🏷️ One broker, three continents, and the address that is really a mailbox

Watch a single broker move. The maintainer object lir-vg-itweb-1-MNT — registered in the British Virgin Islands — appears on the address space of HBING, a 'London' company. The sibling entity Internet Utilities Africa (PTY) LTD holds South African blocks; Internet Utilities LATAM LTD, registered in Belize, holds Argentine ones; and the abuse complaints route to a Gmail address, abuse.webltd@gmail.com. One commercial organism, wearing a BVI maintainer, a South African subsidiary, a Belize subsidiary, and a free webmail inbox, leasing infrastructure that attacks from the Netherlands while answering to nowhere in particular.

HBING LIMITED itself is registered at 124 City Road, London EC1V 2NX — an address that anyone who investigates UK shells learns to recognise, because tens of thousands of companies share it. It is a virtual office, a filing cabinet that calls itself a headquarters. The pattern repeats down the cluster: a Dutch B.V. (Serverion / Des Capital) whose prefixes drift through Bulgaria, the Czech Republic and Russia; a Romanian Srl (NexonHost) whose customer space registers in South Africa and Belize; a German GmbH (PIO-Hosting) whose 'NL' traffic resolves to Hong Kong. The European corporate name is the clean shirt. The routing table is the body underneath.

🚩 The most dangerous line item: Iran, inside a British company

Of everything in this cluster, one thread should make a compliance officer put down their coffee — and it has to be told precisely, because the easy version is wrong. Global Connectivity Solutions LLP is a British limited liability partnership: Companies House number OC450701, registered at Suite 310, 21 Hill Street, Haverfordwest, in rural Welsh Pembrokeshire, its RIPE resources sponsored through a Russian intermediary (LLC Internet Tehnologii, INETTECH-MNT). Its autonomous system, AS215540, routes blocks whose origin country reads variously Bulgaria, Russia and the Seychelles — and, the part that matters, Iranian institutional space: 213.176.16.0/24, registered to the Iranian Research Organization for Science and Technology (IROST), an arm of the Iranian state. A separate block in the same AS, 185.88.99.0/24, is sometimes summarised as 'Telecommunication Company of Iran,' but the registry record resolves it to PROXY6 LLC; Iran's actual incumbent telecom, TCI, sits in a different autonomous system (AS58224). We draw that line deliberately — the documented fact is an Iranian state-research prefix inside a UK partnership, not the national carrier, and saying so keeps the finding bulletproof.

The routing fact is high-confidence; the intent is not. Whether a Welsh-registered LLP carrying Iranian government research space crosses from careless reselling into sanctions exposure is a question for OFSI and OFAC, not a honeypot — and we label it inferential. But this is exactly what jurisdictional arbitrage is for. A sanctioned or sensitive network does not hide on a sanctioned-looking host. It acquires a clean Companies House number and a quiet town address, and lets the geography do the laundering. The Kosovo–Albania nodes elsewhere here (Max TV, ARTMOTION — the latter reached through Serbia's state telecom, Telekom Srbija) are a separate regional story we keep apart rather than inflate. But the GCS line is the one that reaches past cybercrime and brushes against statecraft.

🏛️ The Official Scaffolding — Institutional Anchors

Nothing at this scale operates without anchors in official structures — Regional Internet Registries, company registrars, state telecoms, regulators, financiers, carriers, and law enforcement. These are the documented anchors (sourced). The inferred ones live in the conspiratorial section below.

The European wrappers are anchored exactly where you would expect — and then one of them reaches somewhere you would not. Serverion, PIO-Hosting, NexonHost and the rest are normally registered with RIPE NCC and visible in PeeringDB. HBING is a UK Companies House shell at the mass-registration address 124 City Road, its resources sponsored through Host Sailor (UAE). The strongest offshore broker marker, IT WEB LTD / lir-vg-itweb-1-MNT, and its sibling Internet Utilities Africa anchor — strikingly — back into AFRINIC, the same registry as Part D's Cloud Innovation; the InterLIR brokerage rides RIPE's transfer market. The Balkan nodes are state-telecom-anchored: ARTMOTION reaches transit through Telekom Srbija (AS8400), Serbia's national carrier. And then GLOBAL CONNECTIVITY SOLUTIONS LLP — UK-registered, Russian-LIR-sponsored — routes Iranian IROST state-research address space. A British partnership, a Russian sponsor, an Iranian government prefix, anchored end-to-end in official registries.

🎯 Actors & Entities

🌐 Infrastructure & Indicators (IOCs)

Threat = composite 0–100 score from honeypot activity + multi-source enrichment.

🔎 Findings

🕳️ The Conspiratorial Read — Questions & Calibrated Answers

Each answer states what the evidence supports and labels where a claim is unproven. Questions are instruments: they pry loose the partial truths the flat record hides.

🔗 Linked Dossiers

• TI-020A — master thesis
• TI-020D — Seychelles offshore-shell sibling pattern
• TI-019K — Omegatech/Seychelles + Private Layer (Panama) bulletproof quadrant

📎 Sources & Evidence Chain (23 items)

Every claim above is anchored to a primary source. Full machine-readable evidence in Postgres dossier_intel (investigation 019M).