Exclusive: Iran Used a Ship's History at Brazil's Port of Santos to Evade Sanctions and Deceive Chinese Terminals

IRGC documents leaked by WikiIran reveal that the Iranian network used the pedigree of a legitimate vessel to give a clean profile to a clandestine cargo bound for China.

Leia esta reportagem em português.

On Wednesday, May 13, 2026, WikiIran — a platform specializing in leaked documents from the Iranian regime — published thousands of internal documents and emails from the Islamic Revolutionary Guard Corps, the IRGC. This is the paramilitary force that answers directly to Iran’s Supreme Leader, designated by the United States as a Foreign Terrorist Organization since 2019. The IRGC is not merely an army. It operates as a state-within-a-state, controlling vast sectors of the Iranian economy — from construction to energy and telecommunications.

At the core of its financial autonomy is the Shahid Pour Jafari General Headquarters — the Oil Command — an entity that bypasses the official channels of Iran’s Ministry of Petroleum to fund external operations of the Quds Force and the development of advanced weapons systems. Its structure is composed of senior officers and financial technocrats operating under a veil of corporate anonymity.

Over the past years, WikiIran has published dossiers exposing networks of shell companies, false-flag vessels, and financial schemes used by the Iranian regime to sell sanctioned oil on the international market. Wednesday’s files — the most extensive leak to date — go further: charter contracts with explicit instructions to falsify cargo documents, emails about the secret bunkering of vessels in Iranian waters, and correspondence showing how the IRGC converts oil into operational cash to finance its proxies across the Middle East.

Among the more than 1,600 published emails, there is a sequence of messages that mentions Brazil. In April 2025, the supertanker MT Oceanic Fortune — a vessel capable of carrying more than 320,000 metric tons of crude oil per voyage — called at the Port of Santos. It was on a completely legitimate voyage. The cargo was not Iranian, Venezuelan, or otherwise suspicious. It was Sapinhoá crude, extracted from Brazil’s pre-salt offshore fields, bound for China. The vessel was chartered by UNIPEC, the trading arm of Sinopec, one of the world’s largest oil companies. By every industry standard, the voyage was entirely above board.

Subscribe to A Investigação or make a direct donation:

• Pix: ainvestigacao.com@gmail.com

• Zelle: davidagape@proton.me

• Bitcoin: bc1q0jr2g3cqdelxpmr0jsmdprd5cy4cv52fgl0l3e

• Ethereum: 0x82c5c25FAB4d28C6862b4D54489a9244751C18FF

Before calling at Brazil, the vessel had completed a voyage from the La Paloma terminal in Uruguay to the United States under a Shell charter. After Santos, it loaded at Fujairah (UAE) and Tanjung Pelepas (Malaysia), then discharged at Zhoushan, China, under charter to Chimbusco — one of China’s largest state-owned maritime fuel and energy supply companies. Only after accumulating this track record with these giants did the IRGC network, in June 2025, launch a clandestine operation designed to turn that credibility into a fraud asset.

In June 2025, the name Oceanic Fortune appears at the center of a charter contract tied to no legitimate operation. In a conventional charterparty — the standard contract by which a shipowner (the company that operates the vessel) leases the ship to a charterer (the company that wants to transport a cargo) for an agreed price and period — the shipowner was obligated to three things no legitimate contract would ever include:

• Switch off the vessel’s Automatic Identification System (AIS) — the maritime equivalent of removing a car’s license plates while driving — on the charterer’s orders;

• Perform a ship-to-ship (STS) cargo transfer at sea with a mother vessel whose owners are on the U.S. government’s sanctions list;

• Replace all shipping documents with falsified paperwork, with the master signing under a fictitious name.

The destination declared in the new documents: an Iraqi, Malaysian, or Singaporean port, at the charterer’s discretion. The real destination: refineries in northern China. The real cargo: Iranian oil.

What the documents reveal, however, is more complex than a single contract. In parallel with the Oceanic Fortune negotiation, the same Chinese charterer — Jiandi HK Limited, designated by OFAC in May 2026, operating under the commercial alias Chengtuo Group — was negotiating, through a separate intermediary, a second VLCC (Very Large Crude Carrier) for the same route and the same destination: the MT CS Aura. It was the CS Aura, not the Oceanic Fortune, that physically loaded Iranian oil at sea off the Malaysian coast in June 2025. And it was the CS Aura that arrived at the port of Dalian on June 26 and was rejected. The Oceanic Fortune delivered the pedigree. The CS Aura delivered the cargo.

The operation collapsed when the Chinese terminal cross-referenced submitted documents against the data of the vessel that actually arrived and identified the fraud. But the fact that it got that far — with the ship loaded, at sea, with falsified papers — lays bare the mechanism with precision. The IRGC did not need Petrobras or UNIPEC to know anything. It needed precisely the opposite: a vessel with a genuinely clean history, on genuinely legitimate routes, so that Iranian oil could reach China with a documentary profile indistinguishable from Brazilian pre-salt crude. The credibility built over years of legitimate exports through the Port of Santos was itself the asset the network needed to acquire — and did acquire, without any Brazilian party needing to know.

