Executive Summary: The polite fiction says an IP address belongs to a place. Our data says that fiction has collapsed. In this investigation, 1,091 malicious IPs with threat scores above 30 appear in multiple countries simultaneously depending on which layer of the internet you interrogate: geolocation, BGP origin, RDAP registrant, abuse feeds, or operator self-declared geofeeds. 117 of those IPs score above 80. The problem is not a handful of dirty records. It is an architecture of ambiguity.
If you were designing a system for sanctions evasion, attribution laundering, and jurisdictional confusion, it would look exactly like this: a UK LLP routing Iranian state space; a Russian national controlling a Ukrainian ASN; a German company routing Iranian LIRs from a Dutch border data center; a Romanian operator publishing geofeeds that place IPs in Tehran, Havana, Minsk, and Moscow; and a military telecom whose global footprint doubles as attack infrastructure. Officially, these are separate cases. Forensically, they are one map.
The opening article of this series asks the foundational question: what does it mean when network identity has become negotiable? Once that question is answered, the later parts become inevitable. The corridor is not a metaphor. It is an operating model.
Chapter 1: The Question No One Asks
An IP address is supposed to be boring. It is supposed to resolve to a machine, inside a network, inside a country, under a legal regime. That assumption is embedded everywhere: in sanctions policy, in cyber attribution, in export controls, in abuse workflows, in the way journalists write headlines after an incident. Then one address breaks the illusion.
185.156.73.233 exists in four countries simultaneously: Netherlands by geolocation, Russia by BGP origin country, Netherlands by RDAP registration, and Ukraine by ASN registration. That is not a typo. That is four separate sovereign narratives attached to one packet source. Once you see it, you cannot unsee it.
When the same host can be Dutch for the map, Russian for the route, Ukrainian for the paperwork, and still attack from a completely different operational chain, "country" stops being a fact and becomes a layer.
| IP | Threat | Derived Country | BGP Country | RDAP Country | Operator / ASN Context |
|---|---|---|---|---|---|
185.156.73.233 | 78 | ๐ณ๐ฑ NL | ๐ท๐บ RU | ๐ณ๐ฑ NL | AS211736, Ukrainian FOP, Russian maintainer control |
103.143.238.100 | 100 | ๐บ๐ธ US | ๐ญ๐ฐ HK | ๐ญ๐ฐ HK | AS138152 Yisu Cloud |
185.255.100.196 | 100 | ๐บ๐ธ US | ๐ฌ๐ง GB | ๐บ๐ธ US | High-abuse cross-Atlantic corridor |
212.192.240.126 | 100 | ๐ณ๐ฑ NL | ๐จ๐ฟ CZ | ๐ณ๐ฑ NL | Central European relay pattern |
185.222.138.237 | 97 | ๐ฝ๐ฐ XK | ๐ฉ๐ช DE | ๐ฆ๐ฑ AL | Balkan-to-German laundering lane |
โ What exactly is the paradox?
Most people assume an address has one national identity. Our evidence shows that identity fractures by layer: packet latency produces one answer, BGP announcements another, RDAP registries a third, and beneficial control often a fourth that is never disclosed in any public field.
The paradox is not that databases disagree. Databases always disagree sometimes. The paradox is that the disagreement is structured, repeatable, and strategically useful. When the same forms of disagreement recur around abuse-heavy infrastructure, the discrepancy itself becomes an indicator.
โ Why does this matter beyond geolocation accuracy?
Because law follows paperwork, sanctions follow declared counterparties, and public attribution follows map labels. If the declared place is negotiable, every downstream control built on that place is weakened before anyone begins an investigation.
In practice, an operator can become one entity for the bank, another for the registry, another for upstream transit, and another for journalists who glance at an IP map. That is not just bad data hygiene. It is a form of infrastructure camouflage.
๐ Reading Between the Lines
- When a hostile IP can borrow four jurisdictions, every analyst downstream has to choose which fiction to believe.
- That choice is rarely made explicitly. It happens silently in dashboards, compliance workflows, and incident reports.
