El-Msadi Online Register
That Mohammed (Saber) Hamcho (El-Msadi - المصدي) is OFAC-, EU- and UK-sanctioned is already public record. What this register maps is what sits behind that listing: a small set of servers, one registrar account and one Damascus web studio running the digital estate of a Syrian business group — plus a second, earlier IT vendor whose legacy mail relays still surface across the older domains — the family network and offshore layer in Dubai, Beirut and Cairo that sit on it.
Network of relations
Three views of the same links. First the whole estate as one map: a solid line is corporate
control (parent/controlled_by — someone's own filing, site or a
designation says so), a dashed line is a family relation the record does not claim as control,
and a dotted line ties an entity to the shared server its domains sit on —
the infrastructure that binds the group, and the register's whole thesis. A fainter dotted
line marks a former server: domains that still authorise the predecessor operator
BOC (Server C) in their mail records, though none runs there now. Nodes are grouped
by cluster; people draw as diamonds, companies as circles, and the square hubs are the
servers. Hover or tab any node to light up what it
touches; click it to pin it and list its relations under the map, and click it again — or
follow any link in that list — to open the record.
Prefer a list? Browse the same 71 records on the entities page, or read the ownership and family trees below.
Ownership
The corporate-control links alone, as hierarchies. Each root is a holding group; everything
nested beneath it is a documented parent subsidiary. This is the same data as the
solid lines above, read top-down.
- Hamsho International Group Holding group Designated
-
Sama Alsham Group
Holding group
Not designated
- Abou Waheed Operating company Status unknown
- AMH Group Offshore vehicle Not designated
- Arabesque Radio Operating company Status unknown
- Cham Engineering and Contracting Company Operating company Status unknown
- Dawaco Operating company Not designated
- Ebla Airlines Operating company Not designated
- Ebla Trade Off-shore Offshore vehicle Designated
- EGC Company Offshore vehicle Not designated
- Haima Plant Operating company Status unknown
- MEMO Operating company Status unknown
- Palmyra Village & Resort Operating company Not designated
- Sama Al-Fan Production Operating company Not designated
- Sama TV Operating company Status unknown
- SamaTel Operating company Not designated
- Sham Aqua Park Operating company Status unknown
- Tatweer Operating company Not designated
- Union Electrical Group Operating company Not designated
- United Company for Industrial Investments Operating company Status unknown
- Zaman Al-Khair Operating company Status unknown
The family
Mohammed Hamcho and the relatives the register documents — his wife and four children, and the metals cousin Emad. These are family relations, not a claim of corporate control; five of the six were designated together under the Caesar Act in June 2020.
Infrastructure
The whole estate — the Union companies, the Hamsho-named entities, the offshore vehicles and Gaia's genuine third-party clients — lands on one of Gaia's two current machines, plus a legacy relay from BOC, the vendor Gaia replaced, that still surfaces on older domains.
The server structure below was found by following the infrastructure outward, not by starting from a list of names. Every domain in the Union cluster resolved to one address; a reverse-IP lookup on that address turned up a second virtual host quietly running the Hamsho Group's own site. An SPF record on one of those domains pointed at a separate machine — Gaia's actual corporate mail server — and reverse-IP on that address surfaced close to ninety hostnames, several belonging to entities named in the sanctions designations. A later pass found a third machine, belonging to a separate operator that preceded Gaia. Read the full method note →
65.21.200.112
- Nameservers
- ns1.sama-athletic.com, ns2.sama-athletic.com
- Serves the websites for all ten union-*.com domains, horizon-cont.com, Gaia's own domains, and Gaia's genuine third-party clients.تخدم مواقع النطاقات العشرة كافة union-*.com، وhorizon-cont.com، ونطاقات غايا الخاصة، وعملاء غايا الحقيقيين من الأطراف الثالثة.