The Oceanic Fortune case is singular because it documents, for the first time through a primary source, the use of a genuinely clean route as a pre-clearance tool for a different vessel. It reverses the conventional logic of sanctions evasion. In the operations documented to date, a suspect vessel typically tries to disguise itself as a legitimate one. Here, the opposite happened. The network did not need the Oceanic Fortune to do anything illegal. It only needed the vessel to have a record of legitimate cargoes. The legitimate ship was cloned on paper so that another vessel could deliver sanctioned oil under a risk profile that was not its own.

This finding has direct implications for dismantling the network. The U.S. maritime compliance system — and the screening algorithms used by Chinese terminals that Washington has sought to pressure into adopting stricter controls — is calibrated to identify suspect vessels by looking for anomalies such as duplicate records, disabled tracking systems and false flags. The Oceanic Fortune displayed none of these red flags. For that reason, the case is not merely a failed operation. It is evidence that Iran’s shadow fleet has evolved to a stage in which the most valuable asset is not the ship that carries the prohibited cargo, but the ship that never carries it.

While OFAC continues to designate vessels after the fact — once a ship has already loaded, discharged and changed names — this technique allows the network to systematically build new pedigrees with vessels that may never be designated, because they have never done anything wrong. Closing that gap requires a shift in regulatory approach: from the retrospective tracking of compromised vessels to the proactive detection of pedigree-building patterns — legitimate routes accumulated over short windows, by ships with histories of multiple identities and operated by management companies with no verifiable institutional backing.

On the preceding Monday, May 11 — two days before the scheduled meeting between U.S. President Donald Trump and Chinese leader Xi Jinping — the U.S. Treasury Department imposed a new round of sanctions against three individuals and nine companies accused of helping Iran sell and transport oil to China, directly targeting the same shell-company architecture that appears in the documents of this investigation. Treasury Secretary Scott Bessent framed the measure as part of the Economic Fury campaign, described by the Trump administration as a financial pressure tool against Tehran while peace negotiations remain deadlocked. The State Department went further: it announced a reward of up to $15 million for information that helps dismantle the IRGC’s financial mechanisms.

Fixturenote Oceanicfortune

308KB ∙ PDF file

Download

Download

Q88 Oceanicfortune

510KB ∙ PDF file

Download

Download

Emailchain Vlccsinglevoyage

462KB ∙ PDF file

Download

Download

The Vessel and the Contract

The MT Oceanic Fortune (IMO 9424209) sails under the flag of Liberia, with registered owner listed as HK Xiang Shipping Co., Limited, of Hong Kong. In industry classification, the vessel is a VLCC — Very Large Crude Carrier — measuring 339 meters in length and capable of carrying more than 320,000 metric tons of crude oil per voyage.

The operational manager is New Multimodal Tranz Shipping LLC — a company with a physical address at the Burjuman Business Tower, 10th floor, office 1013, Sheikh Khalifa Bin Zayed Road, Mankhool, Bur Dubai — which also appears in the documents as the recipient of freight payment: an account at Emirates Islamic Bank registered in its name.

A second entity appears in the contract as disponent owner — a term of art in shipping law referring to a party that does not necessarily own the vessel outright but holds operational control of it for the purposes of a specific contract. That entity is Euroship Sea Shipping LLC, also of Dubai. A separate entity, Euroship Int’l Trading & Shipping, signs the negotiation emails. The three form distinct layers of the same structure: the party that negotiates, the party that signs as owner on paper, and the party that receives the money are legally separate entities — a deliberate architecture of asset segregation designed to ensure that sanctions applied to one end of the chain do not paralyze the entire operation.

Picture: shipspotting.com

The vessel’s history is a portrait of the shadow fleet. Built in 2009 by Hyundai Heavy Industries in Ulsan, South Korea, for TMT Co. Ltd. of Taiwan and originally named A Whale, the VLCC cycled through six identities over sixteen years: Madison Orca (August 2014), Cosmo Ace (July 2020), Marine Harmony (March 2023), Oceanic Fortune (August 2023) — the name under which it appears in this investigation — and, from January 2026 onward, Oriental Ark. Each identity change marks an operational cycle: entry into the shadow market, operation, exposure, and re-identification.

The switch to Oceanic Fortune in August 2023 coincides precisely with the start of legitimate voyages chartered by Shell and Sinopec. Two of the biggest names in global energy, on two of the most reputable routes in the South Atlantic, building what the industry calls pedigree: the accumulated trail of AIS data, port records, and certificates of origin that classifies a vessel as low-risk. The most recent switch, to Oriental Ark in January 2026 — seven months after the collapse at Dalian — is consistent with the documented pattern of vessel re-identification following failed or exposed operations.

