By Arsenio Longo, HUAX, and Saleem Khan, Pole Star Global
The location 45 miles off the coast of Johor, Malaysia, often referred to as the Eastern Outer Ports Limits (EOPL) anchorage, does not look like a crisis zone. It sits around Malaysia and Singapore’s eastern approaches, off Johor, in one of the busiest maritime theatres in the world. Tankers, container ships, bulkers, bunker traffic and service vessels move through or around the area every day. On the surface, the Eastern Outer Port Limits, or EOPL, look like part of the normal operating fabric of Southeast Asian shipping.
Which is precisely what makes it worth watching. Unlike Hormuz, EOPL does not announce itself through a declared closure, a naval warning, or a visible access regime. There is no public corridor list, no formal gatekeeper, no single moment at which a vessel either passes or fails to pass. A vessel can anchor, wait, slow-steam, loiter, or later re-enter the main traffic stream without that activity necessarily creating the same port-state record as a terminal call, bunker event, or berth movement.
On 30 May 2026, HUAX observed three Iran-linked tankers: SERENA, SALINA and DUNE, moving westbound through the eastern Singapore Strait after operating in or near the EOPL area. There was no dramatic dark period, no single spectacular anomaly.
The signal was quieter: three Iran-linked vessels, the same direction, a narrow time window, and a shared operating area near one of Southeast Asia’s most sensitive offshore tanker zones. None of that establishes a transfer, a cargo movement, or a sanctions breach. It does show why EOPL should be treated as a behavioural monitoring zone, not just a geographic label.
The 30 May Cluster
The clearest HUAX signal in this observation window came on 30 May. The three vessels generated continuous westbound tracks: SERENA 14.9nm, SALINA 22.7nm, DUNE a shorter 6nm, at broadly similar speeds and within a narrow time window. In the early part of the observed window, their spacing was close enough to make the pattern operationally relevant.
AIS proximity alone cannot establish coordination. In this region, however, clustered movement of Iran-linked tonnage is not something to ignore.
A Port Produces Paperwork. A Waiting Room Produces Patterns
EOPL matters because it sits between visibility and accountability.
A vessel can be visible on AIS and still be difficult to interpret. It can wait outside a formal port event. It can re-enter traffic after a period that remains analytically incomplete. None of that necessarily appears in the records that compliance teams usually rely on: port call logs, bunker receipts, customs filings, terminal events or formal declarations.
Hormuz became legible because the corridor was under declared pressure. Vessels used AIS destination fields to signal identity, crew nationality and cargo purpose. The abnormal behaviour became visible because the constraint was visible. Figure 1- Pole Star Global – Maritime Domain Awareness (MDA) – 03/30/2026. EOPL works differently. Its significance lies in the interval: the waiting, the clustering, the partial darkness, the slow movement, and the return to normal traffic with parts of the story still missing.
Pole Star has monitored vessel behaviour across the Singapore Strait and its eastern approaches for more than a decade. From a Maritime Domain Awareness perspective, EOPL is not an anomaly in the system. It is part of how the system works. The area was designed for efficiency, throughput and operational flexibility, not for perfect accountability, and that creates a problem for conventional screening.
Most compliance frameworks still organise risk around discrete events: a port call, a flag change, a name on a list, a change of ownership, a declared destination. EOPL often produces intervals instead of incidents. A vessel can be present, visible and moving normally while the preceding dwell, its proximity to other vessels, and the pattern before re-entry remain outside standard screening workflows.
Track-level analysis is what helps close that gap. The question is not only whether a vessel appears on a list. It is where it slowed down, where it waited, whether other vessels were nearby, and whether the pattern before re-entry fits the declared purpose of the transit.
Reading the Pattern Carefully
Proximity is easy to overread in sanctions-sensitive maritime analysis.
Westbound clustering is not evidence of transfer. No AIS track, however suggestive the spacing, proves that cargo changed hands, that Iranian-origin oil was involved, or that the three vessels shared a common commercial purpose.
Three Iran-linked tankers were observed moving westbound from the EOPL area within a narrow time window and at similar speeds. Read against the wider corridor, the pattern points to an offshore operating environment where waiting, staging and re-entry into traffic can carry as much analytical value as the transit itself. The visible transit is the exit movement. The dwell is where the risk picture begins to form.
VELON 1 produced a supporting signal: eastward movement toward the EOPL area, followed by a 42-hour 36-minute AIS gap, then westbound reappearance near the same zone. From a compliance and underwriting perspective, the absence itself becomes part of the record, especially when bounded by approach and reappearance in a sensitive offshore zone.
The wider relevance of this operating area was already visible in the TIFANI case. The sanctioned Iran-linked tanker later boarded by U.S. forces in the Indo-Pacific had previously been associated with Singapore-area / EOPL-linked activity, underscoring why this corridor should be read through movement history rather than isolated vessel events.
Identity makes this harder still. The vessels observed here are Iran-linked, but identity in the dark fleet ecosystem is rarely fixed in a simple way. Flag states change. MMSI numbers reset. Names are recycled. Ownership structures can be layered across managers, operators and shell companies. List screening captures identity at a point in time. A vessel may look ordinary at the moment of arrival while its prior movement history carries the real risk signal.
The Waiting Room off Johor
EOPL is not Hormuz, and the difference matters. When risk rises in Hormuz, the world watches. Traffic slows, premiums move, governments issue warnings, and unusual AIS strings become part of the public picture. The crisis announces itself because the chokepoint does. EOPL works in a quieter way. It does not need a declared crisis to create risk. There may be no formal closure, no single incident, and no obvious moment for compliance teams to mark after the fact.
A tanker exits the area westbound. AIS is active. Speed is normal. The track looks clean. But the exit movement is only one data point. The more informative record may lie in what preceded it: dwell time, signal loss, spacing with other vessels, and the match between declared destination and actual track. Modern maritime risk rarely sits inside one event. It builds across a sequence.
The waiting room off Johor is part of the maritime system. Vessels can pause without fully disappearing, remain visible without becoming easy to explain, and depart with the preceding period still analytically incomplete.
For maritime risk teams, the next signal may not come from a closed strait or a dramatic incident. It may come from a normal-looking westbound movement out of a quiet offshore zone: three tankers at similar speeds, in the same direction, with just enough structure in the data to ask better questions.
EOPL is not where the crisis announces itself. It is where the system adapts quietly.