[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"public-config":3,"i-flag:ph-4x3":14,"i-flag:us-4x3":19,"i-flag:de-4x3":21,"i-flag:hk-4x3":23,"i-tabler:lifebuoy":25,"i-tabler:timeline":28,"i-tabler:apps":30,"i-tabler:package":32,"i-tabler:circle-half-2":34,"i-tabler:sun":36,"i-tabler:moon":38,"i-tabler:menu-2":40,"i-tabler:user":42,"i-tabler:notebook":44,"i-simple-icons:forgejo":46,"i-tabler:shield-lock":48,"i-tabler:tools":50,"i-tabler:calendar":52,"i-tabler:x":54,"$fqt9mjjg2kz8q":56,"i-tabler:arrow-left":112,"i-tabler:tag":114},{"matomo":4,"booking":7,"site":9,"blog":11,"newsletter":12},{"enabled":5,"siteId":6},true,"7",{"enabled":5,"url":8},"https:\u002F\u002Fcal.com\u002Fjdbungart",{"url":10},"https:\u002F\u002Fjdneer.com",{"enabled":5},{"enabled":13},false,{"left":15,"top":15,"width":16,"height":17,"rotate":15,"vFlip":13,"hFlip":13,"body":18},0,640,480,"\u003Cpath fill=\"#0038a8\" d=\"M0 0h640v240H0z\"\u002F>\u003Cpath fill=\"#ce1126\" d=\"M0 240h640v240H0z\"\u002F>\u003Cpath fill=\"#fff\" d=\"M415.7 240L0 480V0\"\u002F>\u003Cpath fill=\"#fcd116\" d=\"M26.7 42.4L41 55l16.6-9.2l-7.4 17.5l14 13l-19-1.6l-8.1 17.2l-4.3-18.5L14 71l16.3-10zm323.8 172.3l.4 19l18 6.3l-18 6.2l-.4 19l-11.5-15.1l-18.2 5.5l10.8-15.6l-10.8-15.6l18.2 5.5zM37.2 388.1l8 17.2l19-1.6l-13.9 13l7.4 17.5l-16.6-9.1l-14.4 12.4l3.6-18.7L14 409l18.9-2.4zm114.2-249l-6.2 6.2l3.1 47l-3 .3l-5.7-42.9l-5.1 5l7.6 38.4a48 48 0 0 0-17.2 7.1l-21.7-32.4H96l26.4 34.3l-2.4 2l-31.1-35.5h-8.8v8.8l35.4 31l-2 2.5l-34.3-26.3v7.1l32.5 21.7q-5.2 7.8-7.1 17.2L66.3 223l-5.1 5l42.9 5.7q-.3 1.6-.3 3.1l-47-3l-6.2 6.2l6.2 6.2l47-3.1l.3 3.1l-42.9 5.7l5 5l38.4-7.6a48 48 0 0 0 7.1 17.2l-32.5 21.7v7.2l34.3-26.3l2 2.4l-35.4 31v8.8H89l31-35.4l2.5 2L96 312.2h7.2l21.7-32.5q7.8 5.2 17.2 7.1l-7.6 38.4l5 5l5.7-42.9q1.5.3 3.1.3l-3 47l6.1 6.2l6.3-6.2l-3.1-47l3-.3l5.7 43l5.1-5.1l-7.6-38.4a48 48 0 0 0 17.2-7.1l21.7 32.5h7.2l-26.4-34.3l2.4-2l31.1 35.4h8.8v-8.8l-35.4-31l2-2.4l34.3 26.3v-7.2l-32.5-21.7q5.2-7.8 7.1-17.2l38.3 7.6l5.1-5l-42.9-5.7q.3-1.5.3-3.1l47 3l6.2-6.1l-6.2-6.2l-47 3l-.3-3l42.9-5.7l-5-5l-38.4 7.5a48 48 0 0 0-7.1-17.2l32.5-21.7v-7.1l-34.3 26.3l-2-2.4l35.4-31v-8.9H214l-31 35.5l-2.5-2l26.4-34.3h-7.2L178 200.2q-7.8-5.2-17.2-7.1l7.6-38.3l-5-5l-5.7 42.8l-3.1-.3l3-47z\"\u002F>",{"left":15,"top":15,"width":16,"height":17,"rotate":15,"vFlip":13,"hFlip":13,"body":20},"\u003Cpath fill=\"#bd3d44\" d=\"M0 0h640v480H0\"\u002F>\u003Cpath stroke=\"#fff\" stroke-width=\"37\" d=\"M0 55.3h640M0 129h640M0 203h640M0 277h640M0 351h640M0 425h640\"\u002F>\u003Cpath fill=\"#192f5d\" d=\"M0 0h364.8v258.5H0\"\u002F>\u003Cmarker id=\"SVGEq3dreKJ\" markerHeight=\"30\" markerWidth=\"30\">\u003Cpath fill=\"#fff\" d=\"m14 0l9 27L0 10h28L5 27z\"\u002F>\u003C\u002Fmarker>\u003Cpath fill=\"none\" marker-mid=\"url(#SVGEq3dreKJ)\" d=\"m0 0l16 11h61h61h61h61h60L47 37h61h61h60h61L16 63h61h61h61h61h60L47 89h61h61h60h61L16 115h61h61h61h61h60L47 141h61h61h60h61L16 166h61h61h61h61h60L47 192h61h61h60h61L16 218h61h61h61h61h60z\"\u002F>",{"left":15,"top":15,"width":16,"height":17,"rotate":15,"vFlip":13,"hFlip":13,"body":22},"\u003Cpath fill=\"#fc0\" d=\"M0 320h640v160H0z\"\u002F>\u003Cpath fill=\"#000001\" d=\"M0 0h640v160H0z\"\u002F>\u003Cpath fill=\"red\" d=\"M0 160h640v160H0z\"\u002F>",{"left":15,"top":15,"width":16,"height":17,"rotate":15,"vFlip":13,"hFlip":13,"body":24},"\u003Cpath fill=\"#ec1b2e\" d=\"M0 