Forged internet 'road signs' send users to gambling sites

Internet users in several Chinese provinces were redirected to gambling sites after attackers outside the country hijacked internet routing and address data. The attackers did not infect devices. Instead, they forged the internet's equivalent of road signs and phone-book answers.

The attackers announced fake routes through a foreign autonomous system (AS) 402425, pulling some traffic toward their infrastructure. They then tampered with Domain Name System (DNS) responses, either replacing a legitimate website's address with a gambling-site address or sending users to a malicious DNS server. The hijack exploited a Border Gateway Protocol (BGP) rule called longest-prefix match: a more specific prefix can override a broader legitimate route.

China's National Computer Network Emergency Response Technical Team/Coordination Center (CNCERT) traced the tampering to AS 402425, registered by US company Qorexa Labs in April 2026. CNCERT's report lists malicious IP ranges including 112.121.185.x, 117.55.193.x and 43.230.161.x.

The measurement locates the tampering within that network. However, it does not by itself establish the company's intent.

The case is not China-specific. BGP route incidents occur hundreds of times a month, and most go unnoticed by corporate security teams. In 2024, a BGP hijack involving Cloudflare's 1.1.1.1 service affected more than 300 networks in 70 countries after misconfigurations by two Brazilian operators – without triggering enterprise security alerts.

Tools to reduce the risk already exist. Resource Public Key Infrastructure lets networks verify cryptographically whether an autonomous system is authorized to announce a prefix. Mutually Agreed Norms for Routing Security sets baseline practices. CNCERT recommends that internet registries and IP-address trading platforms review and revoke malicious AS resources and that operators filter routes containing AS 402425.

For ordinary users, the advice is simple: use a trusted public DNS service. If a page suddenly jumps to a gambling site, close it immediately, do not click any button or link, do not download anything, and clear the browser cache. Keep systems and browsers updated.

Routing security is a global supply-chain problem, not just an engineering issue. The Chinese case is a warning that the internet's trust model can be exploited against any country's users – and the fix depends on whether networks and registries adopt safeguards that already exist.