Re: [BGP Hijack] AS202734 hijacked multiple Chinese Carriers on May 16-17 – Full evidence and attribution

[茶栗 via NANOG <nanog () lists nanog org>]

Hello, Zhong Miao and other colleagues on the NANOG mailing list,

Apologies for the late-night message and for adding out-of-region noise 
to the mailing list, but I feel compelled to share some context 
regarding this situation.

Regarding the route leak itself:

1. It is quite common for networks with predominantly Chinese-speaking
   operators or customers to optimize traffic to and from Chinese
   networks (such as CU, CT, and CM). This is often achieved by
   manually specifying common Chinese IP prefixes and applying routing
   policies like BGP communities and cold-potato routing.
2. During configuration, the operator of AS202734 made an error,
   inadvertently applying specific BGP communities to 4,622 routes.
   While these routes were successfully filtered out before being
   exported to upstreams, they unfortunately leaked to HE route collectors.
3. The BIRD3 configuration for AS202734 is publicly available on
   GitHub, which effectively invalidates the report's implication of a
   malicious hijack (which in turn, appears to be an accusation that
   borders on defamation). Furthermore, the operator has provided a
   detailed post-mortem of the leak on the list.

Regarding the reports,

It might behoove certain individuals to acquire a fundamental grasp of 
BGP and route visibility before cluttering the NANOG list with 
low-effort, AI-generated drivel (even not formatted properly and with 
left over Markdown!) and rushing to claim to be "Independent Security 
Researchers". Furthermore, seasoned operators generally have the basic 
competence to distinguish between a mundane configuration error on a 
personal ASN and a malicious route hijack. I must point out that, 
choosing to deliberately conflate the two in order to launch a 
real-world harassment campaign (especially, including the deeply 
disturbing step of dragging the employer and the academic supervisor of 
the operator of AS202734 into the fray) speaks volumes.

I do agree that the operator of AS202734 needs to pay more attention on 
their configuration to prevent further routing incidents, especially 
considering the context of operating on the public Internet, not their 
homelab. However, this report reveals not a commitment to network 
security, but rather a profound lack of professional integrity that 
crosses the line into obsessive doxxing and harassment.

Wishing you a good day.
chariri
May 23, 2026

Attachment: OpenPGP_signature.asc
Description: OpenPGP digital signature

_______________________________________________
NANOG mailing list 
https://lists.nanog.org/archives/list/nanog () lists nanog org/message/W6OVMYPNN7FM65NKRU3HF3RKWQCOKYFK/