0h640v480H0\"\u002F>\u003Cpath id=\"SVG5tfvBPpj\" fill=\"#fff\" d=\"M346.3 103.1C267 98 230.6 201.9 305.6 240.3c-26-22.4-20.6-55.3-10.1-72.4l1.9 1.1c-13.8 23.5-11.2 52.7 11.1 71c-12.7-12.3-9.5-39 12.1-48.9s23.6-39.3 16.4-49.1q-14.7-25.6 9.3-38.9M307.9 164l-4.7 7.4l-1.8-8.6l-8.6-2.3l7.8-4.3l-.6-8.9l6.5 6.1l8.3-3.3l-3.7 8.1l5.6 6.8z\"\u002F>\u003Cuse href=\"#SVG5tfvBPpj\" transform=\"rotate(72 312.5 243.5)\"\u002F>\u003Cuse href=\"#SVG5tfvBPpj\" transform=\"rotate(144 312.5 243.5)\"\u002F>\u003Cuse href=\"#SVG5tfvBPpj\" transform=\"rotate(216 312.5 243.5)\"\u002F>\u003Cuse href=\"#SVG5tfvBPpj\" transform=\"rotate(288 312.5 243.5)\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":27},24,"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M8 12a4 4 0 1 0 8 0a4 4 0 1 0-8 0\"\u002F>\u003Cpath d=\"M3 12a9 9 0 1 0 18 0a9 9 0 1 0-18 0m12 3l3.35 3.35M9 15l-3.35 3.35m0-12.7L9 9m9.35-3.35L15 9\"\u002F>\u003C\u002Fg>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":29},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"m4 16l6-7l5 5l5-6\"\u002F>\u003Cpath d=\"M14 14a1 1 0 1 0 2 0a1 1 0 1 0-2 0M9 9a1 1 0 1 0 2 0a1 1 0 1 0-2 0m-6 7a1 1 0 1 0 2 0a1 1 0 1 0-2 0m16-8a1 1 0 1 0 2 0a1 1 0 1 0-2 0\"\u002F>\u003C\u002Fg>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":31},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M4 5a1 1 0 0 1 1-1h4a1 1 0 0 1 1 1v4a1 1 0 0 1-1 1H5a1 1 0 0 1-1-1zm0 10a1 1 0 0 1 1-1h4a1 1 0 0 1 1 1v4a1 1 0 0 1-1 1H5a1 1 0 0 1-1-1zm10 0a1 1 0 0 1 1-1h4a1 1 0 0 1 1 1v4a1 1 0 0 1-1 1h-4a1 1 0 0 1-1-1zm0-8h6m-3-3v6\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":33},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"m12 3l8 4.5v9L12 21l-8-4.5v-9zm0 9l8-4.5M12 12v9m0-9L4 7.5m12-2.25l-8 4.5\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":35},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M3 12a9 9 0 1 0 18 0a9 9 0 1 0-18 0m9-9v18m0-7l7-7m-7 12l8.5-8.5M12 9l4.5-4.5\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":37},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M8 12a4 4 0 1 0 8 0a4 4 0 1 0-8 0m-5 0h1m8-9v1m8 8h1m-9 8v1M5.6 5.6l.7.7m12.1-.7l-.7.7m0 11.4l.7.7m-12.1-.7l-.7.7\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":39},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M12 3h.393a7.5 7.5 0 0 0 7.92 12.446A9 9 0 1 1 12 2.992z\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":41},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M4 6h16M4 12h16M4 18h16\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":43},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M8 7a4 4 0 1 0 8 0a4 4 0 0 0-8 0M6 21v-2a4 4 0 0 1 4-4h4a4 4 0 0 1 4 4v2\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":45},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M6 4h11a2 2 0 0 1 2 2v12a2 2 0 0 1-2 2H6a1 1 0 0 1-1-1V5a1 1 0 0 1 1-1m3 0v18m4-14h2m-2 4h2\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":47},"\u003Cpath fill=\"currentColor\" d=\"M16.777 0a2.9 2.9 0 1 1-2.529 4.322H12.91a4.266 4.266 0 0 0-4.265 4.195v2.118a7.08 7.08 0 0 1 4.147-1.42l.118-.002h1.338a2.9 2.9 0 0 1 5.43 1.422a2.9 2.9 0 0 1-5.43 1.422H12.91a4.266 4.266 0 0 0-4.265 4.195v2.319A2.9 2.9 0 0 1 7.222 24A2.9 2.9 0 0 1 5.8 18.57V8.589a7.11 7.11 0 0 1 6.991-7.108l.118-.001h1.338A2.9 2.9 0 0 1 16.778 0M7.223 19.905a1.194 1.194 0 1 0 0 2.389a1.194 1.194 0 0 0 0-2.389m9.554-10.464a1.194 1.194 0 