Blog

DNS Hijacking: Real-World Attacks and How to Detect Them

June 9, 2026

DNS is the phonebook of the internet. When you type example.com into your browser, DNS resolves that name to an IP address. But what happens when an attacker intercepts that lookup and returns a malicious IP instead? That's DNS hijacking — and it's been behind some of the most damaging cyber campaigns of the past decade.

What is DNS Hijacking?

DNS hijacking refers to any attack that redirects DNS queries to attacker-controlled destinations. There are several variants:

  • DNS cache poisoning (DNS spoofing): An attacker injects forged DNS responses into a resolver's cache. Subsequent queries for the same domain return the poisoned record until the TTL expires or the cache is flushed.
  • Rogue DNS server: The attacker replaces the victim's configured DNS resolvers with their own, giving them full control over all DNS resolution.
  • Registrar compromise: The attacker gains access to the domain registrar account and modifies the authoritative DNS records directly — changing nameservers, A records, or MX records at the source.
  • BGP hijacking: The attacker announces a more specific IP prefix for the DNS resolver, intercepting DNS traffic at the routing layer before it reaches the legitimate server.

Real-World Attacks

1. DNSChanger Malware (2011–2012)

DNSChanger was a family of trojans that infected over 4 million computers across 100 countries. Once on a machine, it changed the system's DNS settings to point to rogue DNS servers operated by an Estonian crime ring. Every DNS query from the infected machine was routed through attacker-controlled infrastructure, enabling:

  • Redirecting users to fake websites for ad fraud
  • Replacing legitimate search results with paid links
  • Preventing access to security updates, keeping the machine infected

In November 2011, the FBI executed Operation Ghost Click, arresting six individuals and seizing the rogue DNS servers. To prevent millions of infected machines from losing internet access, the FBI temporarily operated the DNS servers in a clean state for eight months before shutting them down in July 2012. The operation remains one of the largest cybersecurity takedowns in history.

2. Sea Turtle Campaign (2019)

Cisco Talos disclosed the Sea Turtle campaign in April 2019, revealing a state-sponsored operation that compromised DNS registrars and DNS hosting providers to hijack DNS for over 40 organizations across 13 countries. The targets included intelligence agencies, military organizations, energy companies, and foreign ministries — primarily in the Middle East and North Africa.

The attack chain was elegant: the actors first compromised the DNS registrar, then modified the target domain's DNS records to point to their own server. This server acted as a proxy — forwarding legitimate traffic to the real server while intercepting credentials and session tokens. Users saw no visible difference. The attackers also used TLS certificates from Let's Encrypt to make their proxy appear legitimate.

Sea Turtle was notable because it targeted the DNS infrastructure itself rather than individual endpoints. Compromising a registrar gives the attacker the ability to hijack any domain that registrar manages — a systemic risk that no individual domain owner can fully mitigate.

3. Brazilian DNS Hijacking (2019)

In 2019, attackers targeted the DNS records of major Brazilian banks — including Banco Inter and Banrisul — by compromising their domain registrars. The attackers changed DNS records to redirect users to convincing phishing sites that mirrored the real banking portals. The phishing sites were hosted on infrastructure that used legitimate-looking TLS certificates, making the attack nearly indistinguishable from the real service.

The attack was discovered when users and security researchers noticed that the banks' domains were resolving to unfamiliar IP addresses. By the time the hijack was reversed, an unknown number of users had submitted their credentials to the phishing sites. The incident highlighted how registrar-level compromises can bypass even the most robust security measures implemented by the domain owner.

4. Iranian DNS Hijacking (2019–2020)

Between 2019 and 2020, multiple DNS hijacking campaigns were attributed to Iranian APT groups, including APT33 (Elfin) and APT35 (Charming Kitten). These campaigns targeted government agencies, telecommunications companies, and internet infrastructure providers across the Middle East and North Africa.

The attackers used a combination of registrar compromise and DNS record manipulation to redirect email and web traffic through their infrastructure. In some cases, they modified MX records to intercept email, while in others they changed A records to redirect web traffic. The campaigns were particularly concerning because they targeted the DNS infrastructure of telecom providers, potentially giving the attackers visibility into the DNS queries of millions of users.

In several cases, the campaigns were discovered only after unexpected TLS certificates were observed for the hijacked domains — highlighting why monitoring your DNS records continuously is essential for catching these attacks early.

5. MyEtherWallet DNS Hijacking (2018)

In April 2018, attackers executed a BGP hijack against Amazon's Route 53 DNS service, specifically targeting the DNS resolution for MyEtherWallet (MEW), a popular Ethereum wallet service. The attackers announced a more specific BGP prefix for one of Amazon's DNS resolvers, causing some DNS queries for myetherwallet.com to be resolved by the attacker's server instead.

Users who were redirected saw a phishing site with a valid TLS certificate (issued by the attacker through a different CA). The phishing site captured Ethereum private keys and wallet passwords. Approximately $150,000 worth of Ethereum was stolen in the roughly two hours the attack was active.

This attack was significant because it demonstrated that BGP hijacking — a network-layer attack — could be used to compromise DNS at scale. No compromise of the domain owner's account or registrar was needed; the attack targeted the routing infrastructure that DNS depends on.

6. SpiceJet DNS Hijack (2020)

In February 2020, SpiceJet — India's second-largest airline — had its domain spicejet.com hijacked. Attackers gained access to the domain registrar account and changed the DNS records to point to an attacker-controlled server. Visitors to the airline's website were shown a defacement page instead of the booking portal.

