Attackers Hijack Routing to Redirect Chinese Users
Malicious actors are using fake internet routes to divert web traffic toward gambling websites.
Updated on Oct. 20, 2026 in Cybersecurity
Live Poll
Do you trust that your internet browser is safely directing you to the correct websites?
Hackers have hijacked internet routing data to redirect users in China to gambling websites. The attack leverages manipulated Domain Name System responses to divert legitimate traffic.
Why it matters
The hijacking demonstrates ongoing vulnerabilities in global internet infrastructure that allow malicious actors to intercept and redirect traffic at scale. These attacks highlight the difficulty of securing decentralized routing protocols used to connect the world.
The attackers utilized autonomous system 402425 to announce fake internet routes and exploit the Border Gateway Protocol longest-prefix match rule. Identified malicious IP ranges include 112.121.185.x, 117.55.193.x, and 43.230.161.x.
The players
CNCERT
The National Computer Network Emergency Response Technical Team/Coordination Center of China is responsible for cybersecurity incident response and monitoring.
Qorexa Labs
This United States-based company is identified as the registered owner of the autonomous system used during the hijacking event.
The details
Attackers announce fake routes to pull traffic toward their infrastructure before replacing legitimate website addresses with gambling site addresses in DNS responses. CNCERT identified Qorexa Labs as the registered owner of the autonomous system used in the operation.
Timeline
April 2026: Qorexa Labs registered autonomous system 402425.
2024: A BGP hijack involving Cloudflare affected 300 networks across 70 countries.
October 2026: The internet hijacking was reported.
The Tech Race
This incident follows the established pattern of BGP route manipulation first highlighted by the 2024 Cloudflare hijack. It underscores how legacy internet routing protocols remain susceptible to exploitation by actors seeking to intercept or divert traffic.
Users in the affected regions may be redirected to unauthorized websites without warning when attempting to access legitimate services. Maintaining updated security software and monitoring for unusual website behavior can help mitigate risks associated with DNS tampering.
The takeaway
Internet routing security remains a critical concern for global network integrity and individual privacy. Users should exercise caution and verify website URLs when accessing sensitive services to avoid redirection attacks.
Further reading
Learn more about the latest Cybersecurity developments and threat analysis.
Source note: This article includes information reported by Cgtn.
Live Poll
Do you trust that your internet browser is safely directing you to the correct websites?
