In August 2021, several mainstream media and social media articles were written raising concern over a tanker which was being reported as AIS dark for the past month. The vessel was stated to be the Guyana flagged WINSOME (IMO:9192260). Reports stated it had “disappeared” whilst in the Gulf of Oman. Many were quick to claim that the vessel had been seized by the Iranians as part of the ongoing tensions between Iran, Israel and the United States. This point of view is assessed by Geollect as dangerously shortsighted, with many commentators refusing to consider additional factors that may play into the situation. 

Utilising the WINSOME’s AIS history, satellite imagery and open source research, Geollect uncovered that the WINSOME has a distinct history of suspicious patterns of behaviour, AIS spoofing and visits to Iranian ports on numerous occasions to load sanctioned oil. Factual data suggests that the WINSOME actively facilitates the transportation of Iranian oil, either directly or through ship-to-ship (STS) transfers with other vessels in the region. If the vessel has actually been taken over by the Iranians, it could be argued that this is not as part of a hostile action against an innocent vessel, but more likely centred around a dispute arising between the two parties over the supply and transportation of Iranian oil or with intentions directed towards the well publicised usage of “ghost ships” by Iran. 

ABOVE: Reference imagery used to identify the WINSOME, note the distinctive red deck and white superstructure. Two useful points of identification is the discolouration at the aft end of the superstructure (red circle), as well as the discolouration just forward of midships (green circle).  

The WINSOME is a 21 year old crude oil tanker sailing under the flag of Guyana. The vessel is currently owned by Winsome Shipping Inc, whilst being managed by Lynx Marine LLC. Both of these organisations have the same registered address, down to the same unit number in the building. The vessel has only been named as the WINSOME since the 1^st July, 2021, it had previously been known as the UMM HABAYEB since the 1^st March, 2021. Both of these name changes occurred whilst the vessel was in the same anchorage position 7 miles east of Khor Fakkan. 

AIS HISTORY-SPOOFING

Looking into the AIS history of the WINSOME, Geollect uncovered numerous instances of AIS spoofing or darkness, suggesting that the WINSOME has a history of intentionally obscuring it’s pattern of behaviour.  

During the months of March, May, June, July and August 2021 the WINSOME conducts lengthy periods of AIS spoofing. 

Above: AIS patterns of the WINSOME which almost certainly suggest the vessel was spoofing position during this time. Geollect focused on the substantial periods of AIS darkness and spoofing, focusing on 3 time periods during 2021, in order to showcase that the vessel had not been seized by the Iranians at this time, but actively participates in the transportation of sanctioned oil.

March 2021

From March through to mid-April, the WINSOME transits from the Persian Gulf to the port of Zhoushan, China. It remained in Zhoushan Port from the 9th-14th, before returning to the Persian Gulf. Of note, the WINSOME does not stop at a port on AIS prior to this visit, or a recognised loading area, raising the suspicion around the cargo. Tracing back the AIS in March, Geollect uncovered a period where the WINSOME is AIS dark for 89 hours in close proximity to the Iranian coast. 

At the most northern point (red circle) the WINSOME has an 89 hour AIS outage, when the vessel reappears on AIS, it is transiting away from the Iranian coast.

Above: The individual AIS points of the WINSOME’s AIS outage, note that once coming back online on the 19th, the vessel is heading immediately in the opposite direction, suggesting that the vessel has recently picked up cargo.

Geollect conducted a satellite imagery search in an attempt to locate the WINSOME during this period of AIS darkness. From the 18th-19th March, a vessel matching the dimensions and characteristics of the WINSOME was docked at Bandar Mahshahr port in Iran.

This vessel in the image above is assessed as highly likely to be the WINSOME.

As the vessel in question was last seen at Bandar Mahshahr on the morning of the 19^th, it would have enough time to transit back to the next reported AIS position of the WINSOME. This position transited southeast away from Iranian waters on the 19th, further adding to the likelihood of the vessel at Bandar Mahshahr being the WINSOME. 

