[BGP Hijack] AS202734 hijacked multiple Chinese Ca rriers on May 16-17 – Full evidence and attribution
me via NANOG <[email protected]>
| Newsgroups | gmane.org.operators.nanog |
|---|---|
| Message-ID | <[email protected]> |
Charlie, Thanks for the technical questions. The full evidence archive (with PII redacted) is available. To directly answer your requests: UTC timestamps & affected prefixes: Hijack window: 2026-05-16 to 2026-05-17 UTC. The attacker's own BIRD config shows manual injection of China Telecom's IPv6 backbone (240e::/20) on May 1 (premeditation). Full list of the 3,948 hijacked IPv4 prefixes is from Hurricane Electric's BGP data, timestamped on May 16-17. Traceroutes/MTRs: From my network (victim) to the attacker's infrastructure: as20473--nrt6.global.tianshome.net (log available in the archive). From attacker's Shanghai Looking Glass to my home IP: direct trace available in the archive. BGP collector / looking-glass sources: Hurricane Electric: https://bgp.he.net/AS202734 RIPE RIS data confirms the hijack peak during May 16-17. Attacker's own Looking Glass: https://lg.tianshome.net The complete evidence archive (PII redacted, including raw logs and emails) is available upon request to avoid cluttering the list. I will not attach files directly here. Thank you for helping validate this incident. _______________________________________________ NANOG mailing list https://lists.nanog.org/archives/list/[email protected]/message/6XX3QOI33A3JJGWC4XLVVIYUF2TFG5TV/