The Oceanic Fortune’s Q88 — the vessel’s technical data sheet used in charter negotiations, a standardized form that compiles the ship’s name, IMO number, flag, capacity, operator, certificates, equipment, and recent cargo history — records two additional details worth noting. Crew management was handled by Bernhard Schulte Shipmanagement Singapore, one of the world’s largest crewing companies, with 670 vessels under management and more than 30 global offices — a firm operating on the opposite side of the network that recruited the vessel. The Russian master and Filipino, Indian, and Bangladeshi crew members were contracted through BSM according to international STCW standards. (STCW — the International Convention on Standards of Training, Certification and Watchkeeping for Seafarers — is the globally binding framework governing maritime crew qualifications.) BSM’s presence as crew manager was one more layer of legitimacy the vessel carried to any negotiating table. BSM itself had no way of knowing, at the time of contracting, what would eventually be asked of that crew.

The second detail is insurance. The Q88, updated on April 29, 2025, records that the vessel’s P&I Club — Protection and Indemnity insurance, the standard maritime liability coverage that indemnifies shipowners for pollution, injury, and third-party claims — was the American Steamship Owners Mutual Protection and Indemnity Association, headquartered in New York, with validity through February 20, 2025. The hull and machinery insurance, placed with PICC Property and Casualty Company Limited, Tianjin branch, expired on March 5, 2025. When the vessel was presented to the IRGC network in June 2025, its insurance policies had been expired for more than three months. A VLCC carrying 320,000 metric tons of crude oil, navigating without valid pollution coverage, without a recognized underwriter, without protection against accidents at sea.

When Pedigree Becomes a Commodity

On June 4, 2025, the Chengtuo Group sent Euroship a precise solicitation: “We intend to charter a white non-sanction VLCC for single voyage from OPL Singapore to north China ports.” The term “white” is shadow fleet technical vocabulary — a vessel with no alerts in OFAC screening systems, with a clean enough history to dock at Chinese terminals without triggering automated alarms. OPL stands for Outer Port Limit — the offshore anchorage zone beyond a port’s formal jurisdiction, routinely used for ship-to-ship transfers away from port cameras and customs authorities.

The message was copied to info@goldenbusiness.info, the address of Golden Business, the broker that connected the parties and remained copied on all subsequent correspondence. Golden Business is an operating name of Golden Globe Demir Çelik Petrol Sanayi ve Ticaret Anonim Şirketi (GDCP), a Turkish company registered in Küçükçekmece, Istanbul, and incorporated in September 2021. In correspondence leaked by WikiIran, the Chinese company Haokun Energy sent a formal debt letter to the goldenbusiness.info address in December 2025, identifying the recipient as “GDCP” in the document title and addressing the text to “General Mohammadzadeh” — a reference to Ahmed Mohammadzadeh Zadeh, head of the Shahid Pour Jafari Headquarters, the oil-trading arm of IRGC. On July 9, 2025, the U.S. Department of the Treasury designated GDCP as a blocked entity, describing it as a front company that moved hundreds of millions of dollars in Iranian oil sales for the IRGC.

Euroship responded in under an hour. On the same June 4, at 6:53 PM, a full recap was already circulating — including the Owner’s Addendum with clauses AA through GG. The speed is notable: in less than six hours from the initial inquiry, Euroship sent not merely commercial terms but detailed instructions for document falsification, use of a false name by the master, substitution of Bills of Lading, and AIS shutdown. The recap was born with the complete scheme already embedded.

Between June 6 and 9, charterer and shipowner negotiated commercial terms with the same naturalness as any legitimate freight transaction: a freight reduction (from $7.2 million to $7.1 million), adjustments to payment terms, changes to demurrage provisions, extension of the cancellation deadline. The most revealing clause of this phase was negotiated by the charterer itself. In the June 6 email, the Chengtuo Group explicitly requested the inclusion of a sanctions protection clause: “In case of sanction on the DV (Disponent Vessel), charterers have no responsibility against owners.” Euroship accepted without resistance. Read in context, this clause is not standard contractual protection — it is the charterer shielding itself in advance from the liability it already knows it is assuming by operating with a sanctioned mother vessel.

The final freight was fixed at $7.2 million for a single voyage, with an additional $200,000 should the discharge port be specifically Dalian. Demurrage — the daily penalty for delays in vessel operations — was set at $100,000 per day, pro-rated. Payment was structured in four tranches:

• 15% upon signing the charterparty;

• 15% upon the formal Notice of Readiness (NOR) — the master’s notification that the vessel is ready to load or discharge;

• 25% after loading;

• 45% before breaking bulk (before discharge begins).

• All payments in U.S. dollars, deposited into New Multimodal Tranz Shipping LLC’s account at Emirates Islamic Bank.

