TI-2026-045A — The Chinese Ecosystem Part A: The Three-Layer Architecture

Introduction

The question in Part A is not whether Chinese-origin infrastructure appears in the dataset. It does. The corpus for TI-2026-045A contains 710 Chinese IPs spread across 84 autonomous systems, with 117 of those IPs scoring a perfect abuse value of 100. The important question is structural: what kind of architecture allows so much hostile or abuse-heavy traffic to remain commercially usable, legally insulated, and operationally replaceable at scale? The evidence in this file points to a three-layer answer: a Seychelles registration shell, a Hong Kong technical manager, and a downstream operator layer that faces customers and produces the traffic investigators actually see.

That architecture matters because the abuse pattern does not sit at the fringe of the sample. State telecoms account for roughly 65% of the Chinese corpus, while major Chinese technology firms account for another 24%. At the top of the distribution are AS4811 ChinaNet Shanghai with 146 observed IPs and a 99% abuse score, AS4134 China Telecom with 115 IPs and a 90% abuse score, AS38365 Baidu with 79 IPs and a 100% abuse score, AS4837 China Unicom with 67 IPs, and AS137718 ByteDance with 54 IPs scoring 100%. This is not a portrait of one rogue reseller floating outside national infrastructure. It is a portrait of abuse moving inside a very large, very normal carrier environment.

The specific chain examined here is narrower and more revealing than the macro sample. Cloud Innovation Ltd, a Seychelles entity, received AFRINIC allocations that include 45.192.0.0/12 in 2014 and 154.192.0.0/11 in 2016, together totaling 3,145,728 IPv4 addresses. AFRINIC later froze 6.2 million Cloud Innovation-linked addresses in July 2021 for use outside the region, and the resulting legal war grew to at least 25 lawsuits, pushed AFRINIC into receivership in September 2023, and by May 2026 had escalated to a liquidation petition with ICANN joining as a party. The point is not only the size of the resource pool. The point is that the resource pool was extracted from a regional governance system and inserted into a cross-border commercial chain whose operators could always point somewhere else when accountability arrived.

This rewrite stays with the narrowest verifiable record. Older summaries around this case often use a broader “16 million addresses” frame inherited from earlier reporting. The directly evidenced anchors in TI-2026-045A are the 2014 /12, the 2016 /11, and AFRINIC’s 6.2 million-address freeze. That narrower framing is still enough to establish the core conclusion: Cloud Innovation, LARUS, and Yisu are not merely adjacent names in scattered registration records. They form a jurisdictional machine designed so that no single authority sees the whole chain and no single complaint reaches the actor who can both identify the abusive customer and terminate the service.

1. The Baseline Before Attribution: What the Chinese Sample Actually Looks Like

Before tracing the Cloud Innovation chain, the broader baseline has to be stated clearly. The Chinese dataset is large, diverse, and top-heavy at the same time. It is diverse because 84 ASNs means many network identities. It is top-heavy because a small number of state carriers and major platforms account for most of the observable surface. That matters analytically: if an abuse-intensive operator can hide inside that environment, the shield is not just corporate opacity. It is statistical camouflage. A few dozen or few hundred malicious or abuse-heavy nodes are easier to absorb when they travel through giant national backbones that already carry enormous legitimate traffic volumes.

Those numbers do not prove that all observed behavior is centrally coordinated. That would be an overclaim. What they prove is something simpler and harder to dismiss: the Chinese ecosystem in this corpus is not made up mainly of obscure, disposable hosters. Its visible bulk sits in networks with national significance or platform-scale reach. That changes the reading of the Cloud Innovation-LARUS-Yisu chain. The chain is not floating in empty space. It is plugged into a broader environment where volume, churn, and institutional distance already work in favor of delayed enforcement.

Within that broader baseline, 117 Chinese IPs score abuse=100. A perfect score is not moral language. It is operational language. It means the enrichment pipeline saw enough convergent signals—scanner behavior, abuse reputation, role consistency, and recurrence—to produce maximal confidence for those nodes. The existence of 117 such nodes across the sample means the problem is not occasional contamination by bad customers. It is recurrence at a scale that requires structure.

