CCTV News: According to the Ministry of Industry and Information Technology’s Cyber ​​Security Threat and Vulnerability Information Sharing Platform, China Academy of Information and Communications Technology recently monitored and discovered that overseas attack organizations used overseas networks (AS402425) to issue BGP route hijacks at Equinix Singapore Internet Exchange Center and other centers, maliciously diverting some of my country’s cross-border traffic, and then tampering with normal domain name resolution results, causing users in many places to abnormally jump to gambling websites when accessing individual domain names.This behavior is a typical domain name poisoning attack through route hijacking.

According to the "Public Internet Network Security Emergency Response Plan" and "Public Internet Network Security Threat Monitoring and Response Measures", we immediately worked with network operators to carry out traceability analysis and emergency response, and adopted measures such as blocking hijacking routes, broadcasting detailed routes, and refreshing domain name caches to restore normal domain name resolution within the country. We also actively communicated and negotiated with international operators Cogent, HE, and Equinix Singapore Exchange Center, which provide Internet access for this overseas network, to request that the global spread of hijacked routes be blocked. The impact of the current attack has been basically eliminated.

Given that the source of the attack is located overseas, the attacking organization still attempts to continue routing hijacking and domain name tampering by changing access networks and changing hijacking techniques from time to time, so there are still potential risks.It is recommended that relevant enterprises should minimize unnecessary cross-border resolution of domain names, strengthen monitoring of route hijacking and abnormal domain name behavior, and handle and report relevant phenomena in a timely manner.Internet users are requested to close the web page immediately when encountering a malicious website that redirects to a page, and clear the browser cache in a timely manner to avoid unnecessary losses.