The charterparty executed was a piece of legal engineering. Of the twenty-five clauses negotiated, six together form a comprehensive manual for evading the six layers of the international maritime surveillance system:

• Clause BB: obligates the shipowner to accept an STS (ship-to-ship transfer) — the transfer of cargo from one vessel to another at sea — with a sanctioned mother vessel designated by the charterers.

• Clause CC: grants the charterers the right to alter all cargo documents — Bills of Lading (the primary shipping documents that serve as receipt of cargo, contract of carriage, and title document), manifests, certificates of origin, quality certificates, and quantity certificates. The clause also carries an explicit instruction: “master must sign with false name on the ullage report” — the ullage report being the document used to measure cargo volume in the vessel’s tanks.

• Clause DD: specifies that the new Bill of Lading must indicate “Iraqi, Malaysian or Singapore port as loading port”, regardless of where the cargo was actually loaded. These are three pre-approved alternative origins for operational reasons: Iraq and Malaysia are among the jurisdictions most frequently used to launder Iranian oil within the global sanctions-evasion architecture; Singapore appears as a fallback should the other two be under additional scrutiny.

• Clause FF: transfers to the charterers control over the vessel’s AIS — the Automatic Identification System, the mandatory transponder that broadcasts a vessel’s identity, position, speed, and course to maritime authorities and commercial tracking platforms worldwide. The clause states: “AIS instructions will be informed by charterers prior to STS transfer and owners shall follow after verification.”

• Clause GG: consolidates the parties’ joint knowledge of the fraud. The text states that the owners were aware that the charterer would redo the documentation after loading, including but not limited to altering the cargo type, loading port, document date, and country of origin.

• Clause 23: formalizes AIS shutdown as a contractual obligation — and goes further. The clause states that the vessel was equipped for position simulation: not merely silence in tracking, but false presence at pre-determined coordinates in Malaysia, while the vessel sailed toward China.

On June 10, 2025 — the day Euroship sent the Q88 demanding urgent return of the signed fixture note (the document that formally confirms the main terms of a charter) — the Chengtuo Group detected the first anomaly: “The ship name in the contract and the ship in Q88 are not the same.” The name in the contract was TBN — to be named — but the Q88 carried the Oceanic Fortune. It is in the Q88 that the essential vessel data appear — name, IMO, flag, capacity, operator, certificates, equipment, and recent cargo history. In the Oceanic Fortune’s case, the Q88 was decisive precisely because it documented the pedigree that made the vessel attractive to the network.

A Two-Track Operation

While Euroship was negotiating the Oceanic Fortune with the Chengtuo Group, a second contract was being stitched together in parallel. Not with Euroship. Not with the Oceanic Fortune. And not under the commercial name Chengtuo Group, but under the charterer’s real legal identity: Jiandi HK Limited, a Hong Kong limited company designated by OFAC in May 2026.

The intermediary in this second contract was NAB Shipping, operating through an anonymous email address — tankchart29@protonmail.com — and consistently copying a second manager, Navfleet. The vessel on offer was the MT CS Aura: a Suezmax tanker 274 meters long, approximately 160,000 metric tons deadweight, flying the flag of Tanzania, IMO 9225081.

The IMO number — assigned by the International Maritime Organization, the UN agency that governs global shipping — is the permanent identification number of a vessel. Unlike the ship’s name, flag, or call sign, all of which are mutable and negotiable in the gray market of maritime registration, the IMO follows the vessel’s hull from construction to scrapping. It is the ship’s social security number. And IMO 9225081 has a history.

That number was born Turkish. On December 31, 2001, the shipyard delivered to DITAS Deniz İşletmeciliği ve Tankerciliği A.Ş. — a subsidiary of the Koç Group, one of Turkey’s largest industrial conglomerates — a 274-meter Suezmax tanker named Cumhuriyet. The name means “republic” in Turkish. For two decades, the vessel carried oil under the national flag, integrated into a conventional commercial fleet with a clean port state control inspection record. In January 2022, DITAS removed it from its fleet and sold it.

The destination recorded by vessel recycling monitoring platforms is Chittagong, Bangladesh — the world’s largest ship-breaking yard, where hulls are beached and cut by hand. Price: $610 per ton. The Cumhuriyet was supposed to die there. It did not. The hull left Turkey as Blue Dhir, reflagged to Gabon, MMSI 626180000, call sign TRAF5. In May 2025 — three years after the supposed beaching — platforms including MyShipTracking and VesselFinder were recording the Blue Dhir as active in the Arabian Sea.

Then, in June 2025, the same IMO 9225081 reappeared in tracking databases under a second profile: CS Aura, MMSI 677081600, flag Tanzania, call sign 5IM916, registered owner Orenda Marine Limited, Trust Company Complex, Ajeltake Road, Ajeltake Island, Majuro — Marshall Islands, the classic jurisdiction for flags of convenience. One IMO number. Two living ships.