• State telecoms at 65% means the ecosystem’s atmospheric cover is carrier-grade rather than boutique.
• Big Tech at 24% means major commercial platforms are also part of the observable terrain.
• 84 ASNs means the surface is fragmented enough to frustrate simplistic blocking strategies.
• 117 perfect-abuse IPs means the problem cannot be reduced to a handful of accidental false positives.

Part A therefore begins from a baseline of scale and heterogeneity, then narrows to a specific architecture that solves a recurring problem for abuse-heavy infrastructure: how to preserve routable address space, technical control, and customer monetization while ensuring that any attempt at remediation is bounced across jurisdictions until the complainant gives up.

2. The Architecture at a Glance: Three Layers, Three Functions, One Accountability Sink

The chain documented in TI-2026-045A is best understood functionally rather than nominally. Each layer performs a different task. Cloud Innovation holds or fronts the legal entitlement to African-allocated IP resources. LARUS manages the technical objects, maintenance contacts, and routing administration that make those resources usable. Yisu Cloud and related downstream brands face the market, lease the space, host the activity, and generate the attacks that appear in telemetry. The names differ because the functions differ. That is why the structure persists even when the branding changes.

The key analytical mistake is to treat those three layers as independent companies that happen to touch the same address space. The evidence does not support that reading. Records place LARUS Limited directly in the technical-management role for Cloud Innovation space, including the maintainer object LARUS-SERVICE-MNT, a Hong Kong address at TML Tower, a Hong Kong phone number, and an abuse mailbox under larus.help. Cloud Innovation’s AFRINIC entity under Lu Heng, with contacts at @larus.net, including Tingting Xu in Hong Kong and Dillon Jodamus and Ncube Gwen in Cape Town. Additional records explicitly connect LARUS and Cloud Innovation Support to Yisu Cloud. The chain is not inferred from one shared logo or vague market rumor. It is visible in the maintenance, contact, and routing relationships.

The second mistake is to imagine that the structure’s purpose is secrecy in the classic sense. It is not especially secret. Investigators can still map it. The purpose is unreachability. Each layer is designed to be visible enough to do business and obscure enough to avoid decisive compulsion. The system does not need to hide forever. It only needs to ensure that the victim, registrar, abuse desk, and regulator are never dealing with the same legal person at the same time.

That is why the three-layer model should be read as an accountability sink. Complaints travel into it. Authority disperses inside it. Remediation rarely comes back out.

3. Layer One — Cloud Innovation Ltd: The Seychelles Shell as Legal Anchor

Cloud Innovation Ltd is the first layer because it solves the first problem: how to acquire or front resources from AFRINIC, the regional internet registry serving Africa and the Indian Ocean. The entity appears in AFRINIC RDAP as ORG-CIL1-AFRINIC, registered on 2013-07-16, with ownership attributed to Lu Heng of Hong Kong and contacts under the @larus.net domain. That combination matters. Seychelles provides the regional eligibility nexus. Hong Kong-linked personnel provide the commercial-operational nucleus. The result is a shell with just enough African-regional legitimacy to receive resources and just enough offshore opacity to complicate ownership and enforcement questions.

Two flagship AFRINIC allocations define the documentary record. The first is 45.192.0.0/12, allocated 2014-12-01, country code SC, type ALLOCATED PA. The second is 154.192.0.0/11, allocated 2016-09-23, also country code SC and ALLOCATED PA. Together they total just over 3.1 million IPv4 addresses. Those are not small operational pools. They are strategic reserves. Address scarcity is one of the central constraints on any hosting business that wants churn, resale, rebranding, and rapid customer replacement. Large pools reduce that constraint. Large pools obtained from a different region’s public-trust allocation system reduce it even further.