- The corridor begins the moment uncertainty is operationalized. From that point forward, the ambiguity is not noise; it is cover.
protonserv-mnt.Chapter 2: The Numbers
Before the narrative comes the shape of the phenomenon. Our thresholded set contains 1,091 geo-discrepant IPs across 66 countries with threat score above 30. 117 score above 80. Across the full tracked estate, 1,357 of 7,946 IPs show country disagreements. BGP agrees with the derived country only 68.6% of the time. That means nearly one in three BGP-country comparisons produce a national story different from the one our derived attribution pipeline would tell.
| Metric | Value | Interpretation |
|---|---|---|
| Geo-discrepant IPs (threat >30) | 1,091 | Malicious or notable addresses with multi-country identity |
| Countries represented | 66 | Global scope; not a regional oddity |
| Threat >80 | 117 | The problem scales into the high-risk tier |
| Total tracked IPs with disagreements | 1,357 / 7,946 | 17.1% of all tracked infrastructure |
| BGP / derived agreement | 68.6% | One-third of routing-country assumptions fail |
| Shared BGP upstream entity links | 8,005 | Corridors are networked, not isolated |
| Derived Country | BGP Country | RDAP Country | Count | Avg Threat |
|---|---|---|---|---|
| US | CA | โ | 36 | 63 |
| IQ | AE | IQ | 34 | 60 |
| FR | DE | DE | 31 | 65 |
| US | GB | US | 27 | 75 |
| IN | US | โ | 20 | 64 |
| US | SG | US | 18 | 66 |
| SG | US | โ | 17 | 62 |
| DE | DE | US | 16 | 64 |
| NL | US | โ | 14 | 69 |
| HK | SC | HK | 8 | 68 |
โ Could this still be normal internet messiness?
Normal messiness exists. CDNs, leased blocks, stale records, and regional heuristics all produce ordinary disagreement. But normal messiness does not consistently overlap with high-abuse IPs, sanctioned-country routing stories, shell-company structures, and known malicious campaigns.
Once discrepancy clusters around threat score, shared upstreams, and repeated organizational archetypes, the burden flips. The question is no longer โwhy are the databases imperfect?โ It is โwhy do the imperfections keep serving the same kinds of actors?โ
โ What does 8,005 shared BGP upstream links tell us?
It tells us the corridors are not single tunnels. They are a mesh. High-risk ASNs repeatedly meet each other through common transit providers, creating overlapping trust surfaces where route acceptance and reseller relationships can propagate ambiguity at scale.
A corridor is not only a point-to-point route. It is a permission structure inside global transit.
๐ Reading Between the Lines
- The volume patterns are not random. They reveal favored national pairings: US/GB, US/SG, IQ/AE, FR/DE. Those are not exotic combinations; they are financially and logistically useful ones.
- Notice what does not appear: obvious one-hop sanction narratives only. The strongest signal is the ordinary-looking corridor that hides inside legitimate transit and leasing markets.
- Seventeen point one percent is too large to treat as exception handling. At that point, discrepancy is part of the systemโs normal operating condition.
Chapter 3: The Five Corridors
Patterns became corridors only when they recurred with enough structure to support prediction. We identified five. Each has its own institutional anchor, its own camouflage style, and its own answer to the same strategic problem: how do you move infrastructure across borders faster than law can follow?
Corridor 1 โ ๐ฌ๐งโ๐ฎ๐ท The UK-Iran Pipeline
A UK LLP, GCS LLP (OC450701), operates AS215540, controlled 75%+ by Russian PSC Evgeniy Marinko via two Seychelles IBCs with consecutive registration numbers. It routes Iranian state IROST space.
Corridor 2 โ ๐ท๐บโ๐บ๐ฆ The Russian Hand
Vorozhtsov Igor in Novosibirsk controls the maintainer object protonserv-mnt, which controls space announced by Ukrainian AS211736. The same email appears in Ukrainian organization records.
Corridor 3 โ ๐ฉ๐ชโ๐ฎ๐ท The German Gateway
PIO-Hosting GmbH (AS198584) and XSServer GmbH share people and phone numbers around the German-Dutch border while routing Iranian LIR-managed space through a company that announces zero German IP space of its own.