While the attack appeared to be a defacement rather than a sophisticated phishing operation, the implications were severe: during the hijack period, no customer could book flights, check in, or access their account. For an airline that processes thousands of transactions daily, even a few hours of DNS hijacking translates to significant revenue loss and reputational damage. The domain was restored after several hours, but the incident underscored how a single compromised registrar credential can take down an entire online presence.

How DNS Hijacking Works Technically

DNS hijacking attacks exploit different layers of the DNS resolution chain. Understanding these layers is key to building effective defenses.

Registrar Compromise

The attacker gains access to the domain owner's registrar account — typically through credential theft, social engineering, or exploiting the registrar's own vulnerabilities. Once inside, they can modify any DNS record: change nameservers to point to their own, modify A/AAAA records to redirect web traffic, or change MX records to intercept email. This is the most impactful form of DNS hijacking because it affects the authoritative source of truth for the domain.

DNS Cache Poisoning

When a DNS resolver queries an authoritative nameserver, the attacker races to send a forged response before the legitimate one arrives. If the forged response arrives first and matches the query's transaction ID, the resolver caches the malicious record. This poisoned cache entry persists until its TTL expires. Modern DNS implementations use source port randomization and DNSSEC to make cache poisoning significantly harder, but not all resolvers are properly configured.

BGP Hijacking

BGP — the protocol that routes traffic across the internet — has no built-in authentication. An attacker can announce a more specific IP prefix than the legitimate owner, causing routers to prefer the attacker's path. When applied to the IP addresses of DNS resolvers or authoritative nameservers, this allows the attacker to intercept DNS queries at the network layer. The MyEtherWallet attack used exactly this technique.

Man-in-the-Middle (MITM)

On local networks, an attacker can use ARP spoofing or rogue Wi-Fi access points to intercept DNS queries between the client and the resolver. This is the simplest form of DNS hijacking but is limited to the attacker's local network. Public Wi-Fi networks are particularly vulnerable to this type of attack.

Detection Methods

DNS hijacking is particularly dangerous because it can go undetected for hours or days. The attacks that lasted the longest were the ones where no one was watching. Here are the primary detection strategies:

Continuous DNS Record Monitoring

Periodically query your domain's DNS records from multiple vantage points and compare the results against a known-good baseline. Any unexpected change — a new A record, a modified CNAME, changed nameservers — is an immediate alert. This catches registrar-level compromises and cache poisoning that affects resolvers you monitor.

Change Alerting

Set up alerts for any DNS record change, nameserver change, or registrar modification. Speed matters — the faster you detect a hijack, the faster you can remediate it. Alerts should go to multiple channels (email, Slack, Discord, webhooks) to ensure they're seen promptly.

How Certack Helps Detect DNS Hijacking

Certack monitors the three signals that matter most for DNS hijacking detection:

DNS Record Monitoring

Certack continuously monitors your domain's A, AAAA, CNAME, MX, TXT, and NS records. When any record changes — whether it's a new IP address in an A record or a completely different set of nameservers — Certack sends an alert immediately. You define the expected baseline; Certack watches for deviations.

Change Detection

Certack tracks the history of every DNS record change. If your domain's A record has pointed to the same IP for months and suddenly resolves to a different IP in a different AS, that's flagged as high-priority. The change history also helps with post-incident forensics — you can see exactly when the hijack started and when it was reversed.

Check SSL/TLS status with the Certack API

bash
curl https://app.certack.com/api/public/check-ssl?domain=example.com

{
  "valid": true,
  "issuer": "Let's Encrypt",
  "expires_at": "2026-09-01T00:00:00.000Z",
  "days_remaining": 84,
  "protocol_version": "TLSv1.3",
  "cipher_name": "TLS_AES_256_GCM_SHA384",
  "hsts": true
}

Prevention Best Practices

  • Enable registrar lock: Most registrars offer a transfer lock that prevents unauthorized domain transfers and DNS changes. Enable it.
  • Use multi-factor authentication on registrar accounts: Credential theft is the most common vector for registrar compromise. MFA significantly raises the bar.
  • Deploy DNSSEC: DNSSEC adds cryptographic signatures to DNS records, allowing resolvers to verify that responses haven't been tampered with. While adoption is still not universal, DNSSEC effectively prevents cache poisoning attacks.
  • Monitor DNS records continuously: Don't rely on users to report issues. Automated monitoring catches hijacks in minutes, not hours.
  • Use RPKI to protect against BGP hijacking: Resource Public Key Infrastructure allows you to cryptographically sign your IP prefixes, making it harder for attackers to hijack your routes.
  • Have an incident response plan: Know who to call at your registrar, how to revert DNS changes quickly, and how to communicate with users during an incident.

Conclusion

DNS hijacking is not a theoretical threat — it's a recurring, high-impact attack that has affected governments, financial institutions, airlines, and cryptocurrency platforms. The attacks are getting more sophisticated, moving from endpoint-level malware to systemic compromises of registrars and routing infrastructure.

The common thread across all these incidents is that detection speed matters. The Sea Turtle campaign operated for months before discovery. The Brazilian bank hijacks were caught only after users reported issues. Continuous DNS monitoring provides the early warning system that turns a multi-day breach into a minutes-long incident.

If you're not monitoring your DNS records today, start now. Certack provides DNS, SSL/TLS, and domain expiry monitoring in a single platform. Start monitoring for free.

← Back to blog