The Cloud Innovation layer also solves the problem of narrative posture. A Seychelles company can present itself as an offshore service provider, an African-region member, or simply a neutral holding company, depending on who is asking. The same entity can be marketed to customers as global, to registries as compliant, and to complainants as merely administrative. The shell does not have to provide detailed beneficial ownership transparency for that posture to work. It only has to remain structurally thin enough that operational responsibility can be pushed elsewhere.

Seychelles-registered hosting entities provide beneficial-owner opacity, generic corporate naming, and a commercial wrapper that looks normal from a distance. In that sense, Cloud Innovation is not important because it is exotic. It is important because it is ordinary in exactly the way offshore shells are supposed to be ordinary. The less memorable the wrapper, the more reusable it becomes.

There is a second, more consequential function at layer one: the shell converts a governance problem into a litigation problem. Once the address resources are formally attached to a recognized entity, any attempt to reclaim, suspend, or re-evaluate them can be contested as a property, contract, or due-process dispute rather than a straightforward policy-enforcement action. That is the transition investigators should keep in view. Abuse begins as a technical problem. The shell reclassifies it into a jurisdictional and procedural one.

The sharper point is this: layer one is not where most victims will ever see the abuse. Victims see scanner IPs, brute-force attempts, credential attacks, or malware infrastructure. They do not see the legal wrapper unless they start pulling RDAP, WHOIS, and litigation history. That asymmetry is part of the design. The attack surface is close to the victim. The allocative entitlement is far away, abstract, and expensive to challenge.

4. Layer Two — LARUS Limited: The Hong Kong Technical Manager That Makes the Shell Usable

If Cloud Innovation is the legal anchor, LARUS is the operational hinge. Without a layer like LARUS, the shell is just paperwork. LARUS Limited in Hong Kong as the technical manager of Cloud Innovation’s IP space, using the maintainer object LARUS-SERVICE-MNT, a Tsuen Wan address, a Hong Kong phone number, and abuse handling through abuse@larus.help. The relationship more directly: LARUS routes for Yisu Cloud, and 16 of 43 tracked Cloud Innovation IPs map to the organization string YISUCLOUDLTD-HK. In plain language, LARUS is the layer that turns abstract address ownership into routable, marketable inventory.

Why put that layer in Hong Kong? Because Hong Kong historically offered exactly the right blend of commercial credibility, telecommunications infrastructure, and cross-border distance. It is legible to carriers, customers, and intermediaries. It is close enough to mainland operators to function smoothly. It is far enough from Seychelles to create a second legal step in any enforcement path. And because it is the technical manager rather than the formal African-region holder, it can always argue that it is merely administering resources or providing transit for someone else.

The contact pattern in E11 deepens that conclusion. Cloud Innovation’s AFRINIC entity includes LARUS-domain contacts in both Hong Kong and Cape Town. That is not decorative metadata. It shows a management stack spanning the formal African-region touchpoint, the Hong Kong administration layer, and an Africa-facing contact facade. The same domain family appears where the legal holder ought to be independent. Independence is precisely what the record does not show.

LARUS also matters because of who else it serves. That LARUS clients include China Telecom and China Mobile. That fact does not prove that those carriers endorse every downstream use of Cloud Innovation-linked space. It proves something narrower and still significant: the same Hong Kong technical-management entity that bridges African IP extraction to downstream hosting also interfaces with core state telecom infrastructure. This collapses any attempt to dismiss LARUS as a marginal operator with no reach into the main Chinese network economy.

• Administrative role: maintainer objects, abuse mailboxes, technical records, routing contacts.
• Commercial role: makes extracted IP space rentable and transferable downstream.
• Jurisdictional role: inserts a Hong Kong layer between the African registry dispute and the customer-facing operator.
• Strategic role: interfaces with both offshore shell structures and major Chinese carriers.

Once LARUS is in place, the chain acquires an important property: deniable specialization. Cloud Innovation can say it is the registrant. LARUS can say it is the technical manager. Yisu can say it is the customer-facing service provider or downstream operator. Each statement can be individually true while collectively preventing accountability. That is why this architecture is stronger than a single shell company. It distributes truth in pieces too small to enforce.