Corridor 4 โ ๐ท๐ดโ๐ The Geographic Liar
M247 Europe SRL (AS9009) spans 11 RDAP countries and publishes geofeeds that place IP blocks in Tehran, Havana, Minsk, and Moscow. The company sells geography itself as a configurable product.
Corridor 5 โ ๐ป๐ณโ๐ฒ๐ฒ The Military Corridors
Viettel Group (AS7552), a Vietnamese military telecom led by a Major General, ties military-state infrastructure to global abuse telemetry and to a Myanmar joint venture alleged to function as a surveillance arm for the junta.
โ Why these five and not fifty others?
Because they are not merely discrepant. They are institutionally anchored. Each corridor rests on identifiable structures: Companies House, RIPE objects, Handelsregister entries, PeeringDB footprints, geofeed declarations, military ownership, or sanctions-relevant counterparties.
The distinguishing feature is not weirdness. It is documented architecture.
โ What do they have in common?
Every corridor splits identity across layers and jurisdictions. One country is used for legitimacy, another for technical routing, another for beneficial control, another for political insulation.
The common product is deniability. Different corridor types sell it in different packaging.
Chapter 4: Corridor One โ The Pipeline
If sanctions evasion ever acquires a dry corporate accent, it sounds like a UK LLP. GCS LLP, registered at Companies House under OC450701, presents the first corridor in its most elegant form: a clean British legal shell carrying the routing burden for Iranian state-related infrastructure while its real controlling stake sits behind two Seychelles IBCs with consecutive registration numbers, and the beneficial gravity points back to Russian PSC Evgeniy Marinko.
| Element | Observed Fact | Why It Matters |
|---|---|---|
| Entity | GCS LLP (OC450701) | UK legal wrapper |
| ASN | AS215540 | Routing control surface |
| Prefixes | 237 IPv4 prefixes (~64K IPs) | Scale; not a hobby ASN |
| Coverage | 96% RPKI ROA | Professionally maintained routing |
| Iran-linked blocks | 213.176.16.0/24, 213.176.18.0/24 | Historically assigned to IROST |
| Transit | Cogent in path; Rostelecom observed | Global reach plus Russian adjacency |
| Companion ASN | AS207713 GIR-AS | Same Russian LIR sponsorship pattern |
โ What is the official explanation?
Officially, this can be described as ordinary international network commerce: a UK partnership, global transit, and route origination for customer blocks. The presence of high RPKI coverage even argues against sloppiness. This is not a back alley operation. It looks like a managed service.
And that is precisely the problem. The corridor works because it looks like respectable infrastructure administration while carrying a sanctions-relevant burden no one seems eager to classify as such.
โ Why does IROST change the character of the case?
Because UK Iran Sanctions Regulations 2023 define the Government of Iran broadly enough to include public bodies and agencies. IROST is not a random private customer. It is an Iranian state academic-research institution directed by a Khamenei advisor.
Once state-linked Iranian infrastructure is the routed payload, the corridor stops being abstract. You are no longer asking whether the internet is global. You are asking whether a UK entity is providing communications infrastructure to a sanctioned state body through a chain designed to look commercially ordinary.
โ Why mention the consecutive Seychelles registrations?
Because shell design leaves fingerprints. Consecutive IBC registration numbers strongly suggest the opacity layer was created as a bundled action, not as two unrelated investments later converging on the same LLP.
That is not proof of criminality. It is proof of choreography.
๐ Reading Between the Lines
- 96% RPKI ROA coverage does not exonerate the corridor. It proves competence. RPKI tells you that the entity announcing the route is authorized to announce the route. It tells you nothing about whether the arrangement should exist.
- The modern sanctions problem is not smuggling in the old sense. It is compliance theater wrapped around professionally managed transit.
- If a hostile state wanted a resilient external routing arrangement, it would not choose chaos. It would choose a neat British legal wrapper with immaculate routing hygiene.
