Maritime AI™ behavioral models, with human analyst review. For intelligence tailored to your operational theater, visit the MIOC page.

Between November 2025 and May 2026, 164 vessels passed through the Hodeida and Saleef approach zone in Houthi-controlled western Yemen. Among them, 19 vessels were operating under active OFAC, UK, or EU sanctions, five completed multi-leg transits linking Iranian or Syrian ports to Yemen, and nine carried no listed registered owner. The October 2025 ceasefire between the Houthis and the U.S.-led coalition did not slow this traffic. Within weeks of the September 2025 strikes that damaged the main port and the Ras Issa oil terminal, arrivals returned to pre-strike levels. Windward’s Maritime Intelligence Operations Center (MIOC) assesses Hodeida as an active Iran-to-Houthi logistics node operating through commercial shipping, with systematic identity manipulation, deceptive shipping practices, and a deliberate bias toward Houthi-controlled ports. The ceasefire changed the signal environment around the network. It did not change the logistics.

What Happened

The Port and the Recovery

Hodeida has been under Houthi control since late 2014 and handles an estimated 70% of Yemen’s pre-conflict imports. The September 2025 strikes damaged container and bulk-cargo handling capability at the main port and oil-loading infrastructure at the Ras Issa terminal, approximately 25 km to the north. AIS and electro-optical imagery indicate commercial activity resumed within weeks. By late October 2025, anchorage arrivals had returned to pre-strike volumes. The 20 km Al-Salif port to the north absorbed displaced cargo between September and November 2025 before traffic rotated back to Hodeida.

Roughly six months into the ceasefire, that recovery has held. A May 20, 2026, satellite pass identified four commercial vessels over 100 meters at the port, one vessel dark with no AIS, and approximately 26 oil storage tanks at the tank farm, with nine large crude/heavy fuel oil tanks and 14 to 16 medium refined-product tanks structurally intact. A holding anchorage approximately 8 to 10 nautical miles northwest of the port entrance was observed at active capacity, with three vessels stationary at the position through May 27. Extended anchorage at this position is consistent with port-entry queuing or awaiting instruction from the Houthi port authority.

The Iran-Syria-Yemen Corridor

Five vessels in the dataset completed confirmed multi-leg transits linking Iranian or Syrian ports to Hodeida or Al-Salif. The sequence is consistent with documented Iranian Revolutionary Guard Corps (IRGC) supply chain patterns: goods move from Iran to Syria — typically Tartous or Lattakia — where consolidation or transshipment occurs, before final delivery to Houthi-controlled Yemen. No direct Iran-to-Hodeida routes were observed in the dataset, and all five vessels conducted multi-stop voyages with transit times of 70 to 96 days, and all exhibited dark activity during the Iranian, Syrian, and Red Sea approach segments.

An OFAC-sanctioned Panama-flagged bulk carrier called Tartous from January 16 to February 1, 2026, and arrived at Hodeida on April 22, 2026, an 80-day transit completed while under designation.

The appearance of Russian upstream ports in two of the five transits is consistent with the broader Iran-Russia logistics axis routed through Syria.

The Djibouti Transshipment Line

A secondary pattern emerged from the port-call data, with Djibouti operating as an active transshipment waystation on the route to Hodeida. Cargo arriving in Djibouti from sanctioned or high-risk origins is transferred to vessels with cleaner AIS histories and lower compliance flags, which then proceed to Yemen. The technique is designed to break the association between the origin cargo and the Yemen destination, insulating the original carrier from Yemen-related intelligence flags.

At least a dozen vessels in the dataset called Djibouti as the final port before entering the Hodeida approach zone, with an average 10.4-day transit time. Two cases illustrate the method. The first, a San Marino-flagged general cargo vessel, anchored at Djibouti from May 14 to 17, 2026, met a tanker for a 4.5-hour bunkering stop, and then departed for Hodeida. Its ownership consists of two single-vessel Liberian shell companies registered in February 2026 with no disclosed beneficial owner. 

The second, a Panama-flagged vessel, filed its Djibouti destination as “YEHOD 3GD CHINAOWNER” — a garbled Hodeida reference assessed as an attempt to mask the destination while still nominally filing one.

Direct Iran Port Calls and Dark Activity

Three vessels in the dataset made direct port calls at Iranian facilities before proceeding to Hodeida. The shared behavior is in-port AIS dark activity, where the vessel goes dark while still inside the Iranian anchorage, not during transit. One vessel called Shahid Rajai, Bandar Abbas, for 222 hours in November 2025, going dark for 97.8 hours while inside the port, before calling Hodeida and exhibiting two additional 12-hour dark periods in Yemeni waters. 

In-port dark activity at the loading stage is consistent with suppressing cargo identification from external monitoring.

The Ras Issa Revenue Stream

Four sanctioned tankers conducted extended loading operations at the Houthi-controlled Ras Issa oil terminal between November 2025 and April 2026.

Post-loading destinations included Khor Fakkan, UAE, Shinas, Oman, and Port Said, Egypt. The U.S. Treasury assessed in January 2026 that the Houthis generate more than $2 billion annually from illicit oil sales. These four tankers represent the observable AIS layer of that revenue stream.