LARUS is also the reason complaints become circular. A victim who traces a hostile IP may find Cloud Innovation-related records. Those records point toward support or maintenance contacts. The maintenance role points to LARUS. LARUS can point back to the registrant, or down to the customer-facing operator, or sideways to abuse processes that lack authority. Every hop is plausible. None are decisive. The system is not broken when that happens. The system is working.

5. Layer Three — Yisu Cloud and the Downstream Surface: Where the Traffic Becomes Visible

Layer three is where victims finally meet the architecture. Yisu Cloud is the operational surface in this part of the series: a customer-facing brand tied to AS138152 and AS142403, linked to Cloud Innovation through shared contacts and to LARUS through routing relationships. The TI-2026-045A investigation describes Yisu as a Hong Kong-facing cloud brand whose scored sample IPs show 100% abuse confidence. That figure does not mean every packet from every Yisu customer is malicious. It means the enriched investigative sample tied to this brand cluster was uniformly abusive, which is exactly the kind of consistency analysts look for when distinguishing structural abuse from random bad tenancy.

the boundary between brands is porous in practice. IP 45.195.221.26 routes through AS135377, associated with UCloud, yet carries rdap_org='Cloud Innovation Support'. That means the registrant identity, the routed network identity, and the customer-facing brand identity do not align cleanly. Such crosslinking is not a bookkeeping accident. It is what happens when address inventory is shared across an operator cluster that wants the flexibility of multiple brand surfaces without the burden of multiple fully separable infrastructures.

The downstream layer therefore performs three tasks at once. First, it monetizes the address space through resale, hosting, and customer acquisition. Second, it generates the actual attack traffic that enters honeypots, blacklists, and incident queues. Third, it absorbs immediate reputational heat. If a specific downstream brand is flagged, another brand, ASN, or sub-allocation can often keep trading because the upstream legal and technical infrastructure remains intact.

The presence of additional names in the actor list—HK Kwaifong Group Limited, HONG KONG LING JIAN ZHUO TECHNOLOGY CO., LIMITED, Antbox Networks—strengthens the same reading. The important point is not that every downstream brand is identical. The important point is that the address space is reused through a constellation of names large enough to fragment attribution but small enough to remain operationally coordinated. In other words, multiplicity is not noise. Multiplicity is a control mechanism.

This is also where the difference between abuse reports and remediation capacity becomes obvious. Victims and defenders usually interact with the bottom layer because that is where the IP appears. But the bottom layer often does not own the hardest asset to replace: the address pool and its upstream technical administration. If Yisu loses a subnet, the chain can sometimes rotate. If Cloud Innovation and LARUS lose the resource base and technical management layer, the business model takes a much deeper hit. The architecture is therefore built so complaints arrive first at the place with the least strategic value to the chain and the least incentive to reveal the rest.

6. The AFRINIC Extraction: From Regional Public Trust to Offshore Inventory

The three-layer architecture only works because there was something worth building it around. That something is AFRINIC-allocated IPv4 space. AFRINIC exists to manage internet number resources for Africa and the Indian Ocean as a public trust, allocating based on demonstrated regional need and policy compliance. The Cloud Innovation case asks what happens when that governance model meets an actor willing to combine shell-company registration, technical indirection, and relentless litigation. The answer, according to the evidence record, is that an African public resource can be converted into offshore inventory while the registry itself is dragged into institutional crisis.

The documentary anchors are clear. Cloud Innovation’s 45.192.0.0/12 allocation dates to December 2014. The 154.192.0.0/11 allocation dates to September 2016. Later reporting and AFRINIC-linked public records state that 6.2 million Cloud Innovation-associated IPs were frozen in July 2021 for leasing outside the region. The problem with necessary bluntness: addresses intended for the African service region were announced from European and American data centers, with zero routing paths traversing African infrastructure. If that description is accurate, the core policy violation is not subtle. The addresses were not merely underused in Africa. They were operationalized elsewhere.

