Dear Zhong, After analyzing the routing data and verifying the incident with AS202734’s NOC, this was not a DFZ-wide BGP hijack. The invalid announcements were visible only on bgp.he.net due to a route collector filtering issue and were not propagated to the public Internet, with no evidence of upstream acceptance or actual traffic attraction.
A route appearing on a single collector is not sufficient evidence of Internet-wide propagation, and incidents like this should be verified across multiple independent sources, such as bgp.tools and unrelated networks’ looking glass, before public attribution is made. Given current operational practice, widespread IRR filtering and increasing RPKI enforcement also make propagation of obviously invalid announcements significantly less likely. Additionally, the MoeDove LLC email you reposted explicitly included a confidentiality notice prohibiting unauthorized redistribution. Republishing private correspondence without consent may itself be improper or unlawful. Routing mistakes and invalid announcements should absolutely be discussed and corrected, but escalating unverified claims simultaneously to RIPE NCC, upstreams, employers, academic supervisors, and public operational mailing lists like NANOG without sufficient evidence of real-world impact is not constructive and unnecessarily consumes community and operational resources. Regards, Yanzheng > On May 21, 2026, at 10:33 PM, me via NANOG <[email protected]> wrote: > > Dear NANOG community, > > I am sharing a fully-attributed BGP hijacking incident that occurred on May > 16-17, 2026. > > **What happened:** > > Between May 16-17, 2026, AS202734 announced 3,948 IPv4 prefixes that it does > not legally own, targeting major Chinese carriers and infrastructure, > including: > - China Telecom (125.104.0.0/13) > - China Unicom (123.144.0.0/12) > - China Mobile > - China Education and Research Network (CERNET) > - China Postal Bureau (120.72.160.0/24) > - Alibaba Cloud, Tencent Cloud, Huawei Cloud > > The same ASN also announced China Telecom's IPv6 backbone (240e::/20). > > **Key technical evidence:** > - Attacker's own BIRD config shows manual injection of hijacked routes on May > 1 (premeditation). > - Attacker's own Looking Glass shows the hijacked routes were active in his > routing table. > - Attacker's GitHub shows he submitted a new ASN (AS402333) on May 16, the > day of the hijack. > - Sponsoring org (MoeDove)'s official website shows they operate 36 global > PoPs, including nodes in mainland China (Shanghai, Hangzhou, Zhengzhou, > Chengdu). > > **Who is behind it:** > AS202734 is registered to Junqi Tian (Jacob Tian), a graduate student at > McGill University and researcher at Mila - Quebec AI Institute. His RIPE > WHOIS address is: 1103-2100 Rue de Bleury, Montreal, Canada. > > **The sponsoring org:** > MoeDove LLC (ORG-ML942-RIPE) is the sponsoring organization. Their network > engineer responded to my abuse report by calling me an "idiot" and refused to > investigate. > > **What I have done:** > - Reported to RIPE NCC, Vultr, HE, Cloudflare, Mila, and his academic > supervisor. > - Vultr has cut IPv4 peering and is "working with the customer" on IPv6. > - RIPE NCC opened tickets #1042641 and #1043090, but stated they "do not have > the scope to act." > > **Attached原始邮件 (.eml) 供验证：** > - `moedove_abuse_reply_idiot.eml` (MoeDove engineer's response) > - `ripe_carl_guderian_1042641.eml` (RIPE NCC first reply) > - `ripe_carl_guderian_1043090.eml` (RIPE NCC second reply) > > **Questions for the community:** > 1. Has anyone else observed unusual prefixes from AS202734 / AS402333 / > AS44324? > 2. What operational steps can the community take to filter bogons from these > ASNs? > 3. Are there best practices for dealing with a sponsoring LIR that refuses to > act? > > **Public evidence:** > - HE BGP Toolkit: https://bgp.he.net/AS202734 > - RIPE WHOIS: https://apps.db.ripe.net/db-web-ui/query?searchtext=AS202734 > > Thank you for reading. I welcome any technical scrutiny or advice. Full > evidence archive (with PII redacted) is available upon request. > > --- > zhong miao > [email protected] > Independent Security Researcher<#1043090 - Re_ RE_ #1042641 - Data > Contradiction and Policy Violation_ 2001_678_1184___48 (EU vs > CA).eml><#1042641 - Re_ Data Contradiction and Policy Violation_ > 2001_678_1184___48 (EU vs CA).eml><Re_ Abuse Report_ AS202734 (Tianshome.net > _ Junqi Tian) - BGP Route Hijacking, IRR_ROA Invalid, > Ongoing.eml>_______________________________________________ > NANOG mailing list > https://lists.nanog.org/archives/list/[email protected]/message/MI6VWOX7XOCDIS244RLJSMS2ITZWTGED/ _______________________________________________ NANOG mailing list https://lists.nanog.org/archives/list/[email protected]/message/2PMG533XC55ODUSNMH4HQLNTHIJIODUU/
