Iranian and Russian “shadow fleet” vessels use bogus websites that mimic African ship registries, maritime administrations, seafarer organizations and other layers of maritime compliance to evade sanctions on oil exports.
Fake websites connected to these fleets likely are used to generate and corroborate false documents and certificates, according to a recent report by Insikt Group, the threat intelligence research division of Recorded Future, a cybersecurity company. These websites routinely impersonate national maritime administrations and ship registries in Benin, Cameroon, Chad, the Comoros, Equatorial Guinea, Malawi and Zambia, and they facilitate false flag registration in several other countries.
The fake websites enable maritime fraud and sanctions evasion to “form a complex network involving front companies, individuals, and vessels,” the report said.
Russia must transport oil to fund its war with Ukraine. According to the Centre for Research on Energy and Clean Air, Moscow’s shadow fleet includes up to 591 ships that carry up to 4.1 million barrels of oil a day, although some now carry natural gas. The global fleet generates up to $100 billion in revenue annually.
“For Moscow, African flags have become a practical means of concealing shadow fleet operations behind foreign jurisdiction,” the Robert Lansing Institute reported. “Once vessels sail under the legal protection of another country’s registry, enforcement becomes far more complex.”
Iran, which also relies heavily on oil exports, operates about 170 shadow vessels, according to S&P Global, a financial data and analytics company. Tehran’s oil exports totaled about 1.6 million barrels per day in 2024 and 2025, up from 434,000 daily barrels in 2020. The shadow fleet carries most of the Iranian oil. Both fleets mostly consist of aging oil tankers that often operate without proper insurance coverage.
Insikt broke down fraudulent activity into three distinct clusters. In each group, fake websites engage in typosquatting, or URL hijacking, to appear credible. This involves scammers buying web addresses that look like popular website names but usually contain a minor spelling error. One website impersonates Benin’s Maritime Administration and offers a self-service tool to generate fraudulent documents from Benin, the Comoros and Nicaragua.
Other websites targeting Cameroon, the Comoros and The Gambia posture as “ship classification societies” established on social media accounts on mainstream platforms with consistent brand identities, the report said.
According to Loyd’s List, a digital maritime news platform, websites affiliated with marinegov.net appear as fake government ship registers or national maritime authorities. These include a site in Namibia that claims to operate under the nonexistent “Directorate General of Shipping,” while an illegitimate “Cameroon Maritime Administration” runs a fictitious ship registration and seafarer licensing department.
“Many of them even share almost identical URL addresses to real registries and routinely use QR codes to obscure links between documents of real websites and fake ones,” Loyd’s List reported.
Other pages pose as national maritime administrations and ship registries in Benin, Chad, Equatorial Guinea, Malawi and Zambia.
Fraudulent flag registries associated with marinegov.net were identified in Benin, Cameroon, Malawi, Mauritania and Namibia. Last year, Lloyd’s List revealed as fraudulent the “Malawi Maritime Administration,” prompting the Malawian government to issue a warning to the International Maritime Organization. The website was quickly shut down, but not before 40 tankers successfully registered for a false Malawian flag in less than a month.
Insikt’s report urged maritime organizations to proactively identify fraudulent online infrastructure related to the Iranian and Russian fleets and implored governments targeted by fake websites to continuously monitor their ship registries. It also advised governments targeted for flag fraud to conduct multijurisdictional information sharing “to enable appropriate legal and security responses.”