BGP Hijack
Rerouting internet traffic by falsely announcing IP routes, a network-layer attack that sits below DNS.
- glossary
BGP hijack (Border Gateway Protocol hijacking) is a network-layer attack in which a malicious or misconfigured autonomous system broadcasts false routing announcements, convincing other routers on the internet to send traffic destined for a legitimate IP address through the attacker's infrastructure instead. Unlike DNS hijacking — which corrupts name-to-IP mappings — a BGP hijack operates at the routing layer, so the domain's DNS records remain untouched and DNSSEC provides no protection against it. Once traffic is rerouted, attackers can intercept TLS certificate issuance (BGP hijacks have been used to obtain fraudulent certificates from CAs that use HTTP-based domain validation), read unencrypted traffic, or perform man-in-the-middle attacks. Mitigations include route-origin validation via RPKI (Resource Public Key Infrastructure) and monitoring services that alert when unexpected ASes announce your prefixes.
Related keywords
- BGP hijack
- route hijacking
- IP prefix
- network security
- internet routing
Contributors
Namefi is a collective of engineers, designers, and operators who obsess over building tools that make managing your onchain domain names effortless.
Victor Zhou is a technology founder and standards editor focused on digital identity and trust. He founded Namefi, edits Ethereum Improvement Proposals, and previously led smart-contract architecture work at Google Labs.
His work sits at the intersection of naming, ownership, and the systems people use to establish identity online. That perspective makes him especially interested in the way names move between personal meaning, public recognition, and digital infrastructure.
For Namefi, Victor edits and writes about domains as durable digital identity: how names become ownable onchain assets, how tokenization changes custody and trust, and what naming can learn from the systems people use to establish identity online.