What It Signals

Sanctions Designation Is No Longer an Operational Constraint

Nineteen vessels with active OFAC, UK, or EU designations continued commercial operations in the Hodeida approach zone throughout the assessment period. Eight are designated under Iran-program authorities, including IRGC, Specially Designated Global Terrorist (SDGT), and Executive Orders 13902 and 13846. Eleven are designated under Russia or Syria-program authorities, with most also carrying secondary Iran-Houthi designations. One vessel in the designated set was identified by OFAC in April 2025 as property linked to a shipping entity tied to Ansarallah, the formal name of the Houthi movement, which is a designation explicitly issued to disrupt the Iran-to-Houthi pipeline that this dataset documents continuing to function more than a year later. 

The absence of an enforcement consequence for designated vessels calling Hodeida indicates that designation alone is no longer producing operational friction in this corridor. Houthi-controlled ports continue to receive these vessels, and bunkering, transshipment, and onward logistics services remain accessible to them.

Identity Manipulation as a System, Not a Tactic

More than 60 vessels in the dataset use identity changes as a recurring operational practice — name oscillation, MMSI substitution, flag hopping, and IMO spoofing — at volumes inconsistent with isolated evasion attempts. The most sophisticated cases illustrate the range. 

One Russian-flagged and state-owned vessel performed more than 100 MMSI alternations between two assigned numbers and accumulated more than 1,200 hours of dark activity. A Panama-flagged vessel executed 44 callsign changes in 33 days at a peak rate of 1.33 per day, combined with false IMO broadcasting and 1,376 hours of dark activity across three periods. An OFAC-designated tanker executed a 2,887-hour (120-day) dark period from June to September 2025, the longest single dark window in the dataset, with coordinated identity changes during the dark interval. A second Panama-flagged vessel oscillated more than 30 times between two names over a single week, including two documented IMO spoofing attempts.

The combined effect is to defeat persistence-based automated screening across name, MMSI, flag, and IMO simultaneously.

Shell Company Dissolution and Disappeared Owners

Nine vessels in the dataset have no listed registered owner as of February to May 2026, and all of them are sanctioned or carry high compliance-risk classifications. The absence of a listed owner does not prevent these vessels from operating. They continue to receive port access, bunkering services, and cargo in Hodeida. The pattern is consistent with deliberate shell-company dissolution to complicate enforcement, asset seizure, and liability tracing.

The Enabling Registries

80% of the fleet flies flags from registries with historically weak sanctions enforcement and limited flag-inspection capacity. Panama leads at 29%, consistent with its scale as the world’s largest open registry. St. Kitts & Nevis and Comoros follow as the next-largest blocks. Botswana, Palau, and San Marino appear disproportionately in the Iran-program designated set, indicating these registries are actively absorbing vessels under enforcement pressure elsewhere.

Western-Connected Operator Exposure

Twenty-one vessels in the dataset are managed or operated by companies registered in EU member states or other Western-aligned jurisdictions. Greek management companies operate at least 11 of these. Greek maritime law affords management companies operational distance from vessel ownership, but Greek-managed vessels appear repeatedly in high-risk contexts in this dataset, including documented dark activity in Iranian and Syrian waters. Three vessels operated by a Germany-based bulk-carrier group were confirmed in the Hodeida holding area, where presence is most consistent with legitimate commercial grain and bulk trade required for Yemeni food security. However, the use of Djibouti port calls before Yemen destinations places these vessels in proximity to the transshipment line described above and warrants closer monitoring of cargo provenance.

The Ceasefire Changed the Signal, Not the Logistics

Hodeida has been struck, damaged, and returned to operation within weeks each time, and the supply network kept moving through all of it. Goods continue to move through Djibouti, ships change flags, owners disappear on paper, and the same vessels keep showing up. The ceasefire that began in October 2025 did not interrupt any of that. It reduced the volume of strike activity and the corresponding intelligence noise around the network, but what it changed was the signal environment, not the logistics.

What to Monitor

Three lines of follow-up are likely to define the analytical picture in the coming months.

The first is whether the sanctioned fleet calling Hodeida expands or contracts. Continued or growing calls by OFAC, UK, or EU-designated vessels would indicate that the corridor’s tolerance for sanctioned tonnage is structural rather than transitional, and that further designation rounds will not produce operational friction without secondary enforcement against ports, registries, and transshipment hubs that enable the calls. New designations alone, on the current evidence, do not slow the traffic.

The second is the Djibouti transshipment line. Whether Djibouti port authorities, partner intelligence services, and shipping classification societies act on the methodology — particularly the use of single-vessel Liberian and San Marino shells registered immediately before the relevant voyages — will determine whether this leg of the pipeline remains the network’s most exposed and most exploitable interruption point.

The third is the Western operator exposure. Whether Greek and other EU-jurisdiction maritime operators with vessels in the Hodeida approach zone publicly clarify their cargo provenance, due diligence practices, and Djibouti port-call rationale will determine whether this segment of the fleet is reclassified from inadvertent commercial exposure to witting participation. The 21 Western-connected vessels in the dataset represent the most policy-actionable subset of the network and the most consequential to the assessment of whether the Iran-to-Houthi pipeline operates with passive Western tolerance or active Western complicity.

In parallel, the four tankers conducting extended Ras Issa loading operations remain the observable revenue layer of the Houthi oil stream, and warrant continued monitoring as the most operationally significant set of vessels in the dataset.

Mission-Ready Intelligence, at Your Service

Detecting patterns like these requires more than static monitoring. Windward’s MIOC integrates multi-sensor intelligence with Agentic AI to detect, collect, and analyze threats in real time. To discuss ongoing intelligence coverage or ad-hoc forensic deep dives tailored to your operational theater, get in touch with us.