On June 10, 2025 — the same day Euroship was sending the Oceanic Fortune’s Q88 — NAB Shipping was sending the Chengtuo Group the recap of the CS Aura’s Charter Party. On the same day, the Chengtuo Group detected the first anomaly in the parallel Euroship negotiation: “The ship name in the contract and the ship in Q88 are not the same.” Instead of clarifying, Euroship responded the following day with urgency and a deadline: “It is imperative that the signed fixture note is returned by 16:00 (UAE time).” The discrepancy was steamrolled by pressure.

On June 11, the CS Aura tendered Notice of Readiness. On the same day, the contract was signed by Jiandi HK Limited. On June 12, with the first freight installment paid (MT103 wire transfer attached), Jiandi sent NAB Shipping the complete voyage instructions:

• Mother vessel: MT TAURUS, IMO 9259745. Satellite phone: +86 21 36812954. Email: eternalpeace@marimail.com.

• Cargo: 1,000,000 barrels of crude oil, API 29.9, temperature 20.8°C.

• STS location: OPL Singapore, with transfer at IPL Muar / Pasir Gudang, Malaysia.

• Cargo surveyor: Meras Venus Sdn Bhd, office in Seri Kembangan, Malaysia.

• AIS simulation coordinates for Pasir Gudang — four fictitious anchorage points in Malaysian waters, where the CS Aura’s transponder would broadcast a false position while the vessel sailed toward China.

The coordinates were: 01°27.300’N / 104°20.500’E, 01°25.000’N / 104°20.150’E, 01°25.000’N / 104°20.450’E, and 01°19.550’N / 104°15.110’E. All four points are located in the Pasir Gudang area, off the southeastern coast of Johor, Malaysia, facing Singapore and the eastern entrance to the Strait of Malacca. Points 1, 2, and 3 appear clustered in an offshore waiting area used by vessels awaiting orders, freight, inspection, or clearance to proceed. Less than 15 km from the Port of Singapore and within the OPL zone described in the contracts as the STS location, the area provides an ideal setting for simulation: on AIS, a vessel transmitting from amid a line of waiting tankers would be difficult to distinguish from the rest.

The vessel departed loaded. In the weeks that followed, as it navigated toward northern China, the operators were attempting to resolve the documentary inconsistency by email.

On June 13, 2025, the CS Aura’s master, Captain Mao Yong, writing from an address with a short-lived domain — cs_aura@omld.top — replied to NAB Shipping with a single operational question: “Well received the information. But I would like to know when we will start the AIS simulation (for Pasir Gudang).” The master was awaiting the order to activate the false position system before the STS operation began.

And on that same June 13, with the CS Aura on the verge of initiating its ship-to-ship transfer with the MT TAURUS off the Malaysian coast, the Chengtuo Group sent Euroship a terse email announcing the cancellation of the Oceanic Fortune contract: “For certain reasons, we are not considering chartering a vessel for the time being.” The two events on the same day are not coincidence. They are confirmation that the real operation was somewhere else.

The MT TAURUS is itself a vessel with a shadowed history. Built in 2004 as Da Li Hu, it operated as Lila Shenzhen (August 2022) and Eternal Peace (November 2022 through 2024) before becoming the TAURUS. It is currently sanctioned by all three major Western jurisdictions: the United States (OFAC), the European Union, and the United Kingdom (OFSI). The U.S. designation, issued in September 2024, ties the vessel to sanctioned company Star Ocean Shipmanage Ltd. The European Union applied sanctions in May 2025 for the transport of Russian oil in violation of the G7 price cap, through ship-to-ship transfers in the Black Sea and near Novorossiysk.

When Jiandi HK Limited designated the TAURUS as the mother vessel on June 12, 2025, the ship had already been under American sanctions for nine months. It was precisely Clause BB of the Oceanic Fortune contract that anticipated this: the contractual obligation for the shipowner to accept an STS operation with a sanctioned mother vessel, with full knowledge of its status.

The Collapse at Dalian

On June 23, 2025 — ten days after the supposed withdrawal from the Oceanic Fortune contract — the Chengtuo Group reappeared in the email chain with Euroship carrying information that had not been requested: the port of Dalian was signaling it would reject a vessel’s berthing if the identity inconsistency were not urgently clarified. The message read: “This vessel is likely the so-called shadow ship, produced in 2001. However, it might be subject to sanctions. Therefore, a scrapped vessel with a call sign from around 1998, close to its own production year, was found for use. Please urgently clarify the fact, otherwise the discharge port will reject the berthing.”

The technical description did not match the Oceanic Fortune. The Oceanic Fortune’s Q88 records a year of construction of 2009, at Hyundai Heavy Industries. But it matched precisely with the CS Aura — the former Cumhuriyet, built in 2001, in exactly the range described by the port. The vessel arriving loaded at Dalian was not the vessel named in the contract with Euroship.

On June 24, the rejection was formalized: “As this vessel has been confirmed by Dalian Port as a vessel with false identity, Dalian Port has explicitly rejected its berthing plan. There are obvious fraudulent behaviors in the vessel’s certificates and qualifications.”

