File photo: VCG

As recent user access requests in multiple provinces across China have repeatedly been abnormally redirected to gambling websites, which seriously endangered the property safety and normal internet access rights of the public, China released an investigation findings on Tuesday, showing that the attackers used overseas autonomous system, employing tactics such as announcing false routes and tampering with domain name resolution data, causing widespread damage. 

The release of the findings aims to help relevant countries, organizations, and netizens worldwide effectively detect and prevent such attacks, the National Computer Network Emergency Response Technical Team (CNCERT) said on its Wechat account.

According to the article, the attackers hijacked traffic by announcing false routes and tampered with the DNS resolution data within the hijacked traffic.

Technical measurements confirmed that the domain name tampering occurred within the overseas autonomous system AS402425. The autonomous system was registered on April 9, 2026, with the American Registry for Internet Numbers by US company QOREXA LABS, whose official website indicates that it is engaged in Bitcoin-related business, the article said.

The CNCERT recommended that relevant countries and organizations strengthen risk awareness and promptly carry out screening and remediation. Internet number resource-related entities such as Regional Internet Registries and IP address trading platforms should verify and deregister malicious AS resources such as AS402425.

Network operators should configure route filtering policies on border routing devices, validate route announcements, and refuse to accept and delete malicious routes containing AS402425.

Internet platforms should step up monitoring of IP changes in domain name resolution for core business, anomalies in DNS response packets, and abnormal changes in routing paths, in order to detect hijacking in a timely manner. Once a hijacking incident is confirmed, they should promptly report it to upstream operators and request that abnormal route announcements be handled to cut off the hijacking link.

Netizens are also advised to strengthen risk awareness and take precautionary measures to avoid unnecessary financial losses, including the use of verified, trusted public DNS services.

If a webpage redirects to a malicious site, netizens should avoid clicking any buttons or links displayed on the webpage, refrain from downloading any programs it offers, close the page immediately, and promptly clear their browser cache, the team said.


Global Times