CNCERT Reports Traffic Hijacking Redirecting Chinese Users to Gambling Sites

China’s National Computer Network Emergency Response Technical Team, CNCERT, has reported traffic hijacking that redirected users in several provinces to gambling websites.

Its October 20 report identified false route announcements and altered DNS responses as the attack methods. The affected operators were not named. 

Routing and DNS Manipulation

According to CNCERT, attackers diverted traffic through infrastructure they controlled, then changed address-resolution responses.

Some responses pointed directly to gambling websites. Others directed requests through a malicious DNS server that returned gambling-site addresses.

Infrastructure Registration Identified

CNCERT located the manipulation within autonomous system AS402425, registered through ARIN by US company QOREXA LABS on April 9, 2026.

That registration identifies an infrastructure connection; it does not independently establish who conducted the attack.

The centre urged relevant registries to investigate and revoke malicious network resources, while network operators should validate route announcements and filter harmful routes.