Chapter 5: Corridor Two โ The Invisible Hand
Some corridors hide behind shells. Some hide behind naming. Corridor Two hides behind a person. Vorozhtsov Igor, in Novosibirsk, with public RIPE handle VI1350-RIPE, phone +79139052140, and email vigorv@mail.ru, administers protonserv-mnt โ the maintainer object controlling address space announced by Ukrainian AS211736, legally tied to FOP Dmytro Nedilskyi.
| Layer | Value | Country Signal |
|---|---|---|
| Geolocation | 185.156.73.233 | ๐ณ๐ฑ Netherlands |
| BGP Origin Country | Prefix origin attribution | ๐ท๐บ Russia |
| RDAP Registration | IP block registration | ๐ณ๐ฑ Netherlands |
| ASN Registration | AS211736 / FOP Nedilskyi | ๐บ๐ฆ Ukraine |
| Maintainer Admin | Vorozhtsov Igor / protonserv-mnt | ๐ท๐บ Russia |
| Org Cross-Link | TOV E-RISHENNYA record includes vigorv@mail.ru | ๐บ๐ฆ Ukraine โ ๐ท๐บ Russia |
โ Is this merely outsourced administration?
That is the least alarming reading: a Russian network specialist informally assisting or administering resources for a Ukrainian operator. Outsourcing across borders happens every day.
But the same personal email appearing in both the maintainer object and the Ukrainian organization record pushes this beyond casual outsourcing. It suggests administrative control woven directly into the registry surface, without any explicit disclosure in the AS identity presented to the world.
โ Why does the name protonserv-mnt matter?
Because names are part of how infrastructure borrows trust. Protonserv is not Proton AG, not ProtonVPN, not the Swiss privacy brand. It is a different actor using a name fragment that evokes that brand instantly for casual observers.
This is classic brand parasitism: not enough to win a trademark lawsuit in a routing registry, but more than enough to plant confusion in a fast-moving attribution environment.
โ What is the real investigative question here?
Not whether one Russian administrator exists in a Ukrainian network record. The real question is why cross-border control of network resources remains so easy to conceal that only direct correlation of maintainer objects, personal emails, and abuse telemetry exposes it at all.
The system does not require operators to tell the truth about who actually holds the steering wheel.
๐ Reading Between the Lines
- The corridor weaponizes the difference between formal registrant and operational controller. That gap exists in every RIR. Here it is simply visible.
- During an era of Russia-Ukraine conflict, a Russian administrative hand inside Ukrainian network identity is not a minor curiosity. It is the kind of anomaly analysts would treat far more seriously if it appeared in finance or defense procurement.
- The IP does not simply exist in four countries. It borrows them selectively: Dutch legitimacy, Ukrainian paperwork, Russian routing gravity, European ambiguity.
protonserv-mnt; ORG-TE87-RIPE references; published dossier The VPN Laundromat.Chapter 6: Corridor Three โ The Border Town
There is a recurring trick in hostile infrastructure: build the paperwork on one side of a border and park the machines on the other. PIO-Hosting GmbH, XSServer GmbH, and SkyLink Data Center BV turn that trick into an operating model. The map coordinates are almost comic in their modesty โ รbach-Palenberg in Germany, Eygelshoven in the Netherlands โ but the routing burden passing through them is not modest at all.
| Company | Registry Anchor | Technical Role | Shared Linkage |
|---|---|---|---|
| PIO-Hosting GmbH | HRB 6893, Amtsgericht Kleve | AS198584, routes Iranian LIRs | Same personnel / sponsor chain |
| XSServer GmbH | HRB 21403 Aachen | AS207959, LIR sponsor | Phone +49 2451 9949570 |
| SkyLink Data Center BV | Dutch operating entity | Border-region facility / AS44592 context | Same phone via admin Dirk Bellgart |
PIO-Hosting announces zero German IP space of its own. Instead, it becomes a routing and laundering surface for blocks from multiple RIR regions: RIPE, ARIN, AFRINIC, APNIC, LACNIC. In one direction, that is just global hosting. In the other direction, it is a legal gray zone carrying 4+ Iranian LIR-managed prefixes plus an InterLIR Marketplace block from Farhang Azma Communications, Tehran.
| Iran-Linked Resource | Prefix | Maintainer / Anchor |
|---|---|---|
| lir-ir-salehi-1-MNT | 91.206.28.0/24 | Iranian LIR |
| lir-ir-seyeddavood-1-MNT | 185.43.33.0/24 | Iranian LIR |
| lir-ir-mazdab-1-MNT | 194.213.118.0/24 | Iranian LIR |
| lir-ir-nahor-1-MNT | 46.249.110.0/24 | Iranian LIR |
| Farhang Azma Communications | InterLIR-routed block | Tehran-linked communications entity |
โ Why emphasize the single phone number?