Dalia Port / Photo: CHINA NEWS SERVICE

On June 26, the complete picture surfaced in a single email. Captain Mao Yong sent the Dalian agent his Free Pratique Letter of Protest — the LOP (Letter of Protest), a formal maritime document by which a master records objection to conditions or decisions that affect the vessel — formally identifying himself as master of the MT CS Aura, writing from cs_aura@omld.top. When the Chengtuo Group forwarded the message to Euroship, it did something revealing: it signed as Jiandi HK Limited. It was the first time, in the entire chain, that the charterer’s real legal identity appeared. And in forwarding the port’s rejection notification, Jiandi addressed it simultaneously to two recipients — cs_aura@omld.top and chartering@euroshiptrading.com. The CS Aura’s master and Euroship’s chartering desk receiving the same notification, in the same email, about the same operation.

Euroship responded with the most surprising message in the entire chain: “We don’t understand — please clarify which vessel this is??? We have not signed any contract with you!!!!!” Five exclamation points. A performance of indignation. The problem is that the preceding email chain documents the opposite: Euroship, under the signature of Matin, Chartering Manager, negotiated, drafted, sent a recap, demanded return of the signed fixture note, and threatened loss of terms if the charterer did not respond within the deadline — all over three weeks, with the same Chengtuo Group/Jiandi. The denial does not erase the twenty preceding messages. It documents a strategy: by substituting a different vessel — the CS Aura — for the contracted vessel — the Oceanic Fortune — without formally notifying the charterer, and then denying any relationship with the recipient when the fraud is detected, Euroship attempts to create a situation in which neither party can take legal action against the other without exposing its own participation in the scheme.

The CS Aura’s Statement of Fact, sent two days later, on June 26, records the arrival chronology with port-level precision:

• 10:30 a.m. local time — the vessel declared EOSP (End of Sea Passage), the end of open-sea navigation and the point at which the ship reaches the port waiting area.

• 12:00 p.m. — the vessel anchored at Dalian OPL (Outer Port Limit), an anchorage zone outside the port’s formal limits, where ships wait for authorization to enter, undergo inspection, or proceed to berth.

• 12:00 p.m. — the vessel tendered NOR (Notice of Readiness), the formal notice by which the master informs that the ship is ready to begin loading or discharging operations.

• June 27, 9:24 a.m. — the log recorded “anchor aweigh,” a nautical expression indicating the moment when the anchor is lifted and the vessel begins to move. The CS Aura then left the OPL and proceeded toward the inner anchorage.

• 1:18 p.m. — the vessel anchored at the inner anchorage, the anchorage area within the port’s operational zone.

• 1:18 p.m. — the vessel re-tendered NOR, formally renewing its notice of readiness after changing position.

• June 28 — the vessel was still awaiting berthing instructions.

The port had identified that the arriving vessel was using the call sign of a vessel scrapped around 1998. The technique is sophisticated: call signs are registered with the International Telecommunication Union (ITU) and appear in Lloyd’s Intelligence and IHS Markit databases. By adopting the call sign of a vessel already demolished — with comparable size and type — a shadow ship passes through automated screening systems that verify only whether the call sign exists in databases and corresponds to a compatible vessel type, but do not verify whether that specific IMO number should carry that call sign. IMO 9225081, the Cumhuriyet/CS Aura, carried a 1998 call sign — three years older than the hull itself, which was not built until 2001. Dalian Port cross-referenced the two data points. The inconsistency between the call sign year and the vessel’s construction year brought the operation down.

Two hypotheses emerge here — and neither is comfortable for Euroship. In the first, the Oceanic Fortune was genuinely contracted as the vessel for the operation, and at some point between June 10 and 13 it was substituted by the CS Aura without formal notification to the charterer. That would constitute a serious contract breach. In the second, the Oceanic Fortune was never the real vessel for the operation. Its function, from the beginning, was to serve as a documentary facade — a Q88 with an impeccable Brazilian pedigree to submit to the Dalian terminal and obtain advance approval, while the CS Aura, with its manipulable identity, was always the vessel that would actually be used. This second hypothesis is a known tactic in the shadow fleet: separating the vessel of the documents from the vessel of the cargo. In either case, the instrumental use of the Brazilian pedigree is the same. The Q88 that opened Dalian’s door was the one from the vessel that called at Santos. What walked through the door was something else.

What the Dalian collapse reveals, however, is not the efficiency of the control system — it is the opposite. The terminal rejected the vessel because of a technical error the network itself committed: an inconsistency between two documents circulating simultaneously. Hengli Petrochemical, the Dalian refinery designated by OFAC in April 2026 as “one of the largest buyers of sanctioned Iranian oil,” sits a few kilometers from the same terminal that refused the CS Aura. Other vessels from the same network — the MT CANGJIE, the MT ATLANTIS I — arrived at Dongying and discharged. The scheme did not fail because it was detected by a Western authority. It failed because it tripped over itself inside the Chinese port system.

