🧭 The Discovery Path

The key signal was never the volume. It was the contradiction. Five attack IPs in AS215540 hit the honeypot: 141.98.233.84, 89.23.108.134, 78.153.155.216, 62.60.234.140, and 45.95.233.88. AbuseIPDB/RDAP distributed them across Belgium, Germany, the United States, Latvia, and France. Team Cymru kept collapsing them back into the same answer: Russian origin — except for one critical outlier, 62.60.234.140, which pointed at Iran.

That geo-discrepancy was the parent clue already visible in TI-019M. This dossier follows it deeper. RIPE showed AS215540 was held by a Welsh LLP with no real public operating footprint. Companies House then showed the LLP was not British capital in any meaningful sense: two Seychelles IBCs as members, a Slavic PSC, identity pre-verified by a London ACSP 37 days before incorporation. RIPE then exposed the Russian sponsor. BGP data exposed the Iranian destination.

This is the whole path in one sentence: honeypot attack traffic → geo-discrepancy → RIPE ASN → UK shell → Russian LIR → Iranian state IP space.

Sources: threat_intel DB; evidence item “AS215540 Geo-Discrepancy Matrix”; Companies House overview/officers/PSC pages; RIPEstat AS overview + whois + routing history.

🏛️ The Corporate Architecture

The chain is not messy. It is layered. Every layer solves a different problem: ownership opacity, jurisdictional cover, routing authority, and sanctions-distance.

This is not diversification — it is compartmentalization. Seychelles hides the owners, Britain launders the appearance, Russia controls the routing, Iran supplies the state endpoint.

Sources: Companies House OC450701 / officers / PSC; RIPE whois AS215540, AS207713, 213.176.16.0/24; report sections 1–3.

📊 The IP Census — All 8 Infrastructure IPs

These are the eight infrastructure points carried into the investigation record. Five attacked the honeypot directly. Three are Iranian-route assets that matter because they show where the corridor terminates.

Structured investigation data records all eight. Direct honeypot telemetry confirms five aggressive scanner nodes plus one successful auth event on Iranian-routed space.

Sources: threat_intel DB (ips, honeypot_sessions); investigation infrastructure records; evidence item “AS215540 Geo-Discrepancy Matrix”.

🇮🇷 The Iranian Connection

IROST — the Institute for Research in Fundamental Sciences, formerly IPM — is not a random university tenant. It is a public Iranian research institute, Iran’s first internet organization, and the operator of the .ir country-code registry. Its director, Mohammad-Javad Larijani, is not a neutral academic administrator. He is a regime insider: adviser to Khamenei on foreign policy, former secretary of Iran’s High Council for Human Rights, and brother of former Chief Justice Sadegh Larijani.

The parent block 213.176.0.0/17 remains clearly anchored in RIPE as IR-IROST-19991208, country IR, org ORG-IROf1-RIPE. Then, on 16–18 September 2025, four child /24s — 213.176.16.0/24, 213.176.17.0/24, 213.176.18.0/24, 213.176.19.0/24 — were shifted into GCS/GIR routing in a coordinated operation.

The child object for 213.176.16.0/24 is the giveaway: netname GCS_SER-NET, country NL, org ORG-GCSL7-RIPE. The parent still says Iran. The child now says Netherlands/GCS. That is not ordinary housekeeping. It is state IP laundering through registry metadata.

This is not “international hosting” — it is Iranian state address space being made to look Dutch while being carried by a UK shell under Russian sponsorship.

Sources: RIPEstat whois for 213.176.0.0/17, 213.176.16.0/24, 213.176.16.0/22; Wikipedia/IPM and Mohammad-Javad Larijani entries; report section 3.

🧬 The Dual-ASN Ecosystem

GCS is not alone. It has a sister organism: AS207713 / GIR-AS, held by GLOBAL INTERNET SOLUTIONS LLC, created in May 2022 — nearly two years before GCS existed. Both are sponsored by the same Russian LIR, ORG-LT104-RIPE / LLC Internet Tehnologii. Both sit under the same routing authority. Both touch IROST space.

Melbikomas and SmartApe matter because they are not prestige enterprise tenants. They are names that recur in the bulletproof and low-abuse hosting ecosystem. Add that to the shared Russian sponsor, the shared Iranian routing, and the split-AS design, and the picture sharpens: one ASN for scale, one ASN for compartmentalization, both under the same hand.

This is not redundancy for resilience — it is redundancy for deniability.