Because small details establish operational continuity better than branding does. A shared public phone number across related corporate and RIPE identities is the kind of simple connective tissue that shell structures often forget to hide.
When three apparently distinct entities keep touching the same phone line, they stop looking distinct.
โ Why is โzero German IP spaceโ such a revealing fact?
Because it means the German companyโs value is not local address ownership. Its value is jurisdiction, transit credibility, sponsorship, and handling capacity. It exists to move and front infrastructure, not to express a national footprint of its own.
In other words: the company is not a destination. It is a gate.
โ What is the official innocent reading?
That a border-region hosting cluster is serving international customers, including difficult regions, using the ordinary flexibility of the IP market. Nothing in BGP itself forbids that.
The harder question is why EU Regulation 267/2012 can prohibit technical assistance to Iranian entities while this exact routing reality persists in public records with no visible enforcement consequence. That silence is not technical. It is institutional.
๐ Reading Between the Lines
- Border towns are useful because they make responsibility feel administratively expensive.
- A company that routes space from five RIR regions without meaningful domestic footprint is not selling nationality. It is selling passage.
- The German-Dutch corridor matters because it converts geography into a legal delay mechanism. Every extra jurisdiction is extra time, and extra time is operational oxygen.
Chapter 7: Corridor Four โ The Geographic Liar
The most honest thing about M247 Europe SRL is that it demonstrates the problem in the open. No hidden nominee chain is required. The corridor is the product itself: a Romanian operator, AS9009, with RDAP records spanning 11 countries, and a geofeed that places blocks in places the compliance world would rather not examine too closely: Tehran, Havana, Minsk, and multiple Moscow entries.
| M247 Signal | Observed Fact | Implication |
|---|---|---|
| RDAP Country Spread | BS / CH / DE / IE / LK / NG / PA / QA / SE / US / VE | Legal nationality is fragmented by design |
| Geofeed Iran | 62.133.46.0/24 โ Tehran | Operator self-declared sanctioned-country location |
| Geofeed Cuba | 89.238.155.0/25 โ Havana | OFAC comprehensive sanctions context |
| Geofeed Belarus | 91.238.70.0/24 โ Minsk | Authoritarian alignment corridor |
| Geofeed Russia | 10 entries, ~1,280 IPs โ Moscow | Geographic fiction scaled industrially |
| Botnet Linkage | 20 nodes in 628-machine libssh2 campaign | Not neutral infrastructure in our telemetry |
| Historical Context | NordVPN 2018 breach on M247 infrastructure | Prior trust-boundary failure already documented |
โ Isnโt a geofeed just a location hint?
Yes โ and that is exactly why it is so dangerous. Under RFC 8805, the operator can publish a machine-readable file telling the world where its IP space is located. Geolocation providers may ingest it. There is no universal verification layer ensuring those declarations correspond to physical reality.
A geofeed is a soft assertion that hardens downstream once databases trust it.
โ Why is this more than a data-quality issue?
Because M247 does not merely have messy records. It has geographic programmability. The company can place legal identity, routing identity, and marketed location into different jurisdictions while still appearing to customers as a coherent service.
That is not passive discrepancy. That is geography as a service.
โ Why connect M247 to sanctions if it is not routing Iranian state prefixes the way GCS or PIO do?
Because mapping blocks into Tehran, Havana, Minsk, and Moscow changes the compliance and attribution problem even if the underlying asset chain differs. The corridor still places infrastructure into politically charged jurisdictions while preserving corporate and routing ambiguity elsewhere.
The exact mechanism differs. The strategic effect rhymes.
๐ Reading Between the Lines
- If a company can publish a CSV that effectively places address space in sanctioned capitals, then โwhere an IP isโ has become partially contractual and partially theatrical.
- The old model treated geography as metadata. The new model treats it as a commercial feature.
- Once hostile campaigns begin to prefer such infrastructure, geolocation itself becomes part of the attack surface.
