cyber.hendryadrian.com
Security Report · recordedfuture.com

Report Finds 36 Fake Maritime Websites Likely Aid Sanctions Evasion

· Original article ↗

Summary

Recorded Future's Insikt Group identified more than 36 inauthentic maritime websites across three linked clusters, likely used by Iranian- and Russian-linked sanctions-evasion networks to impersonate authorities and generate fraudulent ship and seafarer documents.

Key points

  • Insikt Group identified more than 36 inauthentic websites across three partially overlapping clusters associated with Iranian and Russian shadow fleet sanctions-evasion activity.
  • The sites impersonate maritime administrations, ship registries, classification societies, seafarer training bodies, and P&I clubs to lend credibility to fraudulent organizations and documents.
  • A Cluster Alpha web application generated PDF seafarer certificates for Benin, the Comoros, and Malawi, with QR codes linking to the documents.
  • An open directory held more than 30 documents generated by the tool, including certificates for crew associated with vessels the report links to shadow fleet activity; some named vessels are sanctioned.
  • The report connects the clusters through shared infrastructure, domain patterns, documents, and other overlaps. It links Cluster Alpha partly to Indian web developer Oceaniek Technologies and Cluster Bravo to two Syrian nationals; Cluster Charlie remains unattributed.
  • The researchers recommend independent verification and cyber threat intelligence in maritime due diligence, and coordinated government efforts to identify and disrupt fraudulent infrastructure.

Article Details

Publisher
Recorded Future (Insikt Group)
Report Period
Activity documented through late April 2026; cited domain registrations date from June–October 2025.
Scope
Three linked clusters of inauthentic maritime websites associated with sanctions evasion and shadow fleet activity.
Sample Size
More than 36 inauthentic websites; explicit links to 17 vessels.
Key Statistics
  • Insikt Group identified more than 36 inauthentic websites across three clusters.
  • The websites were explicitly linked to 17 vessels; the majority had already been sanctioned by the US OFAC and other countries.
  • Cluster Alpha included 11 websites, Cluster Bravo included 7, and Cluster Charlie included at least 14.
  • An open directory on pdf[.]beninmaritime[.]co contained over 30 fraudulent documents.
Recommendations
  • Maritime and shipping organizations should incorporate independent verification and cyber threat intelligence into due diligence workflows.
  • Governments targeted by impersonation should monitor fraudulent ship registry and maritime administration websites and coordinate identification and disruption of the infrastructure.
  • Governments should share information across organizations to support responses to multi-jurisdictional flag fraud.
  • Track new domain registrations that impersonate maritime administrations and registries mentioned in the report.
  • Track AIS locations for vessels identified in the report.

Indicators of compromise

TypeIndicatorContext
DOMAINalliance-scs[.]orgWebsite for a likely inauthentic classification society that endorsed other websites in Cluster Charlie.
DOMAINatlasregister[.]netListed as an inauthentic ship registry website in Cluster Alpha.
DOMAINbeninmaritime[.]bjListed as an inauthentic site in Cluster Alpha impersonating Benin maritime authorities.
DOMAINbeninmaritime[.]coInauthentic Benin Maritime Administration site hosting a certificate generator for fraudulent seafarer documents.
DOMAINbeninmaritime[.]netInauthentic Benin Maritime Administration website linked to the report’s fraudulent maritime infrastructure.
DOMAINbeninmaritime[.]orgInauthentic website impersonating the Benin Maritime Administration and offering fraudulent flag registration.
DOMAINbtn-shipreg[.]comListed as an inauthentic ship registry website in Cluster Charlie.
DOMAINchad-maradmin[.]orgListed as an inauthentic website impersonating a maritime administration in Cluster Charlie.
DOMAINepnicaragua[.]orgInauthentic Nicaragua maritime site containing documents attributed to the fraudulent website cluster.
DOMAINguve[.]bjTyposquatted domain used in a spoofed version of a real Benin ship-registry contact address.
DOMAINhaiti-shipreg[.]comListed as an inauthentic ship registry website in Cluster Charlie.
DOMAINhellasnaval[.]netWebsite impersonating the likely inauthentic Hellas Naval Bureau of Shipping.
DOMAINimsnaval[.]comWebsite for International Marine Services, described as a likely fraudulent organization in Cluster Bravo.
DOMAINimspanel[.]comHosted a login panel associated with likely fraudulent maritime classification organizations.
DOMAINisithin[.]comWebsite for the International Seafarers Institute, identified as part of the inauthentic Cluster Bravo.
DOMAINmarinegov[.]orgCluster Bravo domain with a subdomain impersonating the Malawi Maritime Administration.
DOMAINmedlloyd[.]onlineWebsite for the likely inauthentic Med Lloyd Classification Society, linked to fraudulent vessel certificates.
DOMAINmedlloyd[.]orgWebsite for the likely inauthentic Med Lloyd Classification Society.
DOMAINnauticacentro[.]mxWebsite impersonating a seafarer training institute and hosting a queryable certificate database.
DOMAINniataregister[.]orgListed as an inauthentic ship registry website in Cluster Alpha.
DOMAINpioneersmaritime[.]comWebsite for a likely inauthentic maritime service provider that claimed flag authorizations and endorsed other Cluster Charlie sites.
DOMAINsasmaa[.]clubWebsite impersonating a P&I club and listing Pioneers Maritime Ship Management as a correspondent.
DOMAINzambiamaritime[.]orgLikely fraudulent website impersonating the Zambian Maritime Administration and linked to Cluster Charlie.
DOMAINzambmaritime[.]orgListed as an inauthentic ship registry and classification website in Cluster Charlie.
HOSTNAMEmalawi[.]shipregistry[.]marinegov[.]orgInauthentic website impersonating the Malawi Maritime Administration and displaying a certificate for a sanctioned vessel.
HOSTNAMEpdf[.]beninmaritime[.]coHost of a certificate generator and open directory containing fraudulent maritime documents.
IPV4159[.]198[.]36[.]123Shared hosting IP for multiple domains associated with likely fraudulent maritime organizations.
IPV4217[.]76[.]51[.]133Hosting IP for the Cluster Charlie network of inauthentic maritime websites.

