On October 20th, reports emerged indicating that the China Academy of Information and Communications Technology (CAICT) had recently detected BGP route hijacking attempts initiated by overseas attacking organizations. These attacks, which were launched through overseas networks (AS402425) at locations such as the Equinix Singapore Internet Exchange Center, are designed to maliciously divert a portion of China's cross-border internet traffic and tamper with the normal resolution of domain names. Consequently, users in multiple regions have experienced abnormal redirections to gambling websites when attempting to access specific domain names. This type of attack is a classic example of route hijacking, also known as domain name poisoning.
Given that the attack originates from overseas and the attacking organizations are constantly adapting their strategies in an effort to sustain their assault, the associated risks persist. It is therefore recommended that relevant enterprises minimize unnecessary cross-border domain name resolution activities, enhance their monitoring capabilities, promptly address any anomalies that arise, and report any suspicious incidents to the appropriate authorities.
