Open-source investigation Updated 2026-08-12

El-Msadi Online Register

That Mohammed (Saber) Hamcho (El-Msadi - المصدي) is OFAC-, EU- and UK-sanctioned is already public record. What this register maps is what sits behind that listing: two servers, one registrar account and one Damascus web studio running the digital estate of a Syrian business group, the family network and offshore layer in Dubai, Beirut and Cairo that sit on it.

2Servers

99Domains

61Entities

10Designated

5Jurisdictions

95Sources

01 — Structure

Network of relations

Three views of the same links. First the whole estate as one map: a solid line is corporate control (parent/controlled_by — someone's own filing, site or a designation says so), a dashed line is a family relation the record does not claim as control, and a dotted line ties an entity to the shared server its domains sit on — the infrastructure that binds the group, and the register's whole thesis. Nodes are grouped by cluster; people draw as diamonds, companies as circles, and the two square hubs are the servers. Hover or tab any node to light up what it touches; click it to pin it and list its relations under the map, and click it again — or follow any link in that list — to open the record.

Designated Named in a designation Not designated / unknown Person (diamond) Server (shared host) Corporate control Family relation — not control Shared server

Prefer a list? Browse the same 61 records on the entities page, or read the ownership and family trees below.

Ownership

The corporate-control links alone, as hierarchies. Each root is a holding group; everything nested beneath it is a documented parent subsidiary. This is the same data as the solid lines above, read top-down.

Under Hamsho International Group

Hamsho International Group Holding group Designated

Under Sama Alsham Group

Sama Alsham Group Holding group Not designated

The family

Mohammed Hamcho and the relatives the register documents — his wife and four children, and the metals cousin Emad. These are family relations, not a claim of corporate control; five of the six were designated together under the Caesar Act in June 2020.

Mohammed (Saber) Hamcho Designated

Documented family relation — see how this register is built.

02 — Technical

Infrastructure

The whole estate — the Union companies, the Hamsho-named entities, the offshore vehicles and Gaia's genuine third-party clients — lands on one of two machines.

The two-server structure below was found by following the infrastructure outward, not by starting from a list of names. Every domain in the Union cluster resolved to one address; a reverse-IP lookup on that address turned up a second virtual host quietly running the Hamsho Group's own site. An SPF record on one of those domains pointed at a separate machine — Gaia's actual corporate mail server — and reverse-IP on that address surfaced close to ninety hostnames, several belonging to entities named in the sanctions designations. Read the full method note →

Server A · 30 domains

65.21.200.112

Hetzner, Finland — Websitesمواقع إلكترونية

Nameservers: ns1.sama-athletic.com, ns2.sama-athletic.com

Serves the websites for all ten union-*.com domains, horizon-cont.com, Gaia's own domains, and Gaia's genuine third-party clients.تخدم مواقع النطاقات العشرة كافة union-*.com، وhorizon-cont.com، ونطاقات غايا الخاصة، وعملاء غايا الحقيقيين من الأطراف الثالثة.
The cluster's authoritative nameservers are hosted on this same machine, under sama-athletic.com.خوادم الأسماء الرسمية للعنقود مستضافة على الجهاز نفسه، تحت sama-athletic.com.
hamsho-group.com and gaia-printing.com are still configured as virtual hosts here, each with a mail. entry, although neither resolves in public DNS any more.لا يزال hamsho-group.com وgaia-printing.com مُهيَّأين هنا بصفتهما مضيفين افتراضيين، لكل منهما إدخال mail.، رغم أن أياً منهما لم يعد يُحلَّل عبر DNS العلني.
Also carries samaalsham-sy.org, which is DNS-configured but serving nothing — apparently a site in preparation.يحمل أيضاً samaalsham-sy.org، وهو مُهيَّأ عبر DNS لكنه لا يخدم أي محتوى — يبدو موقعاً قيد الإعداد.

Server B · 69 domains

188.40.140.252

Hetzner, Germany — Corporate mail — server3.gaia-group.coالبريد المؤسسي — server3.gaia-group.co

Nameservers: ns5.gaia-group.co, ns6.gaia-group.co

A second Gaia machine, discovered only after reverse-IP on the first. It is the mail host for roughly ninety domains covering the Hamsho-named entities, Sama Alsham's operating companies, and the Dubai and Beirut vehicles.جهاز ثانٍ تابع لغايا، اكتُشف فقط بعد البحث العكسي بعنوان IP على الجهاز الأول. وهو مضيف البريد لنحو تسعين نطاقاً تغطي الكيانات المسمّاة بحمشو، وشركات مجموعة سما الشام التشغيلية، ومركبتي دبي وبيروت.
ns3.gaia-group.co and ns4.gaia-group.co sit separately on 176.9.55.34.يقع ns3.gaia-group.co وns4.gaia-group.co بشكل منفصل على العنوان 176.9.55.34.
Cross-link between the two servers: alsy-gaz.com, whose mail is here, authorises ip4:65.21.200.112 — Server A — to send on its behalf.رابط متقاطع بين الخادمين: alsy-gaz.com، الذي يعمل بريده هنا، يصرّح لـ ip4:65.21.200.112 — الخادم A — بالإرسال نيابة عنه.
samaalsham.net resolves to 188.40.140.248, a neighbouring address that shares this box's server3.gaia-group.co reverse-DNS entry — the same machine under a second IP, not a separate host.يُحلَّل samaalsham.net إلى العنوان 188.40.140.248، وهو عنوان مجاور يشترك في إدخال DNS العكسي server3.gaia-group.co الخاص بهذا الجهاز — الجهاز نفسه تحت عنوان IP ثانٍ، لا مضيف منفصل.

DMARC reporting address

[email protected]

The same Gmail address receives DMARC aggregate reports for domains on both servers and across both supposed clusters — which is what first bridged the Union estate to the Gaia infrastructure.

union-copper.com: p=none; [email protected]
gaia-services.net: p=none; [email protected]
gaia-group.co: p=quarantine; [email protected]
awtad-alkheir.vip: p=quarantine; [email protected]