The legal asymmetry is part of the extraction mechanism. The contested AFRINIC addresses at roughly R6 billion, or about $315 million USD. That dwarfs the budgetary resilience of a regional registry. That the dispute generated 25 lawsuits and even froze all AFRINIC bank assets by order of the Supreme Court of Mauritius. When a public-trust allocator faces an adversary who can finance litigation worth many multiples of the allocator’s annual budget, enforcement becomes attritional. The question stops being “is this policy-compliant?” and becomes “can the institution survive long enough to keep arguing?”

an important, uncomfortable nuance. Former AFRINIC staff member Ernest Byaruhanga separately stole 4.1 million IPs by modifying WHOIS records, with the stolen space reportedly hosting gambling and pornography for Chinese users. That is not the same case as Cloud Innovation and should not be collapsed into it. But it does show that the governance environment around AFRINIC resources had already been stressed by insider compromise and commercial exploitation. Cloud Innovation did not create that weakness alone. It weaponized a governance ecosystem whose defenses were already thinner than the asset values attached to them.

That is why “AFRINIC extraction” is the right phrase. This is not normal secondary market behavior. This is regional digital infrastructure being converted into external revenue-generating inventory through legal shelling, technical management indirection, and jurisdictional delay. Africa loses address headroom. Offshore operators gain routable scarcity. The registry absorbs the lawsuit burden. The downstream market keeps moving.

7. The Jurisdictional Loop: Why Abuse Reports Circle Instead of Landing

The phrase “jurisdictional loop” sounds abstract until it is mapped as a workflow. In practice the path looks like this: a victim or defender sees hostile traffic from a downstream IP; the RDAP or abuse contact reveals a Cloud Innovation or Cloud Innovation Support artifact in Seychelles; technical or maintenance details point toward LARUS in Hong Kong; the downstream brand points toward Yisu or another operator; that operator can claim it is only leasing or routing space; complaints move back upward to the registrant or sideways to the technical manager; and no point in the loop guarantees disclosure of the actual customer or decisive service termination.

The loop works because each jurisdiction sees a different legal question:

No single slice is enough. Seychelles may host the paper company, but that does not guarantee visibility into the technical routing decisions or the downstream customer set. Hong Kong may host the maintainer and technical contacts, but that layer can argue it merely administers or resells. The downstream operator sits closest to the actual abuse yet can rely on upstream opacity and foreign registration layers to keep complainants at arm’s length. The architecture converts a unified commercial chain into a fragmented legal landscape.

the term “jurisdictional arbitrage machine.” That is exactly right. Arbitrage here does not mean exploiting a price gap. It means exploiting a responsibility gap. The shell exists where eligibility is easiest. The technical manager exists where administration is easiest. The operator exists where the customer market is easiest. The victim, by contrast, has to work across all three at once. That is the asymmetry.

The evidence also shows why simple abuse-desk logic fails. Most abuse-desk workflows assume the listed contact is either the operator or an actor able to identify the operator quickly. In this chain, the listed contact may only be the next doorway in the maze. The complaint is not refused outright. It is processed into delay. Delay, in this market, is often enough.

• Addresses can be reassigned or rotated faster than many manual complaint cycles complete.
• Victims rarely have the budget to litigate across Seychelles, Hong Kong, and China.
• Regional registries can assert policy, but enforcement gets entangled with court orders and institutional survival.
• Downstream brands can be renamed, replaced, or diffused across additional organization strings.

8. Why No Single Jurisdiction Can Fully Compel Remediation

To say that “no single jurisdiction can fully compel remediation” is not rhetorical. It is a testable institutional claim. Remediation requires at least four powers: the ability to identify the responsible customer, the ability to map the full chain of technical control, the ability to force record production, and the ability to terminate or reclaim the underlying resource. In the Cloud Innovation-LARUS-Yisu architecture, those powers are split.

