Can't close those ads that redirect your webpage? DNS hijacking might be the culprit!

　　Have you ever encountered this situation? You enter the correct URL, but after pressing Enter, you are redirected to an unfamiliar page filled with advertisements; after closing the pop-ups and refreshing the page a few times, everything returns to normal. After this happens repeatedly, you might suspect your computer has a virus, yet repeated scans with antivirus software reveal nothing. This type of intermittent redirect—where the connection works fine one moment and fails the next—is likely not caused by a virus, but by DNS hijacking.

　　I. What is DNS? Why does it get hijacked?

　　To understand DNS hijacking, we first need to understand what DNS does.

　　When you type a URL—such as www.example.com—into your browser, you are using a human-friendly address, whereas computers communicate using IP addresses (e.g., 192.168.1.1). DNS (Domain Name System) acts as the "translator" between the two, converting easy-to-remember domain names into machine-readable IP addresses.

　　Under normal circumstances, the process works like this: your computer asks the DNS server, "What is the IP address for www.example.com?" The DNS server looks it up, provides the correct IP address, and your browser then accesses the website using that address.

　　DNS hijacking occurs when someone interferes with this "asking for directions" process. Attackers use various methods to ensure that instead of receiving the correct IP address, you receive an incorrect one that points to an advertising page or a phishing site.

　　A security advisory issued by the National Computer Network Emergency Response Technical Team/Coordination Center of China (CNCERT) in June 2026 noted that malicious DNS resolutions exceeded hundreds of millions per day, affecting over 700,000 unique domestic IP addresses daily. These figures demonstrate that DNS hijacking is not an isolated incident but a widespread security issue.

　　II. Three common methods of DNS hijacking

　　DNS hijacking can occur at different points in the network, requiring different troubleshooting and resolution methods. Based on the layer at which the attack takes place, it can be categorized into the following three types.1. Router Hijacking: The Entire Home Network Compromised

　　This is currently the most common form of DNS hijacking and a risk type specifically highlighted by CNCERT.

　　Attackers exploit router firmware vulnerabilities or weak default passwords to remotely access your router's administration interface. They then change the configured DNS server address to a malicious DNS server under their control. Consequently, all domain name resolution requests from devices connected to the Wi-Fi—such as smartphones, computers, tablets, and smart TVs—pass through the attacker's DNS server first, redirecting users to designated advertising pages or phishing sites.

　　A telltale sign of this type of hijacking is that multiple devices on the same Wi-Fi network experience redirection issues simultaneously. If you notice this problem across all your home devices, the issue likely lies with the router.

　　2. Local Device Hijacking: Your Computer or Phone Has Been Tampered With

　　This type of hijacking occurs at the user device level. After malware or a virus infects your computer, it may modify the system's "hosts" file or directly alter the system's DNS server settings.

　　The hosts file acts like a built-in "notebook" for the computer, recording mappings between domain names and IP addresses. If malware inserts a record—such as "www.example.com 123.45.67.89"—your computer will connect directly to that malicious IP address whenever you visit the site, bypassing the DNS server entirely.

　　In another scenario, malware directly changes the system's DNS server address to one controlled by the attacker. Subsequently, all domain name resolution requests pass through this "rogue server," allowing the attacker to redirect you to any address they choose.

　　3. ISP-Level Hijacking: The Most Frustrating Scenario

　　Strictly speaking, ISP-level DNS hijacking differs in nature from the previous two types. Internet Service Providers (ISPs) may insert advertisements or perform redirects during the DNS resolution process for commercial purposes.

　　The defining characteristic of this situation is that changing devices or routers is ineffective; as long as you use that specific ISP's broadband service, the problem persists. To resolve this, you typically need to report the issue to your service provider via their complaint channels or consider switching to a different broadband provider.

　　III. What is the difference between DNS hijacking and HTTP hijacking?

　　Many people attribute webpage ad redirects solely to DNS hijacking; however, another type of attack known as HTTP hijacking can cause similar phenomena. While the symptoms are alike, the underlying mechanisms and solutions differ completely.

　　DNS hijacking occurs during the "asking for directions" phase. After entering a URL, you are redirected to the wrong server while the system is attempting to resolve the IP address. The result: you intend to visit Website A but are taken to Website B. The entire page is replaced, and you see content from a completely different site.

　　HTTP hijacking occurs during the "data transmission" phase. You successfully connect to the target website, but as the page content is being transmitted back to you, an attacker injects ad code into the data stream. The result: you are indeed visiting Website A, but the page displays unexpected elements, such as pop-up ads or floating windows that shouldn't be there.

　　From a user's perspective: DNS hijacking means "entering the correct URL but landing on the wrong site," whereas HTTP hijacking means "visiting the correct site but seeing unwanted elements on the page."

　　Regarding prevention: DNS hijacking can be prevented by switching to a trusted DNS provider and securing your router; HTTP hijacking is prevented by the website implementing HTTPS encryption.