- The cluster's authoritative nameservers are hosted on this same machine, under sama-athletic.com.خوادم الأسماء الرسمية للعنقود مستضافة على الجهاز نفسه، تحت sama-athletic.com.
- hamsho-group.com and gaia-printing.com are still configured as virtual hosts here, each with a mail. entry, although neither resolves in public DNS any more.لا يزال hamsho-group.com وgaia-printing.com مُهيَّأين هنا بصفتهما مضيفين افتراضيين، لكل منهما إدخال mail.، رغم أن أياً منهما لم يعد يُحلَّل عبر DNS العلني.
- Also carries samaalsham-sy.org, which is DNS-configured but serving nothing — apparently a site in preparation.يحمل أيضاً samaalsham-sy.org، وهو مُهيَّأ عبر DNS لكنه لا يخدم أي محتوى — يبدو موقعاً قيد الإعداد.
- Its own reverse-DNS record is sport.sama-athletic.com — this is Server A's canonical hostname, not a filler sports site that happens to sit here.سجل DNS العكسي الخاص به هو sport.sama-athletic.com — وهذا هو الاسم المضيف الرسمي للخادم A، وليس موقعاً رياضياً حشوياً يصادف وجوده هنا.
188.40.140.252
- Nameservers
- ns5.gaia-group.co, ns6.gaia-group.co
- A second Gaia machine, discovered only after reverse-IP on the first. It is the mail host for roughly ninety domains covering the Hamsho-named entities, Sama Alsham's operating companies, and the Dubai and Beirut vehicles.جهاز ثانٍ تابع لغايا، اكتُشف فقط بعد البحث العكسي بعنوان IP على الجهاز الأول. وهو مضيف البريد لنحو تسعين نطاقاً تغطي الكيانات المسمّاة بحمشو، وشركات مجموعة سما الشام التشغيلية، ومركبتي دبي وبيروت.
- ns3.gaia-group.co and ns4.gaia-group.co sit separately on 176.9.55.34.يقع ns3.gaia-group.co وns4.gaia-group.co بشكل منفصل على العنوان 176.9.55.34.
- 159.69.139.89 is a secondary outbound relay for this server, not a separate host: it appears in 39 SPF records — more than Server A — always alongside 188.40.140.252 and never instead of it, and reverse-DNS resolves it to a generic Hetzner PTR (static.89.139.69.159.clients.your-server.de), the same provider as Servers A and B. 148.251.75.47 is a third such relay on the same footing. Resolved 2026-08-14; neither is a characterised host, so neither gets its own server record.العنوان 159.69.139.89 هو مُرحِّل صادر ثانوي لهذا الخادم، لا مضيف منفصل: يظهر في 39 سجل SPF — أكثر من الخادم A — دائماً إلى جانب 188.40.140.252 ولا يحل محله قط، ويُحلَّل DNS العكسي إلى سجل PTR عام من Hetzner (static.89.139.69.159.clients.your-server.de)، المزوّد نفسه للخادمين A وB. والعنوان 148.251.75.47 مُرحِّل ثالث من الفئة نفسها. حُسم في 2026-08-14؛ ولا أحدهما مضيف مُميَّز، لذا لا يحصل أي منهما على سجل خادم مستقل.
- Cross-link between the two servers: alsy-gaz.com, whose mail is here, authorises ip4:65.21.200.112 — Server A — to send on its behalf.رابط متقاطع بين الخادمين: alsy-gaz.com، الذي يعمل بريده هنا، يصرّح لـ ip4:65.21.200.112 — الخادم A — بالإرسال نيابة عنه.
- samaalsham.net resolves to 188.40.140.248, a neighbouring address that shares this box's server3.gaia-group.co reverse-DNS entry — the same machine under a second IP, not a separate host.يُحلَّل samaalsham.net إلى العنوان 188.40.140.248، وهو عنوان مجاور يشترك في إدخال DNS العكسي server3.gaia-group.co الخاص بهذا الجهاز — الجهاز نفسه تحت عنوان IP ثانٍ، لا مضيف منفصل.