Seychelles can host the shell and, on paper, the registrant identity. But beneficial ownership opacity and offshore-company thinness limit what a routine complainant can extract. Even if Seychelles forced a response from the shell, the decisive customer and routing data may sit elsewhere. Hong Kong can host the technical manager, but a technical manager can present itself as infrastructure middleware rather than the abusive end-user’s principal. China hosts or services the downstream customer base, but foreign complainants generally do not enjoy a straightforward, rights-like path into that enforcement system—especially when the upstream resource entitlement sits outside China’s registry structure.

That institutional split explains why direct legal victory at one point may still fail operationally. Suppose AFRINIC wins an argument about policy non-compliance. It still has to survive the litigation burden and translate a policy win into effective control over contested resources. Suppose a victim proves abuse from a Yisu-linked node. That still does not automatically reveal the upstream resource chain or force a reclaim of the parent pool. Suppose a carrier peer or transit provider receives evidence. It may still treat the matter as an abuse issue for the listed operator rather than a structural allocation dispute.

The chain is therefore robust against single-point pressure. It does not need each jurisdiction to be fully captured or complicit. It only needs each jurisdiction to be incomplete. Incomplete authority is enough to preserve the machine as long as the commercial gains from keeping it alive exceed the cost of localized nuisance.

This is why the architecture should be understood as an answer to the problem of compellability. Many abuse-heavy infrastructures can tolerate bad press. Fewer can tolerate subpoenas or coordinated reclaim actions. The Cloud Innovation chain is built to make those actions expensive, slow, and jurisdictionally disaggregated.

The difference between China and the United States in this respect is revealing. The U.S. Comparison corpus in TI-2026-045A contains 1,857 IPs across 245 ASNs, with a threat average around 33 and a response rate of roughly 40%. China’s observed response rate in this comparison set is effectively 0%. That does not mean every American abuse desk is virtuous or every Chinese operator is malicious. It means the measurable operational expectation differs sharply. In one environment, complaints sometimes terminate nodes. In the other, the architecture is arranged so complaints usually disappear into process.

9. The Comparative Baseline Matters: China’s Zero-Response Pattern Is the Context, Not a Side Note

Comparisons are dangerous when used lazily, but useful when used narrowly. The U.S. Sample is larger in raw IP count—1,857 IPs across 245 ASNs—yet its aggregate threat profile is much lower, around 33, and the documented response rate is roughly 40%. China’s comparison figure is not merely higher threat with lower response. It is high threat with an observed response rate around zero. The implication is not that American infrastructure is clean. The implication is that the expected cost of operating in the Chinese abuse-response environment is substantially lower for repeat offenders.

That matters because the Cloud Innovation-LARUS-Yisu chain does not operate in a vacuum. Its economic value depends on where the downstream traffic can move with the least interruption. Extracted African address space becomes more useful when inserted into an ecosystem where response norms are weak, attribution is fragmented, and giant carriers provide atmospheric cover. The offshore shell acquires the resource. The Hong Kong manager operationalizes it. The broader Chinese environment supplies the tolerance.

If the response pattern were different—if complaints routinely triggered transparent customer identification, subnet quarantine, or rapid upstream intervention—the value of the architecture would drop. The fact that it persists suggests the market judges the opposite: the architecture works because the environment lets it work.

Series Connection

Part A establishes the machine: Cloud Innovation as the allocative shell, LARUS as the Hong Kong technical bridge, and Yisu plus other downstream brands as the operational surface. The immediate next step is Part B, which tests whether the bottom layer behaves like unmanaged customer spillover or like an abuse-tolerant service model. Part C then contrasts this commercial-jurisdictional shield with the Tencent/Aceville pattern, where the problem is less bulletproof obscurity than selective enforcement inside a state-adjacent ecosystem.

The later parts of the series widen the frame. Parts D through F examine wrapper entities, backbone behavior, and recurrent failure modes. Parts G through N move from infrastructure into law, geopolitics, and transnational enforcement gaps. Parts O and P return to synthesis: China versus America as operational environments, then the unified architecture tying state carriers, Big Tech, offshore shells, and downstream credential-industrial abuse into one map. Without Part A, those later arguments risk sounding ideological. With Part A, they rest on a documented chain of legal form, technical control, and routable inventory.