China publishes report on web redirects to gambling sites traced to overseas AS 402425

China's National Internet Emergency Center published an investigation report on 20 October on the malicious tampering of some DNS resolution data from the overseas autonomous system AS 402425, IT Home reported. The report says that in recent times users in several Chinese provinces were repeatedly redirected to gambling websites when they tried to access sites. It says this seriously harmed people's property security and normal internet use. [ 1 , 2 , 3 , 4 , 5 ]

According to the report, the attackers used AS 402425 and mainly relied on announcing false routes and tampering with domain name resolution data. In the first step, the attackers registered false source address prefixes and a false set of autonomous systems in an internet routing registry. They then used the autonomous systems they controlled to publish the false prefixes and false short paths, hijacking part of the traffic inside China. [ 2 , 5 , 6 ]

In the second step, once the traffic was hijacked, the attackers tampered with the DNS resolution data in it, in two ways. One was to change the DNS resolution value directly to a gambling website address. The other was to point it to a malicious DNS server, which returns a gambling website address when users ask it to resolve a domain name. [ 2 , 5 , 6 ]

The report says technical measurement confirmed that the domain name tampering took place inside AS 402425. It says the system was registered with the American Registry for Internet Numbers (ARIN) on 9 April 2026 by the US company QOREXA LABS, whose website shows that it runs Bitcoin-related business. [ 2 , 5 , 6 ]

The report advises countries and organisations worldwide to check and deal with the problem. Regional internet registries, IP address trading platforms and similar bodies should check and cancel AS 402425 and other malicious AS resources. Network operators should set route filtering on border routers, verify route announcements, and reject and delete malicious routes containing AS 402425. Internet platforms should monitor changes in the IP addresses their core domains resolve to, abnormal DNS responses and abnormal route path changes, and report confirmed hijacking to upstream operators so the hijacking link is cut. [ 5 , 6 ]

For internet users, the report advises using verified, trusted public DNS services and avoiding DNS services of unknown origin. If a page redirects to a malicious site, users should not click any button or link or download any program, should close the page at once and clear the browser cache. It also advises keeping the operating system and browser up to date and turning on security software. [ 5 , 6 ]

CLS and 36Kr credited their text to CCTV News. The text says the findings were published as a reference for relevant countries, organisations and internet users worldwide to detect and guard against such attacks. [ 1 , 4 ]