1 0 0 2.389a1.194 1.194 0 0 0 0-2.39m0-7.735a1.194 1.194 0 1 0 0 2.389a1.194 1.194 0 0 0 0-2.389\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":49},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M12 3a12 12 0 0 0 8.5 3A12 12 0 0 1 12 21A12 12 0 0 1 3.5 6A12 12 0 0 0 12 3\"\u002F>\u003Cpath d=\"M11 11a1 1 0 1 0 2 0a1 1 0 1 0-2 0m1 1v2.5\"\u002F>\u003C\u002Fg>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":51},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M3 21h4L20 8a1.5 1.5 0 0 0-4-4L3 17zM14.5 5.5l4 4\"\u002F>\u003Cpath d=\"M12 8L7 3L3 7l5 5M7 8L5.5 9.5M16 12l5 5l-4 4l-5-5m4 1l-1.5 1.5\"\u002F>\u003C\u002Fg>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":53},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M4 7a2 2 0 0 1 2-2h12a2 2 0 0 1 2 2v12a2 2 0 0 1-2 2H6a2 2 0 0 1-2-2zm12-4v4M8 3v4m-4 4h16m-9 4h1m0 0v3\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":55},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M18 6L6 18M6 6l12 12\"\u002F>",{"slug":57,"title":58,"excerpt":59,"image":60,"publishedAt":61,"topics":62,"readMinutes":66,"html":67,"metaTitle":58,"metaDescription":59,"shareImage":68,"updatedAt":61,"author":72,"related":74},"downfall-of-bgp-exchange","The downfall of bgp.exchange: how a volunteer peering exchange lost its domain, mail and management plane in a day","In September 2026 a volunteer peering exchange lost its domain, mail and management plane in about a day. A timeline from public records.","\u002Fcontent\u002Fimages\u002F2026\u002F10\u002Fbgpx-fiber-switch.jpg","2026-10-23T12:00:00.000+08:00",[63],{"key":64,"label":65},"news","News",7,"\u003Cp>For a few years, bgp.exchange was one of the friendliest on-ramps into real-world peering. It was a volunteer-run virtual exchange with route servers in several countries, and its public footprint listed roughly 510 participant networks (\u003Ca href=\"https:\u002F\u002Fettayeb.fr\u002Freseau\u002Fbgp-exchange-compromise-2026\u002F?ref=ghost.jdneer.com\">ETTAYEB\u003C\u002Fa>, \u003Ca href=\"https:\u002F\u002Fknutmichael.com\u002Farticles\u002Fbgp-exchange-was-hijacked?ref=ghost.jdneer.com\">Knut Michael Haugland\u003C\u002Fa>). Hobbyists, lab networks and small operators used it to learn BGP with live sessions instead of slides.\u003C\u002Fp>\u003Cp>In September 2026 that project lost its management plane in about a day: its hypervisor, its application and database servers, its mail system, its website, its DNS and finally its domain. This is how it happened, based only on public records and on what the operators themselves have said. Where nobody knows, I say so.\u003C\u002Fp>\u003Cp>A note before we start: I won't link the old domain. The operators themselves say it must still be treated as compromised.\u003C\u002Fp>\u003Ch2 id=\"before-the-fall\">Before the fall\u003C\u002Fh2>\u003Cp>The registry record (\u003Ca href=\"https:\u002F\u002Frdap.identitydigital.services\u002Frdap\u002Fdomain\u002Fbgp.exchange?ref=ghost.jdneer.com\">RDAP\u003C\u002Fa>) shows the domain was registered on April 1, 2021, and is paid up until April 1, 2028. It never lapsed. Certificate transparency logs (\u003Ca href=\"https:\u002F\u002Fcrt.sh\u002F?q=bgp.exchange&ref=ghost.jdneer.com\">crt.sh\u003C\u002Fa>) look boring until September 12, 2026: one certificate per host, renewed on schedule.