国家互联网应急中心发布调查报告，揭露了中国多个省份近期发生的用户访问请求异常跳转事件1。根据报告，攻击者利用位于中国境外的自治域AS 402425进行恶意活动，通过宣告虚假路由、篡改DNS解析数据等手段进行攻击，对用户财产安全和正常上网权利造成严重危害1。
攻击者主要采用两种手法篡改DNS解析数据1。一是直接将解析结果修改为博彩网站地址，二是指向恶意DNS服务器1。该自治域由美国公司QOREXA LABS在美洲互联网号码注册管理机构ARIN注册1。根据调查，QOREXA LABS官网显示其经营比特币相关业务1。调查人员还识别了18个恶意IP地址用于重定向1。
The National Internet Emergency Center has published an investigation report documenting a coordinated cyberattack affecting users across multiple provinces in China, in which access requests were being maliciously redirected to gambling websites 1. The attackers exploited an overseas autonomous system number, AS 402425, deploying false route announcements and DNS resolution tampering to carry out the assault, which posed significant threats to users' financial security and internet access rights 1.
The investigation identified two primary attack methods targeting DNS resolution: direct modification of records to point to gambling website addresses, or redirection to malicious DNS servers 1. The autonomous system was registered by American company QOREXA LABS through ARIN, the Americas Registry for Internet Numbers 1. According to the company's official website, QOREXA LABS operates Bitcoin-related business operations 1. The attackers deployed eighteen malicious IP addresses to facilitate the redirections 1.
评论
还没有评论，欢迎留下第一条。