Chapter 8: Corridor Five โ The Military Telecom
The fifth corridor is the one polite analysts tend to avoid because it forces a more uncomfortable admission: not all suspicious infrastructure hides behind shell games. Sometimes it sits inside a major national telecom that is deeply integrated with state power. Viettel Group, operating AS7552, is not marginal. It is a giant: 8,105 IPv4 prefixes, 479 peers, 8 IXPs, and global rank #62. It is also led by a Major General and tied through Mytel to Myanmarโs surveillance environment.
| Indicator | Value | Investigative Meaning |
|---|---|---|
| Viettel IPs in telemetry | 38 | Non-trivial attack footprint against our honeypot |
| Average threat | 90.7 | High-risk cluster, not ambient noise |
| IPv4 prefixes | 8,105 | Backbone-scale capacity |
| Peers | 479 | Global interconnection power |
| JV link | Mytel, Myanmar | Cross-border political exposure |
| Comparative state actor context | ChinaNet: 93 botnet nodes, avg threat 9.3 | State-linked carrier infrastructure repeatedly appears in abuse telemetry |
โ Is this proof the Vietnamese state directs attacks?
No. That would require evidence this article does not claim to possess. Large carriers contain many customers, many leased environments, and many unmanaged or compromised endpoints. Carrier scale alone does not prove state intent.
What the evidence does show is that state-linked telecom infrastructure can function as a corridor of consequence: politically shielded, globally peered, and difficult to challenge without geopolitical cost.
โ Why bring in Myanmar?
Because Mytel turns Viettel from a national telecom into a cross-border state-power instrument. Once a military-owned operator extends into a conflict-saturated foreign surveillance environment, its infrastructure can no longer be treated as a purely commercial backdrop.
The corridor here is not only technical. It is strategic.
๐ Reading Between the Lines
- Bulletproof corridors hide because they are small. Military corridors hide because they are enormous.
- A major telecom does not need deceptive branding to evade scrutiny. Its legitimacy is pre-installed.
- When military-owned infrastructure shows up in hostile telemetry, the safest public sentence is โthis may be customer abuse.โ The more honest sentence is โcustomer abuse is now protected by an unusually powerful umbrella.โ
Chapter 9: The Trust Collapse
The corridors do not exist because the internet is broken. They exist because the internet was designed for trust inheritance at a scale and speed that no longer match reality. BGP emerged for a world of a few hundred cooperative networks. Now there are more than eighty thousand ASNs and a thriving gray market in routing authority, leased prefixes, sponsored resources, and reseller control. The old model assumes that if the route is valid, the relationship beneath it is socially legitimate. The modern corridor exploits the difference between those claims.
| Date / Layer | Observed Event | Why It Matters |
|---|---|---|
| July 2025 | Attacker impersonated a small Indonesian ISP with forged documents | Identity verification failure, not routing-crypto failure |
| Hijack #1 | 20-minute burst announcement | Short enough to monetize, short enough to dodge sluggish response |
| Hijack #2 | 15-minute burst | Repeated confidence in social engineering |
| Hijack #3 | 5-minute burst | Proof of concept refined into tactical use |
| Cross-RIR response | APNIC + LACNIC + APJII / IDNIC coordination | Jurisdictional complexity is now part of incident response |
| Key lesson | RPKI did not solve weak identity proofing | Valid announcement โ legitimate actor |
โ Doesnโt RPKI fix this?
RPKI fixes a specific problem: whether an ASN is cryptographically authorized to originate a prefix. That matters. It reduces random hijacking and validates route origination more strongly than the older trust model.
But RPKI does not tell you whether the entity receiving authorization is fronting for someone else, whether beneficial ownership is concealed, whether the commercial relationship is sanctions-relevant, or whether the route exists because an upstream was socially engineered into provisioning it.
โ What did the APNIC/LACNIC case really prove?
It proved the oldest weakness still dominates the newest control plane: humans. An attacker used forged documents, convinced a multinational upstream to enable transit, then injected brief route bursts that lasted just long enough to matter.
The corridor problem is the same vulnerability stretched over longer time horizons. Once identity proofing is weak, the rest is paperwork choreography.
โ What collapses when trust collapses?