On May 15, 2026 — two days after WikiIran published the documents — the Oceanic Fortune, now renamed Oriental Ark, was navigating the Persian Gulf toward Jebel Dhanna, the UAE’s crude oil export terminal, inbound from Singapore. AIS tracking via VesselFinder confirms the IMO, flag, and call sign as identical to those in the investigated Q88. The vessel continues to operate. Only the name changed.

Brazil on the IRGC’s Map

The Oceanic Fortune is not the only thread connecting the Iranian regime to Brazil in WikiIran’s archives. Over 2024 and 2025, the platform exposed two parallel Iranian Armed Forces systems with architecture identical to the Shahid Pour Jafari Command: Sepehr Energy Jahan (SEJ), the oil arm of the Armed Forces General Staff, and Sahara Thunder, the analogous arm of the Ministry of Defense. In June 2025, WikiIran concluded that the two structures are “two sides of the same coin” — both operate shell companies in the UAE, China, and Hong Kong, relabel Iranian oil with falsified documents, and conduct ship-to-ship transfers at sea.

The list of countries used as documentary cover is, across all three networks, nearly identical: SEJ relabeled cargoes as Malaysian; Sahara Thunder as Iraqi; the Pour Jafari Command instructs its masters to declare Iraqi, Malaysian, or Singaporean ports. This is not coincidence. It is operational doctrine shared across the regime’s three military arms.

It was through the SEJ that Brazil first appeared in these archives. In investigations published between 2023 and 2025, WikiIran documented that this network directly negotiated with a Brazilian intermediary to insert up to six million barrels per month of Iranian oil into the country, disguised as cargo from the UAE, for sale to Petrobras. The intermediary was Roberto Viana Batista Júnior, founder of Petra Energia S.A. — a company that, according to the Brazilian outlet O Bastidor, maintained a close relationship with Defense Minister José Múcio. Múcio himself reportedly intermediated contacts between Viana Batista and the government, according to the same publication. Viana Batista’s Iranian contact, Elyas Niroomand Toomaj, was designated by OFAC in November 2023 under U.S. counterterrorism legislation.

The presence of an intermediary with those connections at the center of a sanctioned oil import scheme is not an isolated episode. It fits within a pattern of government conduct that, since January 2023, has systematically signaled what sanctions compliance means in practice.

The Lula Government and Iran

The proximity of the Lula government to the Iranian regime is not the product of circumstance or bureaucratic failure. It is doctrine with personal continuity. Celso Amorim — the diplomat who in 2010 architected the Tehran Declaration, the trilateral Brazil-Turkey-Iran nuclear agreement rejected by the Obama administration — returned in January 2023 as Special Presidential Advisor. The third Lula term resumed precisely where the first had left off.

Brazilian Vice President Geraldo Alckmin at the inauguration of Iranian President Masoud Pezeshkian. In the photo: Alckmin appears alongside the leader of Hamas and representatives of Islamic Jihad, Hezbollah, and the Houthis.

The third Lula term resumed precisely where the first had left off. The rapprochement with Tehran moved beyond diplomacy and began to appear in concrete decisions, official statements, and sensitive operations involving vessels, sanctions, and Iranian cargoes. Brazil’s practical posture toward Iran can be traced through a series of concrete decisions:

• 2019 — MV Bavand and MV Termeh at Paranaguá
  In 2019, the vessels MV Bavand and MV Termeh, operated by Sapid Shipping Co. — designated by OFAC — arrived at Paranaguá to load corn destined for Iran, part of the commercial circuit maintained by Eleva Química, Brazil’s largest historical importer of Iranian urea. Petrobras refused to bunker the vessels. The Paraná state court granted an injunction compelling the fueling, but Petrobras appealed. The then-president of Brazil’s Supreme Court (STF), Justice Dias Toffoli, denied the appeal and upheld the order. Petrobras bunkered the vessels.

• February 2023 — Iranian Warships at Rio de Janeiro
  In February 2023, the Lula government authorized the docking of the Iranian warships IRIS Makran and IRIS Dena at the Port of Rio de Janeiro. U.S. Ambassador Elizabeth Bagley stated publicly that “these ships should not dock anywhere.” The Lula government ignored the objection.

• August 2023 — Lula Criticizes Unilateral Sanctions at BRICS Summit

  On the margins of the BRICS Summit in Johannesburg, Lula strongly condemned unilateral international sanctions, calling them harmful instruments that violate sovereignty and multilateral principles. He advocated for alternatives to the dollar-based financial system (such as local-currency payments) to mitigate their effects, particularly on countries under sanctions.

• July 2024 — Alckmin at the Iranian Presidential Inauguration
  In July 2024, Lula sent Vice President Geraldo Alckmin to the inauguration of Iranian President Masoud Pezeshkian. At the ceremony, Alckmin was photographed seated near Hamas leader Ismail Haniyeh and representatives of Islamic Jihad, Hezbollah, and the Houthis.