\u003C\u002Fp>\u003Cp>On September 6, Haugland received an ordinary-looking sponsorship request from the project's support address through its mailing platform, asking for servers, network gear, connectivity or money. He kept the full headers, and it serves as his clean baseline for everything that followed (\u003Ca href=\"https:\u002F\u002Fknutmichael.com\u002Farticles\u002Fbgp-exchange-was-hijacked?ref=ghost.jdneer.com\">source\u003C\u002Fa>).\u003C\u002Fp>\u003Ch2 id=\"september-12-the-mail-starts\">September 12: the mail starts\u003C\u002Fh2>\u003Cp>The operators put the start of their incident window at about 3:00 AM PHT on September 12 (their status page lists it as about 05:00 AEST).\u003C\u002Fp>\u003Cp>That afternoon, members started getting mail they never should have received. \u003Ca href=\"https:\u002F\u002Fknutmichael.com\u002Farticles\u002Fbgp-exchange-was-hijacked?ref=ghost.jdneer.com\">Haugland\u003C\u002Fa> kept the full headers, and they show the abuse moving through more than one sending path. At 4:38 PM PHT a harassing message went out through SMTP2GO, the same campaign platform the genuine sponsorship email had used. Between 5:05 and 5:09 PM PHT, three more messages went out through the project's own mail servers by authenticated submission, signed with its DKIM keys, carrying harassment, Nazi song lyrics and political text. These messages weren't spoofed.\u003C\u002Fp>\u003Cp>At 4:51 PM PHT a user opened a thread on \u003Ca href=\"https:\u002F\u002Fwww.reddit.com\u002Fr\u002Fnetworking\u002Fcomments\u002F1we7dd2\u002Fweird_mail_from_bgpexchange\u002F?ref=ghost.jdneer.com\">r\u002Fnetworking\u003C\u002Fa> asking whether anyone else got the \"weird\" mail. Replies reported real member data in the messages, including full names, and at least one member said they ended their membership because of it. \u003Ca href=\"https:\u002F\u002Fborncity.com\u002Fwin\u002F2026\u002F09\u002F12\u002Fbgp-exchange-website-compromised-sept-12-2026\u002F?ref=ghost.jdneer.com\">Born's Tech and Windows World\u003C\u002Fa> and \u003Ca href=\"https:\u002F\u002Fettayeb.fr\u002Freseau\u002Fbgp-exchange-compromise-2026\u002F?ref=ghost.jdneer.com\">ETTAYEB\u003C\u002Fa> reported the same pattern: harassment, obscenities in Cantonese and real member names.\u003C\u002Fp>\u003Ch2 id=\"the-website-and-the-services-go-dark\">The website and the services go dark\u003C\u002Fh2>\u003Cp>The homepage was replaced with an abusive defacement page: a mix of political flags and slogans, a Nazi flag and personal attacks accusing the operators of financial exploitation and of wasting resources on a virtual IXP. I'm not reproducing any of it.\u003C\u002Fp>\u003Cp>Nobody has a public record of when the page first went up. The Wayback Machine has no snapshot (I checked again on October 23), and the earliest public URLScan result Haugland found is from 10:08 PM PHT on September 12. So the page was live by then, but it may have appeared earlier.\u003C\u002Fp>\u003Cp>It wasn't only the website. A member who wrote to Born's blog that day reported that peering through the exchange was disrupted, his VPN tunnels to it had stopped working and the member portal no longer let him log in. ETTAYEB reported the same: peering disrupted, some member tunnels down, the login portal unreachable. In ETTAYEB's words, this was a full compromise of the management side: website, mail, DNS and possibly the domain.