Colocated with the Great Firewall is an entirely different claim, and not one that ATT makes. Your citizenlab article provides a possible case for it, but that's a different discussion.

And even then, it could be some third party cache poisoning attack, etc. The citizenlab evidence would look exactly the same.

This is likely China, as I said, but let's not pretend that we know more than we do.