WINSOME spends the rest of March and early April transiting east towards China. The vessel arrives on the 9^th April and is docked for the next 4 days. It is almost certain that during this time the suspected Iranian oil is being offloaded. Once completed, the WINSOME begins transit back west towards the Persian Gulf. 

May 2021

From the end of April to early May, the WINSOME transits west to a position south of Iranian waters, near where the vessel anchored previously in March. The WINSOME’S AIS position puts the vessel at the position below from the 2nd to the 10th May. However, many of these AIS positions are assessed to be spoofed, with no satellite imagery showing the WINSOME at this position during the 8-day period.

It is assessed as highly likely that the WINSOME visited Bandar Mahshahr in March, Geollect utilised available satellite imagery to determine the likelihood of the WINSOME visiting again under a period of AIS spoofing.

The above capture from the 7^th May, 2021, displays a vessel matching the characteristics and dimensions of the WINSOME at the port of Bandar Mahshahr. As with previous satellite imagery, there is visual discoloration forward of midships, as well as some colour at the aft end of the superstructure, matching with the multi coloured exhaust of the WINSOME. As a result, Geollect assesses that it is highly likely that the vessel in this image is the WINSOME. 

The vessel arrives at Bandar Mahshahr on the 6^th May and departs by the 8^th. This would give the vessel enough time to transit back to the last reported AIS position of the WINSOME, as it is reported on AIS departing southeast the night of the 10^th May.

June 2021

After leaving the Persian Gulf, WINSOME spent the next 3 months in the Gulf of Oman, staying close to the coast, in particular around Sohar, Oman and Khor Fakkan. The AIS positions during this time are assessed to be frequently spoofed, with multiple suspicious patterns and behaviours. The area around Sohar is known for STS transfers to take place, and a good area to blend in. Many vessels involved in nefarious activity choose to be AIS dark during this process. 

ABOVE: The AIS positions of the WINSOME from the 11^th May to present day, much of the transitory tracks seen have suspicious jumps in speed and heading, suggesting illegitimacy. Several areas within the AIS track contain blatant instances of AIS spoofing, such as the three squares displayed on page 3.

The purpose of this report was to challenge the shortsighted reporting made by some commentators, as well as proving the WINSOME had a sustained history of facilitating the transportation of Iranian oil.

This hypothesis is strengthened by the discovery of the vessel assessed to be WINSOME conducting a STS with a sanctioned VLCC on the 27^th June. From the 26^th June to the 5^th July the WINSOME was once again conducting a period of assessed AIS spoofing, East of Sohar. Geollect ran nearby AIS searches to uncover any potentially suspicious vessels and discovered the vessel OMAN PRIDE was in the vicinity at the time of the spoofing. Utilising satellite imagery of the surrounding area, Geollect uncovered on the 27^th June a vessel matching the dimensions and characteristics of the WINSOME conducting a STS.

Geollect placed both AIS tracks onto the same image in order to effectively visualise the timeline of the STS transfer. From the 26^th June, the WINSOME’s AIS positions become irregular, with unexpected jumps and variations suggesting a manipulated track. This then culminates in the WINSOME reporting the exact same AIS position from the 27^th June to the morning of the 7^th July. As the spoofing matches up to the time of the STS captured on imagery, Geollect assess it is highly likely that the WINSOME conducted this STS transfer during this time.

Looking into the background of the OMAN PRIDE, Geollect discovered that the vessel was placed on the OFAC SDN list in August 2021. The vessel, alongside it’s registered owner Bravery Maritime Corporation, were accused of transporting Iranian oil and thus added to the SDN list. Bravery Maritime Corporation has also been linked to several Iranian brokers, whose role is to obscure the origin of Iranian oil to fund armed networks such as the Iranian Revolutionary Guards Quds Force.