Sources: RIPEstat whois for AS215540 and AS207713; evidence item “Sister ASN AS207713 (GIR-AS)”; finding “Dual-ASN Ecosystem”.

🕶️ The PROXY6 Shadow

One more structure hangs off the same corridor: PROXY6 LLC, a commercial proxy service at proxy6.net that openly markets proxies and an affiliate program. Its block 185.88.99.0/24 is registered in RIPE with country IT — Italy — yet the routing authority on the block is INETTECH-MNT, the same Russian maintainer that powers GCS and GIR.

The current RIPE fetch confirms INETTECH-MNT control over PROXY6 with high confidence. The ru-quasar-1-mnt link sits at medium confidence: it was confirmed in the investigation data and earlier cluster evidence, but not on the main AS215540 aut-num object. That uncertainty does not weaken the PROXY6 point. It narrows it: the Russian routing sponsor is confirmed; the secondary shadow maintainer is highly plausible and probably role-specific.

PROXY6 is not adjacent noise — it is what the corridor looks like when sold as a product.

Sources: RIPEstat whois for 185.88.99.0/24; evidence items “PROXY6 LLC IP Block” and “ru-quasar-1-mnt Maintainer Cluster”; report section 4.

⚖️ The Sanctions Question

The legal question is simpler than the networking question. UK Iran sanctions regulations define the “Government of Iran” to include its public bodies and agencies. IROST is a public body. It operates critical national internet functions. GCS LLP is a UK LLP. That gives UK jurisdiction.

The regulations do not need to say “BGP” to be relevant. Internet transit is not metaphysical. It is a service. It has commercial value. It enables the beneficiary to operate. If a UK LLP is routing address space for an Iranian public body without a licence, the sanctions question is not theatrical. It is live.

The U.S. angle is just as uncomfortable. Most observed AS paths for GCS traverse Cogent (AS174), a U.S. Tier-1. If GCS is carrying Iranian state space and Cogent is carrying GCS, then U.S. transit is part of the corridor whether Cogent intended that or not.

This is not a passive peering curiosity — it is a commercial service chain touching a sanctioned state environment through a British shell and a Russian routing sponsor.

Sources: UK Iran (Sanctions) Regulations 2023, Reg. 2 and related provisions; RIPEstat BGP state; report section 7; evidence item “UK Iran Sanctions 2023 — Applicability to IROST Routing”.

📡 BGP Analysis

Rapid growth matters too. AS215540 went from allocation on 9 Feb 2024 to first observed routing on 8 Oct 2024 to 237 IPv4 prefixes by 17 Jun 2026. That is not organic artisanal growth. That looks like pre-existing customers being migrated into a new legal shell.

This is not a shell with no infrastructure — it is a shell with a real backbone behind it.

Sources: bgp.he.net/AS215540; PeeringDB net API for ASN 215540; RIPEstat BGP state and path-length data; report section 5.

🏝️ The Seychelles Pattern

The Seychelles members are not decorative. They are the opacity mechanism. LUPINE LOGISTICS LTD and LS TRADING PARTNERS INC sit at the same Sound & Vision House address in Victoria, Mahe. Their registration numbers — 215807 and 215808 — are consecutive. That means they were created together, almost certainly by the same formation agent, for the same purpose.

There is no evidence of real logistics operations. There is no evidence of real trading operations. There is evidence of synchronized shell formation feeding directly into a UK LLP that later routes Iranian state space. That is enough.

This is the same offshore grammar seen elsewhere in the dossier corpus: use a reputable-facing jurisdiction for the public wrapper, use a secrecy jurisdiction for the members, and keep the real operator one layer further back. It is not business structuring — it is ownership laundering. The broader Seychelles shell pattern will be revisited in TI-2026-024.

Sources: Companies House officers page for OC450701; investigation actor records for LS TRADING PARTNERS INC and LUPINE LOGISTICS LTD; report section 1.2.

❓ Conspiratorial Questions

👁️ Read Between the Lines

🧪 Methodology

🔗 Linked Dossiers

• TI-019M — the geo-discrepancy parent map that first exposed GCS-AS as a Russian-shaped network wearing Western addresses
• TI-020A “Cartographers of Nowhere” — why country disagreement across routing, abuse, and registration is a first-class forensic signal
• TI-2026-024 — forthcoming Seychelles-shell pattern analysis that generalizes the consecutive-IBC tactic seen here

📎 Sources & Evidence Chain

Machine-readable evidence exists in the dossier pipeline for TI-2026-022: actor records, findings, infrastructure, connections, and evidence items were cross-checked against the full OSINT research report before composition.