\u003C\u002Fp>\u003Ch2 id=\"september-13-the-domain-walks-away\">September 13: the domain walks away\u003C\u002Fh2>\u003Cp>Certificate transparency, the registry and Haugland's mail headers line up into one sequence. Thanks to Kat on my team for pulling the certificate and registry timeline together from \u003Ca href=\"https:\u002F\u002Fcrt.sh\u002F?q=bgp.exchange&ref=ghost.jdneer.com\">crt.sh\u003C\u002Fa> and \u003Ca href=\"https:\u002F\u002Frdap.identitydigital.services\u002Frdap\u002Fdomain\u002Fbgp.exchange?ref=ghost.jdneer.com\">RDAP\u003C\u002Fa>.\u003C\u002Fp>\u003Cul>\u003Cli>\u003Cstrong>Sep 12, 12:03 PM PHT:\u003C\u002Fstrong> a burst of Let's Encrypt certificates for four Frankfurt hosts. It is not clear whether the operators or the attacker requested them.\u003C\u002Fli>\u003Cli>\u003Cstrong>Sep 13, 11:27 AM PHT:\u003C\u002Fstrong> the first wildcard certificate for the domain (*.bgp.exchange). A Let's Encrypt wildcard requires a DNS challenge, so whoever requested it controlled the domain's DNS at that moment.\u003C\u002Fli>\u003Cli>\u003Cstrong>Sep 13, 12:05 PM PHT:\u003C\u002Fstrong> the registry logs an inter-registrar transfer, 38 minutes after that wildcard.\u003C\u002Fli>\u003Cli>\u003Cstrong>Sep 13, 3:35 PM PHT:\u003C\u002Fstrong> a Google Trust Services wildcard. That fits a move to Cloudflare, but that is our inference, not a record.\u003C\u002Fli>\u003Cli>\u003Cstrong>Sep 13, 5:28 PM PHT:\u003C\u002Fstrong> mail starts arriving from a new Microsoft 365 account on the domain, passing SPF, DKIM and DMARC as bgp.exchange (\u003Ca href=\"https:\u002F\u002Fknutmichael.com\u002Farticles\u002Fbgp-exchange-was-hijacked?ref=ghost.jdneer.com\">Haugland\u003C\u002Fa>). Passing all three requires matching DNS records, so whoever sent that mail controlled the domain's DNS by then.\u003C\u002Fli>\u003Cli>\u003Cstrong>Sep 18:\u003C\u002Fstrong> the registry record changes again. It does not say what changed.\u003C\u002Fli>\u003Cli>\u003Cstrong>Oct 1:\u003C\u002Fstrong> a Sectigo wildcard is issued.\u003C\u002Fli>\u003C\u002Ful>\u003Cp>Today the domain sits at Tucows, is locked against transfers and updates, uses Cloudflare nameservers and has redacted registrant details. The previous registrar isn't public.\u003C\u002Fp>\u003Cp>The Microsoft 365 messages kept coming. Haugland logged a message asking recipients to send cryptocurrency at 5:55 PM PHT and an \"Urgent Support Needed to Keep BGP.Exchange Online\" message at 7:02 PM PHT. These times fall after the operators' stated incident window ended.\u003C\u002Fp>\u003Cp>At 8:23 PM PHT, a user identifying as part of the team confirmed on r\u002Fnetworking that the site had been hacked and that the domain had been \"transferred away without our consent.\" A Discord statement attributed to the team, shared as a screenshot on Reddit, said the transfer happened through an API, that mail servers, Docker hosts and the web server were affected, and that route servers were not compromised. Haugland notes that the screenshot can't be independently authenticated.\u003C\u002Fp>\u003Cp>When Haugland checked again at 9:54 PM PHT on September 13, both the root domain and www still served the defacement, and the looking glass redirected to it. He also noted that no incident explanation had been emailed to members.