A 47-vessel cluster in the Strait of Hormuz, and what it tells us about identity drift.

Most maritime risk frameworks assume identity is fixed. A vessel has a name, an IMO number, a flag, and an owner — and screening compares those identifiers against a list. When everything matches, the box is green. When something doesn't, it's red. The trouble is that identity, in commercial shipping, drifts. Names change. Owners restructure. Flags switch in port. And in the corridors that matter most, identity itself becomes a tool.

Between mid-April and the end of April 2026, HUAX observed a cluster of 47 vessels transiting the Strait of Hormuz whose behavioural fingerprints diverged sharply from their declared identities. None were on a primary sanctions list at the moment of observation. None had a single anomaly that, in isolation, would have triggered a screening alert. But taken together, their movement patterns produced a peer-group deviation of Z = 4.3σ — well outside what we'd expect from a population of compliant carriers running normal Gulf trade.

What we observed.

The cluster shared three behavioural traits. First, draught drift: declared cargo loads inconsistent with measured hull immersion, sometimes by more than two metres. Second, STS proximity patterns — vessels coming within 200 metres of one another at speeds and durations consistent with ship-to-ship transfer, in zones where STS is not declared. Third, AIS gaps averaging 4 hours 22 minutes per vessel per week, concentrated in coordinates that don't correlate with known transmission shadow.

A four-hour silence is not, by itself, evidence. Forty-seven vessels going dark in the same coordinates over fourteen days, is.

Individually, each of those signals has a benign explanation. Draught readings can be off because of fuel consumption, ballast adjustments, or sensor noise. Vessels pass close to each other in busy lanes. AIS transponders fail. The HUAX evidence chain treats each in isolation — and assigns probability, not certainty.

What changes the picture is co-occurrence. When the same vessels exhibit two of these traits, the joint probability of a benign explanation drops sharply. When all three converge, in the same coordinates, across a population of vessels with overlapping ownership histories — that is when a behavioural cluster becomes evidence.

Why identity-based screening missed it.

Sanctions lists are slow. Ownership filings can be amended. Flag registries respond to commercial pressure. By the time identity-based screening catches up to a network, the network has restructured. Behavioural signals don't have that latency — they describe what a vessel did yesterday, not what its paperwork said last quarter.

The 47 vessels in the cluster, at the time of observation, were registered across eleven flag states. Sixteen had changed beneficial owner within the past 180 days. Eight had changed name. Two had been re-flagged twice in the same calendar year. Identity, for this population, was not a fixed point — it was a moving target. Behaviour was not.

What it means for risk teams.

For underwriters, compliance officers, and operators with exposure to Gulf trade, the implication is straightforward. Screening against identity is necessary but no longer sufficient. The vessels that warrant closer attention are not always the ones flagged in databases — they are the ones whose movement patterns diverge from the population they claim to be part of. That requires baseline comparisons, peer-group analysis, and an evidence chain that explains why a signal was raised.

HUAX provides that evidence chain as a structured output, not a black-box score. Every signal in the cluster was traceable to its underlying observations: AIS fixes, registry filings, draught readings, proximity events. That is what we mean by glass-box.