Bosphorus Network

The Bosphorus network operates fake maritime websites across a range of flag states, hosted on the Turkish provider Eniyisunucum (AS215068) using nameservers at netkreatif.com. The hub domain, imsaq.org, functions as a shared hosting platform: certificate transparency records show multiple fraudulent domains registered as subdomains of imsaq.org, allowing the operator to manage the cluster from a single server.

A distinctive feature of this network is that it copies not only legitimate maritime authorities but also other fraudulent operations. The hub domain imsaq.org is itself a typosquat of imsag.org — an Oceaniek-operated fake Guyana registry — and cameroonshipregistry.com duplicates cameroonshipregistry.org, a site attributed to the Unity network. This suggests an operator who monitors existing fraudulent infrastructure and clones it, effectively piggybacking on the credibility that other fraudsters have already established.

Infrastructure

All sites share IP 89.35.73.199 and nameservers ns1.netkreatif.com / ns2.netkreatif.com. The subdomain hosting pattern (fraudulent domains issued as site.imsaq.org in certificate transparency logs) mirrors the approach used by Oceaniek, reinforcing the copycat character of the operation.

Targeting Pattern

The network targets a geographically dispersed set of flag states, including land-locked and low-profile maritime jurisdictions:

• Honduras — merchantmarinehonduras.com
• Zanzibar / Tanzania — maritimezanzibar.com
• Mongolia — mongoliashipregistry.org
• Cameroon — cameroonshipregistry.com

A fake classification society (apmb-class.com) is also hosted on the same infrastructure, following the common pattern of pairing fraudulent registries with a self-certifying classification body.