Chapter 1: Suite 310

The official story begins with a legal form. The forensic story begins with an address. Suite 310, 21 Hill Street is not an operational nerve center for a strategically awkward routing estate. It is a formation-agent location in Haverfordwest. Its job is not to run the network. Its job is to reassure the first person who asks where the network lives.

That is why the address matters. Institutions still trust physical registration. A British postcode softens questions from banks, vendors, registries, and journalists before they ever reach Seychelles member entities, Russian sponsor chains, or Iranian beneficiary routes. The shell does not need to be glamorous. It needs to be administratively ordinary.

In a town this small, the contrast becomes sharp enough to see. Not because the town itself is suspicious, but because the distance between local physical footprint and global routing consequence becomes absurd. The Welsh address is not the network. It is the network’s mask.

Chapter 2: The Corporate Architecture

The designated members of GCS LLP are LUPINE LOGISTICS LTD and LS TRADING PARTNERS INC, both Seychelles IBCs using the same registered-agent address at Sound & Vision House, Francis Rachel Street, Victoria, Mahe. Their numbers are 215807 and 215808. Consecutive numbers are not style. They are a fingerprint. These companies were created together as a pair.

No logistics operation has been identified for Lupine Logistics. That matters because the name seems to exist mainly to imply commerce that the public record does not reveal. LS Trading Partners does the same thing from a different angle: broad, respectable, and empty enough to carry whatever purpose the shell needs next.

The actual controller is Evgeniy Marinko, recorded as the person with significant control with 75%+ ownership, voting rights, and appointment power. His identity was verified on 13 December 2023 by COMFORM SOLUTIONS LIMITED, exactly 37 days before GCS LLP was incorporated. The compliance layer was present at birth.

Chapter 3: The Russian Backbone

Under the British shell sits a Russian technical spine. AS215540 is sponsored by LLC Internet Tehnologii, a Russian LIR. GCS also operates AS207713 (GIR) under the same sponsor logic. The dual-ASN arrangement is not just redundancy. It is continuity insurance.

The RIPE objects are even more revealing. ru-quasar-1-mnt appears as a shadow maintainer inside the GCS environment. INETTECH-MNT has mnt-routes authority over the historical IROST prefixes. Frequent BGP traversal through Rostelecom (AS12389) adds state-telecom gravity to the same picture.

Then the ecosystem clue appears: 185.88.99.0/24, registered to PROXY6 LLC, is originated by AS215540, with ru-quasar-1-mnt in the object atmosphere. A proxy-service adjacency does not prove a unified conspiracy. It proves comfort with mediated presence — distance between action and actor sold as a service.

Chapter 4: The Iranian State

The beneficiary side of this corridor is not generic “Iranian traffic.” It is IROST — the Iranian Research Organization for Science and Technology — affiliated with Iran’s Ministry of Science, Research and Technology, established in 1980, and led by Dr. Ahmad Akbari. Naming the institution matters because it replaces vague geopolitics with a specific state-linked body.

IROST carries a documented proliferation-sensitive history. Canada designated it in July 2010 as contributing to Iran’s proliferation-sensitive nuclear activities. Japan listed it in 2011 as an entity of concern for WMD proliferation. The UK listed it in 2011 as an entity of potential concern for WMD-related procurement. And the UK had already identified IROST in February 1998 as having procured goods and technology for biological WMD programs.

The older details are what make the later routing story impossible to trivialize. In 1989, IROST tried to purchase toxin-producing fungus strains from the Netherlands and was denied. It oversees a Biotechnology Research Center with a Persian Type Culture Collection. It has done pilot-scale production of Bacillus thuringiensis, relevant in proliferation discourse because it can be used as an anthrax simulant.

Chapter 5: The Transfer

The corridor becomes operationally undeniable in 16–18 September 2025. In that narrow window, historical IROST-linked prefixes 213.176.16.0/24 and 213.176.18.0/24 move into the GCS / GIR routing umbrella. This is the hinge point where the shell structure stops looking merely capable of carrying sensitive traffic and starts actually carrying it.

Then comes the metadata move: the prefixes are re-registered in RIPE with country=NL. Not Iran. Netherlands. That field does not change physical reality, but it changes first-glance interpretation. To many downstream readers, Dutch paperwork is enough to quiet the Iranian question before it fully forms.