Attribution collapses first. Enforcement collapses second. Public comprehension collapses third. By the time a journalist says โthe IP was in Country X,โ three other layers may already disagree.
The map becomes a narrative weapon for whoever publishes fastest.
Chapter 10: The Jurisdictional Void
The law says one thing. The routing table says another. On paper, sanctions regimes prohibit technical assistance and service provision to certain Iranian entities and jurisdictions. In practice, we find: IROST state-linked space routed through a UK LLP; multiple Iranian LIRs routed through a German company; and M247 geofeed declarations placing address space into sanctioned capitals. Across the cases reviewed in this series, the number of public prosecutions for internet-transit sanctions violations remains: zero.
| Legal Frame | Corridor Reality | Observed Gap |
|---|---|---|
| UK Iran Sanctions Regulations 2023 | GCS LLP routes IROST-related prefixes | Service classification appears under-enforced |
| EU Regulation 267/2012 | AS198584 routes Iranian LIR resources | Technical assistance / transit ambiguity |
| OFAC comprehensive sanctions logic | M247 geofeed points to Tehran / Havana | Geographic layer is self-declared and commercially fluid |
| Financial enforcement trend | Chainalysis reports 694% surge in state-driven sanctions evasion | Money enforcement races ahead of network enforcement |
| Recent pressure points | Nobitex designation, Zedxion dissolution, Tether $344M freeze | Payments are visible; transit remains comparatively opaque |
โ Why are there zero prosecutions?
One answer is doctrinal uncertainty: network transit is technically complex, commercially layered, and hard to map cleanly onto sanctions statutes written with goods, funds, or more conventional services in mind.
The harsher answer is institutional convenience. Enforcing against transit would expose upstreams, sponsors, carriers, lessors, and marketplaces that many regulators would rather treat as neutral plumbing.
โ Is internet transit really a service in the sanctions sense?
Courts and regulators will argue that. Investigators already know the practical answer: transit is the difference between reachable and unreachable. Without it, the routed entity loses meaningful network presence.
When a sanctioned or state-linked actor remains reachable because a foreign intermediary carries its prefixes, the intermediary is not philosophically adjacent. It is operationally necessary.
๐ Reading Between the Lines
- The system punishes moving value for sanctioned actors faster than it punishes moving packets for them.
- That asymmetry matters because modern state capacity depends on connectivity as much as on money.
- Once packet movement is treated as morally neutral infrastructure, the corridor acquires a quasi-immunity unavailable in finance.
Chapter 11: What If Itโs Not a Bug?
Here the investigation crosses from documented architecture into the zone everyone privately thinks about and publicly avoids. What if the corridor is not an accidental byproduct of legacy internet governance? What if it persists because too many legitimate actors benefit from its existence?
The cautious, official answer says fragmentation is inevitable in a global internet: leasing markets grew, registries aged, verification standards lagged, and commercial reality outran governance. That answer is not false. It is also incomplete.
| Stakeholder | Official Story | Alternative Reading |
|---|---|---|
| Registries | We allocate resources; we do not police geopolitics | Beneficial opacity remains someone elseโs problem indefinitely |
| Upstreams | We sell neutral transit | Neutrality becomes cover for high-risk counterparties |
| Hosting / LIR sponsors | We enable customers globally | Jurisdictional fragmentation is the product |
| Compliance teams | We screen known entities | The corridor exists to ensure the real entity is never singularly visible |
| Analysts / media | We report the country on the dashboard | Fast publication rewards the shallowest layer |
โ What would a deliberately preserved regulatory gap look like?
It would look exactly like strong controls on money, weak controls on beneficial ownership of routing resources, permissive reseller chains, self-declared geofeeds, and public narratives that keep calling all of this โjust infrastructure.โ
In that world, no one actor needs to conspire explicitly. Incentives alone preserve the gap.
โ Are we claiming a coordinated conspiracy?
No. The documentary record here proves corridors, opacity, and repeated benefit. It does not prove a single secret room where everyone agreed to maintain them.
The more interesting possibility is structural conspiracy without meetings: a distributed system of tolerated ambiguity sustained because closing it would impose costs on actors far more powerful and legitimate than the obvious abusers.
โ Why is this chapter necessary in a forensic dossier?
