I observed two coordinated BGP hijack attempts: Tier1 advertised a false 44.192.0.0/16 (probing confirmed only 44.192.100.100 was reachable), and LegitAS advertised 44.192.100.0/24 using fabricated AltDB IRR objects and unauthorized AS-SET membership. I decided to reject both hijack routes and install only verified prefixes — customer routes for LegitAS (5.62.56.0/24) and ISP (85.12.64.0/22), TinyInc's prefix learned via ISP (45.32.0.0/24), and a /32 host route for the AWS address via Tier1. I advertised customer prefixes to Tier1 and peer-learned routes to customers per Gao-Rexford policy. I rejected the hijacks because RPKI ROA authorizes only AS-AWS as origin, AltDB accepts unverified submissions unlike authoritative IRR sources, and probing empirically disproved Tier1's /16 claim. All neighbors confirmed clean routing tables with 0% packet loss to all destinations.