CNCERT warns that tampered home-router DNS settings are redirecting users to porn, gambling or phishing pages

China’s National Computer Network Emergency Response Technical Team (CNCERT) warned on 1 June that some home users, after joining their router’s Wi-Fi, were being redirected to illegal pages such as pornography or gambling when they visited ordinary sites or ran a connectivity check, and that the cause was tampered DNS settings on home routers and similar devices ^[1]. It said affected routers had weak admin passwords, and attackers apparently reached the admin page after compromising a device on the home network; it had monitored dozens of malicious resolvers and redirect servers, with more than 100 million malicious lookups a day and more than 700,000 mainland IP addresses affected on the worst day, creating risks of aggressive ads, phishing and account-data theft ^[1]. CNCERT advised households to log into the router admin page, check whether the DNS address has been changed to an unknown IP, restore the ISP or a trusted public DNS if it has, and reboot the router and devices; it also said to replace default or weak admin passwords, turn off unnecessary remote management and UPnP, and disconnect immediately if ordinary sites start redirecting, resetting the router if needed ^[1].

Industries mainly affected: Cross-industry