Source: https://sanctionssearch.ofac.treas.gov/Details.aspx?id=32896

As the WINSOME was highly likely conducting a STS with this vessel, it becomes difficult to argue that the vessel did not have any prior involvement with subverting sanctions placed on Iran, with even less arguments available to claim that the vessel was seized unjustly by the Iranians as part of a diplomatic spat.

July 2021-Present Day

Following the 5th July the WINSOME suffered an AIS outage of 320 hours, re-emerging northeast of Sohar in a pattern assessed to almost certainly be AIS spoofing. Utilising satellite imagery, Geollect was unable to locate the WINSOME on its reported AIS positions past the 5th July, suggesting that during this time the vessel transited to Iran. 

The above image displays the AIS track of the WINSOME, with the corresponding satellite imagery of the recorded position. Whilst it is immediately apparent that the more blatant periods of AIS spoofing do not have the WINSOME at the recorded position, the spoofing on transit lines calls into question the AIS history since the 5th July. As no imagery could be found of the WINSOME during these 2 months, it is almost certain that the spoofing has been used to take the vessel to an Iranian port, either as part of some dispute or through the Iranians taking control of the vessel. 

Following this information, Geollect began to investigate nearby Iranian ports in order to locate a vessel matching the dimensions and characteristics of the WINSOME. 

The above vessel was located south of Bandar Abbas, and is assessed to highly likely be the WINSOME. The vessel matches the dimensions and characteristics of the WINSOME, including the discolouration seen forward of midships, as well as the colour at the aft of the superstructure. The vessel in the imagery arrived in this position on the 7th July and has been at this position ever since. The arrival of the vessel on the 7th July would match up with the AIS outage of the WINSOME on the 5th July. If the WINSOME transited towards Bandar Abbas at it’s previous speed of 11 knots it would take an estimated 16-18 hours to arrive at the position captured on satellite imagery.

Final Thoughts & Looking to the Future

As of current writing, the WINSOME is still displaying behaviour linked to AIS spoofing in the Gulf of Oman, with the vessel highly likely still south of Bandar Abbas. With the data Geollect has collated, it is highly likely that the WINSOME will continue in the facilitation and transportation of Iranian oil, either delivered to ports or transferred to other vessels. The theory that the WINSOME was seized by the Iranians in the past month as a pawn in a wider diplomatic spat does not have any supporting evidence or solid data points at this time. Looking at the last 6 months, WINSOME is assessed to have been an active participant in evading sanctions placed on Iran and it’s oil. It is highly likely that the vessel has made at least two port calls in Iran during this time, with supporting satellite imagery and AIS positions corroborating this. The STS with the OMAN PRIDE only reinforces this pattern of behaviour, as there is no other explanation for a vessel associating itself with a sanctioned entity. If the WINSOME is indeed controlled by an Iranian entity, it is highly unlikely this was achieved through hostile action. If the ship was seized in any matter, the most likely explanation is a dispute between the two parties, such as the buyer of the oil and the supplier or in a bid to operate this vessel as a “ghost ship”.

The events surrounding the WINSOME showcase the importance of considered and researched analysis. Many were quick to claim that the WINSOME was seized in a hostile action by the Iranians with no supporting evidence. This can be put down to the state of geopolitics in the Persian Gulf as well as the Gulf of Oman, with many commentators rushing through stories without considering important factors. This is far from the first time a ship has “disappeared” from this region, with the recent story emerging about the GULF SKY vessel supporting this. Much like the WINSOME, the GULF SKY had a sustained period of AIS darkness, before re-emerging in Iranian waters highly likely facilitating the transportation of Iranian oil. 

Geollect suggests a counter narrative to what has been covered in the mainstream media and social media domains. This position is established upon data points, imagery analysis and supporting open-source research.  Geollect assesses that it is almost certain that the WINSOME is one of many vessels that has been willingly aiding Iranian oil smuggling efforts and will continue to do so in the foreseeable future in some capacity.

Images credit: European Union, contains modified Copernicus Sentinel data 2021, processed with EO Browser.