国家互联网应急中心公布调查报告，揭露了中国多个省份近期发生的用户访问异常跳转至博彩网站事件2。调查发现，攻击者利用由美国公司QOREXA LABS于2026年4月9日在ARIN注册的自治域AS 402425实施攻击2。该公司官网显示其经营比特币相关业务2。
攻击者采用了两种主要手法进行网络劫持2。一是通过宣告虚假路由劫持用户流量，二是篡改DNS解析数据，具体包括将解析值直接修改为博彩网站地址，或指向恶意DNS服务器1。这些协同的攻击手段导致用户访问被异常重定向。
针对此事件，相关机构提出了多项防范建议1。用户应使用经过验证的可信公共DNS服务，避免使用来源不明的DNS1。同时建议互联网注册机构注销恶意AS资源，网络运营商配置路由过滤策略以防止类似攻击1。
Internet users across multiple provinces in China experienced anomalous redirects to gambling websites, according to an investigation report published by the National Internet Emergency Center 2. The attack exploited an autonomous system (AS 402425) controlled by U.S. company QOREXA LABS, which was registered with ARIN on April 9, 2026 12. QOREXA LABS operates businesses related to Bitcoin, as shown on its official website 2.
The attackers employed two primary methods to compromise user traffic 12. The first involved announcing false routing declarations to hijack internet traffic, while the second entailed tampering with DNS resolution data 12. According to the investigation, DNS tampering took two forms: directly modifying resolution values to point to gambling website addresses, or redirecting users to malicious DNS servers 1.
To mitigate such attacks, authorities recommended that users rely on verified and trustworthy public DNS services while avoiding DNS providers from unknown sources 1. The report also suggested that internet registration authorities revoke malicious AS resources and that network operators implement route filtering policies to prevent similar incidents 1.
评论
还没有评论，欢迎留下第一条。