Because evidence without implication is just inventory. Investigative work must distinguish between what is proved and what the proved facts strongly suggest about institutional behavior.
The corridor cases suggest a world where deniability has become an infrastructural commodity. That implication is too important to leave unsaid merely because it is uncomfortable.
๐ Reading Between the Lines
- Power rarely needs airtight illegality when diffuse ambiguity works better.
- The corridor survives because every layer can point to another layer and say, โthat part isnโt ours.โ
- The result is a machine with no single villain large enough to prosecute and no single truth simple enough to publish in a headline.
Chapter 12: The Map
Maps usually simplify. This one accuses. The corridor map says that internet geography has ceased to be a stable attribution layer and become instead a contested, monetized, and politically exploitable surface. It says that 1,091 high-interest IPs are not a side effect but a symptom. It says that the world of โwhat country is this IP in?โ has ended, and a harder question has begun: which country does each layer need you to believe in?
| Marquee IP | Threat | Derived | BGP | RDAP | Series Connection |
|---|---|---|---|---|---|
103.143.238.100 | 100 | US | HK | HK | Yisu Cloud and Asian laundering lanes |
185.255.100.196 | 100 | US | GB | US | Trans-Atlantic corridor logic |
124.156.202.242 | 100 | SG | SG | IN | South Asia / Singapore identity split |
172.214.209.153 | 100 | US | GB | US | US/GB high-risk routing duality |
212.192.240.126 | 100 | NL | CZ | NL | Central Europe relay ambiguity |
172.110.219.251 | 100 | ES | HK | HK | European endpoint / Asian control split |
94.154.35.215 | 99 | NL | UA | UA | Eastern Europe laundering lane |
87.251.64.176 | 99 | PL | RU | PL | Poland / Russia split-risk signal |
185.222.138.237 | 97 | XK | DE | AL | Balkan corridor into German route identity |
โ What did we actually prove in this opening article?
We proved that large-scale, high-risk geographic discrepancy exists; that it clusters into five corridor archetypes; that those archetypes rest on documented institutional anchors; and that sanctions and governance frameworks do not currently resolve the gap between legal identity and operational control.
We did not prove every corridor is state-directed or criminal in its entirety. We proved something more durable: the infrastructure is designed so that those questions become hard to answer on purpose.
โ What comes next?
Each corridor gets its own dossier. The UK-Iran pipeline must be traced entity by entity. The Russian hand behind a Ukrainian mask must be unpacked in public record detail. The German border triangle must be walked from phone number to prefix to company director. M247โs geographic fiction needs a machine-scale audit. Viettel and the military corridor require their own geopolitical treatment.
This article is the map on the wall with pins and thread. The next five are the rooms behind each pin.
๐ Cross-Border Corridors โ Continue the Series
TI-2026-022C โ The UK-Iran Pipeline โ GCS LLP, Seychelles opacity, Russian beneficial control, and Iranian state IROST space.
TI-2026-022D โ The Russian Hand โ Vorozhtsov Igor, protonserv-mnt, FOP Nedilskyi, and the four-country IP.
TI-2026-022E โ The German Gateway โ PIO-Hosting, XSServer, SkyLink, Iranian LIR routing, and the border-town relay.
TI-2026-022F โ The Geographic Liar โ M247, geofeed theater, sanctioned capitals in CSV form, and geographic identity fraud at industrial scale.
TI-2026-022G โ The Military Corridors โ Viettel, Mytel, ChinaNet, and state telecom infrastructure as attack platform.
Related: TI-2026-023B โ The Backbone โ The earlier M247 backbone investigation that exposed the protonserv and corridor precursors.
Related: TI-2026-023C โ The Virtual Country โ The geofeed dossier that made self-declared geography impossible to treat as innocent metadata.
Related: TI-2026-023D โ The Trust Chain โ The discrepancy cartography that quantified the collapse.
Related: TI-2026-026C โ The German Gray Zone โ Border-region transit and the companies no one seems to prosecute.
Related: TI-2026-026F โ The Sanctions Question โ Where sanctions doctrine collides with routing reality.
Related: TI-2026-026K โ The Predecessor Network โ The corporate genealogy behind the German-Dutch corridor.