\u003C\u002Fp>\u003Ch2 id=\"the-rebuild\">The rebuild\u003C\u002Fh2>\u003Cp>The operators' own incident statement, printed in \u003Ca href=\"https:\u002F\u002Fborncity.com\u002Fblog\u002Fen\u002F2026\u002F09\u002F12\u002Fwebseite-bgp-exchange-kompromittiert-12-sept-2026\u002F?ref=ghost.jdneer.com\">Born's German edition\u003C\u002Fa>, says the attacker was able to \"Gain unauthorised access to BGP.Exchange infrastructure, including hypervisor systems\" and \"Gain unauthorised access to the app.bgp.exchange management platform.\"\u003C\u002Fp>\u003Cp>The operators later published their own timeline on a status page at bgpexchange.com. I couldn't independently confirm that site is operated by the team, so treat it as their claim. All times converted to PHT:\u003C\u002Fp>\u003Cul>\u003Cli>\u003Cstrong>Sep 14, 1:00 PM:\u003C\u002Fstrong> affected systems narrowed to the application server, the database server, the email server and the Sydney hypervisor.\u003C\u002Fli>\u003Cli>\u003Cstrong>Sep 14, 5:30 PM:\u003C\u002Fstrong> domain recovery escalated with the registrar and registry; replacement Sydney infrastructure prepared.\u003C\u002Fli>\u003Cli>\u003Cstrong>Sep 15, 12:00 AM:\u003C\u002Fstrong> new Sydney hypervisor installed, then patched and hardened.\u003C\u002Fli>\u003Cli>\u003Cstrong>Sep 15, 12:00 PM:\u003C\u002Fstrong> new DNS, mail and Docker infrastructure deployed; application security review started; decision made to rebrand.\u003C\u002Fli>\u003Cli>\u003Cstrong>Sep 17, 3:00 PM:\u003C\u002Fstrong> core replacement infrastructure operational, with the application redesigned so admin functions are separated from member-facing services.\u003C\u002Fli>\u003Cli>\u003Cstrong>Sep 28:\u003C\u002Fstrong> rebrand to ixFabric underway, with PeeringDB, APNIC and RIPE records being updated.\u003C\u002Fli>\u003C\u002Ful>\u003Cp>In other words, the management side wasn't patched, it was replaced. The operators say they found no evidence that any route server, in any location, was accessed, and no evidence of access to hypervisors at their other points of presence. That is their claim; I have seen no public evidence either way. ETTAYEB also reported a measured operator statement on September 17 saying the same about the route servers.\u003C\u002Fp>\u003Ch2 id=\"what-happened-to-the-community-channels\">What happened to the community channels\u003C\u002Fh2>\u003Cp>Email was abused through three sending paths: the SMTP2GO campaign platform, the project's own mail servers and the new Microsoft 365 account. The website, the member portal and the looking glass were down or defaced. That much is documented.\u003C\u002Fp>\u003Cp>Discord was still working on Sep 12–13, according to a Born reader. I found no public record of when or whether the other channels went down. The operators' first statement came on Discord, and I found no public source showing that the Telegram group, the mailing list or any social accounts were taken over. A public Telegram group under the old name still lists several hundred members. Beyond Reddit, Born and ETTAYEB, I found one \u003Ca href=\"https:\u002F\u002Fsocial.treehouse.systems\u002F@astraleureka\u002F117257598788130178?ref=ghost.jdneer.com\">Mastodon post\u003C\u002Fa> from someone who got the mail, and nothing on Hacker News, NANOG, LowEndTalk, GitHub or DN42.