• June 2025 — Brazil Condemns Strikes on Iran’s Nuclear Program
  In June 2025 — ten days after the beginning of American and Israeli strikes on Iranian nuclear facilities — Brazil issued, as rotating BRICS president, a joint statement condemning the strikes as a “violation of international law and the UN Charter.” The Brazilian BRICS presidency converted the multilateral mechanism into diplomatic cover for the Iranian regime at the precise moment the networks documented by WikiIran were operating at maximum intensity.

• September 2025 — Emergency BRICS Summit Against U.S. Sanctions
  In September 2025, Lula convened an emergency virtual BRICS summit to denounce U.S. secondary sanctions as “tariff blackmail” and a “threat to sovereignty” of countries that trade with “friendly nations.” Brazil’s formal position, articulated publicly and through multilateral instruments it controlled, was that the mechanism the United States uses to enforce sanctions against Iran is illegitimate. That was the political ceiling under which every Brazilian regulatory agency operated between 2023 and 2025.

• September 2025 — Iranian Urea with Swapped Documentation at Paranaguá
  Still in September 2025, journalist Claudio Dantas revealed that Brazilian importers had been bringing Iranian urea into the country through altered documentation. In one case, the cargo transported by the vessel The Strong had Pardis Petrochemical listed as exporter on the original Bill of Lading. The BL delivered at Paranaguá, however, listed East Oil Petroleum, of Dubai, as exporter, with the port of origin changed to Khor Fakkan, Oman. It was, in practice, the same method attempted by the Oceanic Fortune at Dalian: switching the cargo’s documentary origin to conceal its Iranian connection.

• September 2025 — LB ENERGE and Megeve on the Same Route
  Dantas’s reporting identified additional similar occurrences. The bulk carrier LB ENERGE, sailing under a Panamanian flag, was discharging a urea cargo at Paranaguá imported by Link Comercial, with evidence of documentation substitution: the vessel had departed from Iran, but the paperwork indicated Oman as origin. Another Pardis Petrochemical urea shipment was en route to Paranaguá aboard the Megeve, flying a Liberian flag, imported by Blacklake Ltda. A port operator had gone so far as to email the Megeve’s master alerting that swapping the Iranian port of origin in the documents could constitute document forgery and manipulation.

• October 2025 — Delruba at Santa Catarina
  The Delruba, an Iranian-flagged vessel subject to OFAC secondary sanctions, docked at the Terminal Portuário de Santa Catarina (TESC), in São Francisco do Sul, and discharged approximately 60,000 metric tons of urea. Customs documents indicated the cargo originated from Pardis Petrochemical, also under U.S. sanctions. Pardis is a subsidiary of the National Petrochemical Company, linked to Iran’s Ministry of Petroleum and identified by OFAC as a structure used to finance the Revolutionary Guard.

• October 2025 — GANJ Refused at Imbituba
  In October 2025, the vessel GANJ, linked to the Iranian government and loaded with Pardis Petrochemical urea, was refused by the Port of Imbituba. With no operator willing to handle the operation in Santa Catarina, the vessel remained at anchor near Paranaguá;

• 2026 — David Y and Another Pardis Cargo
  Between December 2025 and January 2026, another case emerged in southern Brazil: the MV David Y remained at anchor at Paranaguá before being moved to São Francisco do Sul, also carrying urea produced by Pardis Petrochemical. The cargo’s importers were not publicly identified.

The Oceanic Fortune case did not emerge in a vacuum. What the vessel attempted in China — substituting a cargo’s documentary origin, using commercial intermediaries, and presenting Iranian oil as coming from a different jurisdiction — had already appeared in operations connected to Brazil. The difference is that at Dalian, the Chinese terminal cross-referenced the vessel’s data, identified the false identity, and refused the berthing.

These episodes do not make Brazil the operator of the fraud. They show something else: Iranian networks found in the country a useful environment for building maritime track records, testing regulatory gaps, and circulating cargoes with sensitive documentation.

Brazil does not have domestic legislation that mirrors OFAC sanctions — a regulatory vacuum that Iran-linked networks know and exploit. A president who publicly describes sanctions as a “criminal weapon” is not merely expressing a foreign policy preference. He is setting the practical ceiling under which every port authority, customs inspector, and financial intelligence analyst in the country will calibrate their decisions. The result is an environment of permissiveness that does not require conspiracy to function. It requires only the absence of political will to close it.

WikiIran treats these leaks as a priority because the Iranian oil sold outside sanctions is not merely a clandestine commodity. It feeds the financial structure that sustains Hezbollah in Lebanon, the Houthis in Yemen, militias in Iraq and Syria, and Tehran’s ballistic missile program. That is why it matters to find, in the archives of an Iranian military command, a supertanker with a recent legitimate cargo history at the Port of Santos.

---

Read more: