This is not true, the traffic for the previous github incident with the great cannon was co located[0] with the great firewall (which is indisputably under the control of the chinese government).
And even then, it could be some third party cache poisoning attack, etc. The citizenlab evidence would look exactly the same.
This is likely China, as I said, but let's not pretend that we know more than we do.