\u003C\u002Fp>\u003Ch2 id=\"routing-data\">Routing data\u003C\u002Fh2>\u003Cp>Kat on my team went through the public routing and registry data. Here is what it shows, with times in PHT.\u003C\u002Fp>\u003Cul>\u003Cli>\u003Cstrong>The ASN:\u003C\u002Fstrong> the exchange runs AS24381, registered at APNIC as BGPE-AS with the description \"BGP.Exchange.\" Its APNIC record was last modified on Sep 27, as part of the move to ixFabric (\u003Ca href=\"https:\u002F\u002Fstat.ripe.net\u002Fdata\u002Fwhois\u002Fdata.json?resource=AS24381&ref=ghost.jdneer.com\">RIPEstat whois\u003C\u002Fa>).\u003C\u002Fli>\u003Cli>\u003Cstrong>PeeringDB:\u003C\u002Fstrong> about 50 city exchange records were renamed to ixFabric in one batch early on Sep 28. The organization record now carries the notice \"OUR DOMAIN HAS BEEN STOLEN, SEE BGPEXCHANGE.COM\" (\u003Ca href=\"https:\u002F\u002Fwww.peeringdb.com\u002Fapi\u002Fnet\u002F1434?ref=ghost.jdneer.com\">PeeringDB\u003C\u002Fa>).\u003C\u002Fli>\u003Cli>\u003Cstrong>Sep 12 to 13:\u003C\u002Fstrong> public route collectors show none of the project's own routes withdrawn. Haugland's RIPE RIS snapshots show the same 13 prefixes visible to about 735 peers from Sep 11 to Sep 13. That is outside reachability only. Member tunnels and route-server sessions aren't visible to public collectors, so this data neither confirms nor refutes the operators' claim.\u003C\u002Fli>\u003Cli>\u003Cstrong>Oct 3 to 17:\u003C\u002Fstrong> smaller drops in visibility.\u003C\u002Fli>\u003C\u002Ful>\u003Ch2 id=\"september-21-an-unexplained-routing-event\">September 21: an unexplained routing event\u003C\u002Fh2>\u003Cp>Between 5:39 and 5:43 AM PHT on September 21, AS24381 sent about 1,700 announcements and 450 withdrawals, and several of its IPv6 blocks vanished from RIPE collectors until about 7:56 AM PHT on September 22 (\u003Ca href=\"https:\u002F\u002Fstat.ripe.net\u002FAS24381?ref=ghost.jdneer.com\">RIPEstat\u003C\u002Fa>, \u003Ca href=\"https:\u002F\u002Fbgp.tools\u002Fas\u002F24381?ref=ghost.jdneer.com\">bgp.tools\u003C\u002Fa>). The operators haven't explained it publicly, and I won't guess.\u003C\u002Fp>\u003Ch2 id=\"where-things-stand\">Where things stand\u003C\u002Fh2>\u003Cp>RIPEstat shows 11 prefixes from AS24381 today. The operators promised the new ixFabric site within 48 to 72 hours on September 28. Three weeks later, ixfabric.net still shows only \"Coming Soon.\"\u003C\u002Fp>\u003Ch2 id=\"what-we-still-dont-know\">What we still don't know\u003C\u002Fh2>\u003Cul>\u003Cli>How the attacker first got in.\u003C\u002Fli>\u003Cli>Which API was used for the domain transfer, and at which registrar.\u003C\u002Fli>\u003Cli>When the defacement first appeared.\u003C\u002Fli>\u003Cli>What changed in the registry record on September 18.\u003C\u002Fli>\u003Cli>What caused the September 21 routing event.\u003C\u002Fli>\u003C\u002Ful>\u003Ch2 id=\"what-i-take-away-from-it\">What I take away from it\u003C\u002Fh2>\u003Cp>Whatever happened to the route servers, an exchange is more than its route servers. The portal, the mail, DNS and the domain are how members find you, trust you and get told what's going on. Lose those and the exchange goes down anyway, and anyone holding the old domain can keep speaking in your name.\u003C\u002Fp>\u003Cp>If you were a member: treat anything from the old domain as untrusted, rotate any credentials you shared with the portal, review your sessions and tunnels, and only trust updates through channels the team has verified.