Pandas Network

The Pandas network operates fake maritime websites targeting several African flag states. The network is characterized by sites hosted on the same IP range and sharing similar design templates and registration patterns.

Available evidence — including Chinese-language artefacts in PDF documents and server 404 error pages — suggests the network has Chinese origins. However, a significant portion of the infrastructure uses Iranian hosting (netafraz.com nameservers, Hetzner servers in the 31.7.65.x and 85.10.251.x ranges), suggesting either a China/Iran operational nexus or that elements of the network have migrated to Iranian-managed infrastructure over time.

Infrastructure

Certificate history on crt.sh reveals rapid domain registration and short certificate lifespans consistent with fraud operations that expect to be taken down.

Targeting Pattern

The network focuses on African states with low-profile maritime administrations:

• Benin — multiple fake versions of the Benin maritime authority
• Zambia / Zimbabwe — landlocked states where legitimate registries are minimal
• Mozambique — Indian Ocean access makes this a more plausible target