The presence of INETTECH-MNT as mnt-routes authority over the same prefixes makes the rewrite even more revealing. Iranian historical allocation, Russian route authority, British legal wrapper, Dutch country field: the corridor becomes a layered narrative-management machine.

Chapter 6: The Honeypot Evidence

The corridor is visible not only in public registries but in live telemetry. Our database contains 25 AS215540-linked IPs spanning more than 12 country identities. Most resolve to RU in BGP. Several present European or US faces in derived or RDAP layers. Three are clearly Iranian. One is clearly Seychellois. The map does not merely disagree with itself; it argues with itself.

The politically cleanest paradox is 62.60.234.140: Latvia on paper, Iran in BGP, under a UK shell, with 35 hits in our telemetry. The identity-chaos champion is 5.253.59.68: NL in the derived layer, BG in BGP, FI in RDAP, with 30 hits. Meanwhile the quiet Iranian hosts prove the corridor is carrying what the shell architecture implies it was built to carry.

The outlier that feels almost too neat is 193.39.208.26, which resolves to Seychelles — the same jurisdiction used by the LLP’s member shells. The shell geography shows up again in the address space like an involuntary confession.

Chapter 7: The Cogent Problem

BGP paths touching GCS frequently traverse both Rostelecom (AS12389) and Cogent Communications (AS174). That pairing matters. Rostelecom gives the corridor Russian state-telecom gravity. Cogent gives it mainstream global normality. This is how politically awkward routing becomes commercially mundane.

The question is not whether a US backbone intended to serve historical Iranian state research space through a Russian-sponsored UK shell. The question is whether the corridor has been arranged so that no transit participant has to confront the full beneficiary chain at once.

Chapter 8: The 15,000

If GCS LLP were unique, the case would be easier to marginalize. It is not. Transparency International found around 15,000 UK LLPs — roughly 10% of the stock — controlled by pairs of offshore corporate partners. The pattern in this dossier is therefore not some rare mutation. It is a recognized British failure mode.

The overlap is almost mechanical: UK wrapper, paired offshore members, same agent address, distant natural controller, and a high-value operating function whose political significance far exceeds the apparent modesty of the registered office. BBC reporting in 2023 on Seychelles-linked exploitation of UK loopholes did not need to mention GCS specifically to be relevant. It described the terrain in which GCS makes perfect sense.

Chapter 9: The Sanctions Paradox

The UK’s Iran Sanctions Regulations 2023 are written around funds and economic resources. The corridor lives in the space where routing tries to pretend it is neither. Is transit a resource? Is operational reachability? Is BGP continuity? Is a British shell making a sensitive Iranian state-linked institution easier to keep online? The law hesitates. The corridor profits.

RIPE’s behavior shows the same friction. RIPE NCC postponed invoicing Iranian and Syrian members because sanctions exposure looked risky. It later removed restrictions from 49 members and end users after JCPOA adjustments. Experts warned that providing resources to sanctioned entities could create criminal-liability problems for leadership. Yet the sponsor model still lets a Russian LIR support a UK shell that routes Iranian state-linked space.

Chapter 11: The Question of Intent

The timeline does not prove criminal mens rea. It does prove sequence, and sequence is often where intent stops needing melodrama. First the Russian controller is verified. Then the British LLP is formed behind two consecutive Seychelles shells. Then the Russian-sponsored dual-ASN estate matures with strong 96% RPKI coverage. Then historical IROST-linked prefixes move under the corridor in 16–18 September 2025 and present as Dutch in RIPE.

Chapter 12: The Pipeline Persists

As of this writing, GCS LLP remains active. AS215540 remains live. AS207713 remains the adjacent continuity path. Historical IROST-linked space remains part of the documentary record. No public prosecution is visible. No visible forced unwind is visible. The corridor persists because looking is not the same as seeing.

The public facts are not buried. The PSC is public. The Seychelles pair is public. The Russian sponsor is public. The IROST profile is public. The route-authority clues are public. The pathing is observable. What keeps the pipeline alive is not invisibility. It is compartmentalized normality.

British company law can say it only hosts a form. Offshore agents can say they only sell incorporations. Russian sponsors can say they only maintain technical relationships. Backbones can say they only move traffic. Registries can say they only reflect administrative reality. Each sentence contains enough truth to preserve comfort. Together they build an answer that Tehran’s state-adjacent internet can use.