\u003C\u002Fp>\u003Cp>And for the rest of us running small networks: lock your domains, turn on registrar lock and 2FA, watch certificate transparency for your own names, and keep your management plane as far from your data plane as you can.\u003C\u002Fp>",{"src":60,"height":69,"width":70,"type":71},1339,2000,"image\u002Fjpeg",{"name":73,"url":10,"owner":5},"JD Bungart",[75,84,95,104],{"slug":76,"title":77,"excerpt":78,"image":79,"publishedAt":80,"topics":81,"readMinutes":83},"rakazo-v0-3-3-self-hosted-grok-bot-alternative","Rakazo v0.3.3: What's New in the Self-Hosted Grok Bot Alternative","Rakazo, the open source, self-hostable AI agent platform, shipped v0.3.3 on October 22. A small release: delete chats on mobile, Telegram replies with images and files, and a handful of fixes.","\u002Fcontent\u002Fimages\u002F2026\u002F10\u002Frakazo-readme-hero-1280x720.png","2026-10-24T18:00:00.000+08:00",[82],{"key":64,"label":65},1,{"slug":85,"title":86,"excerpt":87,"image":88,"publishedAt":89,"topics":90,"readMinutes":83},"dito-cme-board-changes-2026","DITO CME elects four new directors at annual stockholders' meeting","DITO CME Holdings elected Oozi Cats, Xinxin Wang, Enrique Pampolina and Cenon Audencial Jr. to its board, as Eric Recto and Salvador Medialdea ended their terms.","\u002Fcontent\u002Fimages\u002F2026\u002F10\u002Fdito-board-boardroom-pavel-gromov-unsplash.jpg","2026-10-24T08:00:00.000+08:00",[91,94],{"key":92,"label":93},"philippines","Philippines",{"key":64,"label":65},{"slug":96,"title":97,"excerpt":98,"image":99,"publishedAt":100,"topics":101,"readMinutes":83},"a-third-of-philippine-businesses-now-use-ai-but-only-17-have-a-plan-to-scale-it","A Third of Philippine Businesses Now Use AI, but Only 17% Have a Plan to Scale It","An AWS-commissioned study says 32% of Philippine businesses now use AI, up from 21% a year ago. But only 17% have a roadmap to scale it, and just 19% feel ready for agentic AI. Skills remain the biggest gap. Here are the numbers that matter.","\u002Fcontent\u002Fimages\u002F2026\u002F10\u002Fteam-laptops-cherrydeck-unsplash.jpg","2026-10-22T18:00:00.000+08:00",[102,103],{"key":92,"label":93},{"key":64,"label":65},{"slug":105,"title":106,"excerpt":107,"image":108,"publishedAt":109,"topics":110,"readMinutes":83},"chainguard-broke-the-php-embargo-by-six-hours-that-was-the-wrong-call","Chainguard Broke the PHP Embargo by Six Hours. That Was the Wrong Call","Chainguard shipped fixed PHP images more than six hours before the coordinated October 21 release, citing exploits in the wild. Here is how embargoes work, what Chainguard says, and why I still think releasing early was the wrong call for open source.","\u002Fcontent\u002Fimages\u002F2026\u002F10\u002Fhamburg-containers-julia-taubitz-unsplash.jpg","2026-10-22T16:00:00.000+08:00",[111],{"key":64,"label":65},{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":113},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M5 12h14M5 12l6 6m-6-6l6-6\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":115},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M6.5 7.5a1 1 0 1 0 2 0a1 1 0 1 0-2 0\"\u002F>\u003Cpath d=\"M3 6v5.172a2 2 0 0 0 .586 1.414l7.71 7.71a2.41 2.41 0 0 0 3.408 0l5.592-5.592a2.41 2.41 0 0 0 0-3.408l-7.71-7.71A2 2 0 0 0 11.172 3H6a3 3 0 0 0-3 3\"\u002F>\u003C\u002Fg>"]