52.72.12.188
- Nameservers
- ns1.yoursrs.com, ns2.yoursrs.com
- Belongs to BOC — Business Optimization Consultants, a Damascus/Aleppo web firm, not to Gaia. Twenty-seven estate domains authorise this server or its sibling server1.bocme.net (37.58.80.226, IBM Cloud/SoftLayer, Netherlands) in their SPF records, all registered between 2002-07-17 and 2017-01-05 — a pre-handover artifact, not a current relay.يعود هذا الخادم لشركة BOC (تحسين أداء الأعمال)، وهي شركة ويب مقرها دمشق/حلب، وليس لغايا. ستة وعشرون نطاقاً في هذا السجل تصرّح لهذا الخادم أو للخادم الشقيق server1.bocme.net (37.58.80.226، IBM Cloud/SoftLayer، هولندا) ضمن سجلات SPF الخاصة بها، وجميعها مسجَّلة بين 2002-07-17 و2017-01-05 — أثر سابق لمرحلة انتقال المشغّل، لا إعادة توجيه حالية.
- BOC's own fleet enumerates as server1.bocme.net (37.58.80.226, IBM Cloud/SoftLayer NL), server2.bocme.net (52.72.12.188, AWS US — this record), server3.bocme.net (52.72.128.2, AWS US — also bocme.com/.net's own web and mail), server4.bocme.net (159.8.215.36, SoftLayer), and server5.bocme.net (52.70.98.178, AWS US, recovered via Certificate Transparency rather than DNS guessing).يُعدَّد أسطول BOC كالتالي: server1.bocme.net (37.58.80.226، IBM Cloud/SoftLayer هولندا)، server2.bocme.net (52.72.12.188، AWS الولايات المتحدة — هذا السجل)، server3.bocme.net (52.72.128.2، AWS الولايات المتحدة — وهو أيضاً موقع وبريد bocme.com/.net نفسها)، server4.bocme.net (159.8.215.36، SoftLayer)، server5.bocme.net (52.70.98.178، AWS الولايات المتحدة، استُخرج عبر شفافية الشهادات لا تخمين DNS).
- The last BOC-era domain registration in the estate is 2017-01-05; the next registration, six days later, is the start of the Union cluster, built entirely on Gaia infrastructure. See the boc entity.آخر تسجيل نطاق من حقبة BOC في هذا السجل هو 2017-01-05؛ والتسجيل التالي، بعد ستة أيام، هو بداية عنقود Union المبني بالكامل على بنية غايا التحتية. انظر كيان boc.
gaia.group.sy@gmail.com
The same Gmail address receives DMARC aggregate reports for domains on both servers and across both supposed clusters — which is what first bridged the Union estate to the Gaia infrastructure.
- union-copper.com
- p=none; rua=gaia.group.sy@gmail.com
- gaia-services.net
- p=none; rua=gaia.group.sy@gmail.com
- gaia-group.co
- p=quarantine; rua=gaia.group.sy@gmail.com
- awtad-alkheir.vip
- p=quarantine; rua=gaia.group.sy@gmail.com
37.58.80.226 (server1.bocme.net)
The narrowest, most distinctive relay set in the register: exactly six domains authorise this single BOC address. Five are confirmed Sama Alsham / Hamsho hospitality and tourism entities; the sixth, team-spirit.co, carries the widest relay list of the batch and is treated as a same-operator lead, not an ownership claim.
- jupiterrentacar.com
- confirmed — Jupiter, tourism and vehicle rental
- palmyravillage.com
- confirmed — Palmyra Village
- sham-aquapark.com
- confirmed — Sham Aqua Park
- shamaquapark.com
- confirmed — Sham Aqua Park
- shamaquapark.net
- confirmed — Sham Aqua Park
- team-spirit.co
- widest relay list of the batch; no independent ownership evidence