　　IV. Troubleshooting process: Four steps to pinpoint the source of the problem

　　When you encounter issues with webpage ad redirects, you can follow the steps below to troubleshoot and identify the actual culprit.

　　Step 1: Test using a different network

　　This is the simplest and most effective preliminary diagnostic method. If you experience ad redirects while accessing a site via Wi-Fi, immediately switch to your mobile data (4G/5G) and try again.

　　If the problem disappears after switching networks, the issue lies with your Wi-Fi network or router; if the problem persists, the issue may stem from your device itself or a compromise of the website's server. Step 2: Check the router's DNS configuration

　　Log in to the router's management interface and check the DNS server address under sections such as "Internet Settings," "Network Parameters," "LAN Settings," or "DHCP Server."

　　A legitimate DNS address should be one automatically assigned by your ISP or a trusted public DNS server you have manually configured. If you find an unfamiliar IP address—such as 185.222.223.125—it is highly likely that your router has been compromised.

　　Step 3: Compare DNS resolution results

　　Open the Command Prompt (Windows) or Terminal (Mac/Linux) on your computer and enter the following command to view the domain name resolution results:

nslookup www.example.com

　　Note down the returned IP address. Then, temporarily change your computer's DNS settings to a public DNS (such as 114.114.114.114 or 223.5.5.5) and run the same command again.

　　If the IP addresses obtained in the two instances differ, it indicates that the default DNS server returned an incorrect result, suggesting DNS hijacking.

　　Step 4: Check the device for malware infection

　　If the issue persists after switching networks or DNS settings, perform a comprehensive security scan on the device. Check if the hosts file has been tampered with and run a full system scan using antivirus software.

　　V. Solutions: From emergency response to long-term protection

　　Once the source of the problem is confirmed, targeted measures can be taken.

　　1. Handling router hijacking

　　If it is confirmed that the router's DNS settings have been tampered with, take the following actions:

　　First, log in to the router's administration interface and change the DNS server address back to "Obtain automatically" or manually set it to a trusted public DNS.

　　Second, immediately change the router's administrative password. Many routers are compromised because they use default or weak passwords (such as admin/admin or 123456). Set a strong password to prevent attackers from gaining unauthorized access again.

　　Next, check for and disable unnecessary features—such as remote management, UPnP, and port forwarding—to reduce the router's attack surface.

　　Finally, keep an eye out for firmware updates released by the router manufacturer and upgrade to the latest version promptly to patch known security vulnerabilities.

　　2. Handling device hijacking

　　If a computer or mobile phone has been compromised by malware, take the following actions:

　　On Windows systems, you can run the following command to clear the DNS cache:

ipconfig /flushdns

　　Linux System Usage:

sudo systemd-resolve --flush-caches

　　Next, check the hosts file (located at `C:\Windows\System32\drivers\etc\hosts` on Windows, or `/etc/hosts` on Linux/Mac) and remove any suspicious entries.

　　Perform a full system scan using reliable antivirus software to eliminate any potential malicious programs.

　　3. Long-term protection: Use encrypted DNS

　　Traditional DNS queries use UDP port 53; data is transmitted in plaintext and is easily tampered with by man-in-the-middle attackers. Encrypted DNS (DoH/DoT) encapsulates DNS queries within HTTPS/TLS tunnels, preventing ISPs and attackers from viewing or tampering with the resolution results.

　　4. Protective measures for website administrators

　　If you operate a website, you can protect your visitors by taking the following steps:

　　Enable HTTPS encryption across the entire site and configure the HSTS response header to prevent SSL stripping/downgrade attacks:

Strict-Transport-Security: max-age=31536000; includeSubDomains

　　Add a no-transcoding tag to the page header to prevent carriers from automatically transcoding the content or inserting advertisements:

<meta http-equiv="Cache-Control" content="no-transform" />
<meta http-equiv="Cache-Control" content="no-siteapp" />

　　VI. Conclusion

　　If you cannot close advertisements that cause your browser to redirect to other pages, your computer is not necessarily infected with a virus; DNS hijacking is a likely culprit. In terms of the point of attack, DNS hijacking can occur at the router, local device, or ISP level. Regarding symptoms, DNS hijacking results in being directed to the wrong website, whereas HTTP hijacking typically manifests as extra advertisements appearing on the page.

　　The core troubleshooting strategy involves: testing on a different network to determine the scope of the issue, checking router DNS settings for unauthorized changes, and comparing DNS resolution results to confirm whether hijacking is occurring.

　　Key solutions include: changing weak router passwords, switching to a trusted public DNS service, and enabling encrypted DNS. For website administrators, implementing site-wide HTTPS and using anti-transcoding tags are essential protective measures.

　　Data from the National Computer Network Emergency Response Technical Team/Coordination Center of China (CNCERT/CC) indicates that DNS hijacking has a widespread impact, affecting up to 700,000 unique domestic IP addresses in a single day. This is not a trivial issue to be ignored. Spending just a few minutes checking your router's DNS configuration could save you a great deal of unnecessary trouble.