Massive fraudulent flag operation linking over 20 separate fake sites uncovered
AT LEAST 21 separate fraudulent ship registries and seafarer certification bodies created in the past year and half can all be linked back to a single source, according to a Lloyd’s List investigation.
The recent proliferation of fake ship registers purporting to represent non-existent government entities has accelerated significantly over recent months, fuelled by rapidly growing lists of sanctioned ships seeking ship registers to sustain operations.
However, the investigation which examined dozens of fraudulent registration documents and traced links between hundreds of web domains, reveals the scale of the problem is significantly larger than previously assumed.
According to the International Maritime Organization’s GSIS database, there are currently 306 fraudulently flagged ships in operation, registered to 29 separate fraudulent flags.
However, Lloyd’s List has uncovered an additional 21 fraudulent flag and crewing operations not included in GSIS, all linked to a single operation via an online domain — marinegov.net.
The investigation, which was conducted in conjunction with independent open-source intelligence analyst Christian Panton, has also linked a separate operation, thought to be based in China, that is behind at least three other fraudulent flag registers: Matthew Islands, Sint Maartin and Timor Leste.
It has also revealed how the groups of scammers are outpacing national government and IMO attempts to track the frauds.
In total, Lloyd’s List has now identified at least 50 fraudulent sites created to produce ship registration and seafarer certification with no authority from the governments they falsely claim to represent.
These websites have, in most cases, emerged since the beginning of 2024.
The largest of these operations, operating under the Marinegov.net domain name, can be traced to a total of 13 live sites currently in operation that purport to be government approved ship registers or national maritime authorities. However, Lloyd’s List has also uncovered an additional 11 further sites that are currently either dormant or still under construction, all linked back to the same single fraudulent operation.
While the sites often share similarities in text, functionality and style, these fake maritime administrations are all designed to look like genuine government-backed services. Many of them even share almost identical URL addresses to real registries and routinely use QR codes to obscure links between documents of real websites and fake ones.
The Namibian Department of Maritime Administration, for example, claims to operate under a non-existent Directorate General of Shipping. Similarly, the fake Cameroon Maritime Administration operates an entirely fictitious ship registration and seafarer licencing department, while Cambodia now boasts two entirely fraudulent entities: a Directorate General Shipping, Cambodia (Merchant Marine Dept) and a Cambodia Maritime Administration.
In all cases a digital interrogation of the web pages behind these websites link back to a single domain — Marinegov.net. Behind the official-looking facades, the online pages built off basic blogging technology reveal how these sites area created using gambling website templates and holding text that is copied and pasted from one site to the next in quick succession.
Some sites are more successful than others at hiding their fraudulent roots. Several contain sloppy mistakes, which reveal links unintentionally. Slovakian certificates appearing in one website, also appear in a Peruvian site, for example. Meanwhile, the search function on another site reveals forgotten text from previous incarnations of entirely separate fraudulent registries when via an error code.
By mapping the code and domain names back to the hosting servers, it is possible to connect the dots between at least 21 individual sites that all stem from the single Marinegov.net source.
While the scammers have been careful not to leave any traces of their identities, several of the sites share domain registration links with a Bangladesh-based design agency. Lloyd’s List has not been able to verify whether that agency has played a role in any of the fraudulent operations.
The links between the fake flags, however, does reveal how the recent expansion of fraudulent flags has accelerated so quickly.
Lloyd’s List revealed the Malawi Maritime Administration to be a fraudulent operation on June 19, prompting the Malawian government to issue a warning to the IMO days later.
At the point, the fake flag had registered just four ships. The fake website was shut down following the government warning and widespread press coverage, but that has not prevented the entirely fictional Malawian flag from amassing 40 tankers in less than a month. All of the tankers are subject to sanctions. The IMO’s GSIS database only recognises 26 of those 40 ships as having switched, highlighting the delay in identifying the frauds.
Once a fraudulent flag becomes too popular and attracts too much attention, however, others will quickly emerge from the extensive cache of dormant fake registries already either sitting dormant, or under construction.
A previously Panama-flagged tanker, Clio, formerly Freya (IMO: 9238052) flagged to Malawi via several name changes earlier this month having left another fraudulent flag purporting to represent Guyana. But Freya has already moved again, its second flag change in two weeks, to join Angola — another fraudulent flag linked to Marinegov.net that is so new the website is still under construction.
The rapid pace of new fraudulent registries being constructed is also allowing the scammers to evolve increasingly sophisticated operations with each iteration.
Earlier this month, Lloyd’s List revealed how the Timor Leste flag had been used by scammers, at that point attracting eight sanctioned ships.
By tracking back the web domain history of that site Lloyd’s List can conclusively link the Timor Leste site to two previous frauds: the Maritime Administration of the Matthew Islands (a tiny volcanic island in the South Pacific inhabited only by seabirds), and the Sint Maartin Registry.
While both of those fake flags have only attracted a handful of tankers, the Timor Leste operation signals growing ambition. Lloyd’s List was able to look behind the website to see the dozens of fake registration licences, insurance documents and seafarer certification, all created in PDF documents for either ships that are not yet flagged to Timor Leste.
Dozens of the fake certificates, seen by Lloyd’s List, are dated from this month and have IMO and MMSI numbers for ships that have either already been scrapped, or in some cases never existed. Some relate to real ships flagged elsewhere, suggesting that the new fake identities are being created to order in advance of moving flag.
Content Original Link:
" target="_blank">