MITRE ATT&CK

T1036.005 · Match Legitimate Resource Name or LocationWebsites impersonated maritime administrations, ship registries, classification societies, and training organizations.T1583.001 · DomainsThe report describes registration and use of multiple inauthentic domains to support maritime impersonation and sanctions evasion.T1583.006 · Web ServicesThe report describes the inauthentic website infrastructure being hosted across web services and IP ranges.

People

Christian PantonIndependent researcher whose prior reporting on related activity is cited; the article says he collaborated with Bellingcat and Lloyd’s List.

Vendors

Oceaniek Technologieslinked clusters and is associated with vessels and organizations including Benin, the Comoros, Oceaniek Technologies, Med Lloyd Classification Society, Hellas Naval Bureau of Shipping, and Pioneers Maritime Ship

Countries

BeninThe infrastructure spans three linked clusters and is associated with vessels and organizations including Benin, the Comoros, Oceaniek Technologies, Med Lloyd Classification Society, Hellas Naval Bureau of Shipping, andBhutanmaritime administrations and ship registries from countries such as the Comoros and Benin, as well as Bhutan, Cameroon, Chad, Equatorial Guinea, Gambia, Haiti, Malawi, Nicaragua, and Zambia.BruneiAt least fourteen inauthentic websites in this cluster impersonate ship registries from countries such as Bhutan, Brunei, Cameroon, Chad, Equatorial Guinea, Haiti, and Zambia.Cameroonadministrations and ship registries from countries such as the Comoros and Benin, as well as Bhutan, Cameroon, Chad, Equatorial Guinea, Gambia, Haiti, Malawi, Nicaragua, and Zambia.Chadand ship registries from countries such as the Comoros and Benin, as well as Bhutan, Cameroon, Chad, Equatorial Guinea, Gambia, Haiti, Malawi, Nicaragua, and Zambia.Comorosspans three linked clusters and is associated with vessels and organizations including Benin, the Comoros, Oceaniek Technologies, Med Lloyd Classification Society, Hellas Naval Bureau of Shipping, and PioneersEquatorial Guineaship registries from countries such as the Comoros and Benin, as well as Bhutan, Cameroon, Chad, Equatorial Guinea, Gambia, Haiti, Malawi, Nicaragua, and Zambia.Gambiafrom countries such as the Comoros and Benin, as well as Bhutan, Cameroon, Chad, Equatorial Guinea, Gambia, Haiti, Malawi, Nicaragua, and Zambia.Haiticountries such as the Comoros and Benin, as well as Bhutan, Cameroon, Chad, Equatorial Guinea, Gambia, Haiti, Malawi, Nicaragua, and Zambia.Indiathree vessels also exhibit common registration patterns via front companies registered in the Seychelles, India, and the United Arab Emirates (UAE):Iranand the resulting detention.” In November 2020, the non-governmental organization United Against Nuclear Iran (UANI) had flagged SERANO II as being likely part of the Iranian shadow fleet.Malawisuch as the Comoros and Benin, as well as Bhutan, Cameroon, Chad, Equatorial Guinea, Gambia, Haiti, Malawi, Nicaragua, and Zambia.Nicaraguaas the Comoros and Benin, as well as Bhutan, Cameroon, Chad, Equatorial Guinea, Gambia, Haiti, Malawi, Nicaragua, and Zambia.Russiaan Indian company accused of becoming “the largest carrier of Russian oil” since the start of the Russia-Ukraine war.SyriaOperations Platform shows that HNBS-linked bulk carrier GOLDEN LEO (9181833) made several trips between Syria, Türkiye, and Black Sea ports in Romania and Bulgaria since September 2025.United Arab Emiratescommon registration patterns via front companies registered in the Seychelles, India, and the United Arab Emirates (UAE):Zambiaand Benin, as well as Bhutan, Cameroon, Chad, Equatorial Guinea, Gambia, Haiti, Malawi, Nicaragua, and Zambia.

Industries

Maritime and shippingOrganizations in the maritime and shipping sectors should integrate independent verification and cyber threat intelligence into compliance workflows to proactively identify fraudulent online infrastructure.