← Back to Design & Development
Internet Routing · Simple Guide

BGP Hijacking, Explained Simply

What it is, why it's dangerous — and the cleaner ways a country can block an app inside its own borders without breaking the internet for everyone else.

Foundations

The internet works like a postal system

Before we can understand BGP hijacking, we need one simple picture. The internet is not one big machine — it's thousands of separate networks (run by ISPs, companies, and clouds) that agree to pass traffic to each other. Think of them as post offices.

When you open an app, your data is like a letter. You don't decide the route — you just hand the letter to your local post office (your ISP). It looks at the destination and forwards it to the next post office, which forwards it onward, until it reaches the right one. Each post office only needs to know one thing: "for this destination, who do I hand the letter to next?"

IP address block = a postal code

Every app's servers live at a range of IP addresses, written like 149.154.160.0/20. Think of it as a postal code — a region of addresses, not one single house.

Network (AS) = a post office

Each network is called an Autonomous System (AS) and gets a unique number. It's the post office that says: "I can deliver mail for these postal codes — route through me."

So what: reaching any app means trusting a chain of post offices to forward your data correctly, based on a shared map of "which network owns which addresses." The system that builds that map is called BGP.
The Protocol

What is BGP?

BGP (Border Gateway Protocol) is simply the language post offices use to tell each other which addresses they can deliver to. One network announces to its neighbours: "I own this address block — send that traffic to me." Each neighbour writes it down and passes the message along. That's how the internet's whole map gets built.

flowchart LR APP([App's servers
own 149.154.160.0/20]) N1[Network A] N2[Network B] ISP[Your ISP] YOU([You]) APP -->|"I own this address block"| N1 N1 -->|"reach it through me"| N2 N2 -->|"reach it through me"| ISP ISP -->|"forwards your traffic"| YOU style APP fill:#38b265,stroke:#38b265,color:#fff style YOU fill:#4a90d9,stroke:#4a90d9,color:#fff style ISP fill:#9b72cf,stroke:#9b72cf,color:#fff style N1 fill:#171d27,stroke:#7b8599,color:#d4dae5 style N2 fill:#171d27,stroke:#7b8599,color:#d4dae5

There's one rule to remember: if a network hears about the same address block from two directions, it picks the one that looks "closer" or more specific. The winner gets all the traffic for that block. That tie-breaker is exactly the lever a hijacker pulls.

So what: BGP is just networks shouting "I can deliver to these addresses!" and everyone believing them. The internet's map is only as honest as those announcements.
The Problem

What is BGP hijacking?

Here's the shocking part: when a network announces "I own these addresses," nobody checks if it's true. BGP was designed decades ago between a few trusting networks, so it runs on the honour system — it has no built-in way to verify ownership.

So if a network announces an address block it does not own, neighbours believe it and start sending that traffic the wrong way. That's BGP hijacking in one line:

BGP hijacking = a network claims to own IP addresses that actually belong to someone else, so traffic meant for the real owner gets redirected to the impostor — where it can be dropped (app goes offline) or spied on (man-in-the-middle).

flowchart LR YOU([You]) --> ISP[Your ISP] ISP -->|"believes the false claim"| HJ[Impostor network
falsely claims the app's addresses] HJ -.->|"traffic dropped or spied on"| X((✕)) APP([Real app servers]):::ghost classDef ghost fill:#171d27,stroke:#545d6e,color:#7b8599,stroke-dasharray:4 4 style YOU fill:#4a90d9,stroke:#4a90d9,color:#fff style ISP fill:#9b72cf,stroke:#9b72cf,color:#fff style HJ fill:#e05252,stroke:#e05252,color:#fff style X fill:#e05252,stroke:#e05252,color:#fff

It comes in two intents, and the difference matters:

⚠️ Accidental (a "route leak")

The most common case — an engineer makes a config mistake, or a network forgets to filter an announcement, and a route escapes that should have stayed internal. No malice, just a slip.

🚨 Deliberate

An attacker claims someone's addresses on purpose — to knock a service offline, intercept traffic, or steal data — then disappears.

Key point: from the traffic's point of view, accidental and deliberate hijacks look identical — data simply goes to the wrong network. You can't tell intent from the routing alone.

Why It Matters

Why it's so dangerous

The whole danger of BGP hijacking is that it has no respect for borders. BGP is a global system — an announcement made in one country can spread to networks all over the world in seconds. So if a network tries to redirect an app's traffic but the announcement isn't kept strictly internal, it can leak worldwide and break the app for people in completely unrelated countries.

It's global by default

A route meant for "my own users" can escape to international networks. Now their users are affected too — even though the original intent was local.

It spreads fast, undoes slow

A false route ripples across the internet in seconds. Pulling it back means waiting for every network that learned it to hear the correction. The damage is done long before cleanup finishes.

It's silent

No alarm goes off. Users just see the app "not working" with no error explaining why. Only engineers watching global routing tables can spot it.

Bottom line: BGP hijacking is the wrong tool for blocking an app in one country. It's like trying to close one shop's door by rerouting the entire city's mail — the side effects spill far beyond where you intended. There are cleaner, contained ways to do it.

The Alternatives

Better ways to block an app in a country

If a country genuinely needs to restrict an app inside its own borders, there are well-understood techniques that stay contained to that country's own networks — they don't leak onto the global internet the way a bad BGP announcement does. Here are the main ones, from simplest to strongest.

1. DNS blocking (the simplest)

What it is: DNS is the internet's phone book — it turns a name like app.com into an IP address. ISPs in the country are told to make their DNS servers refuse to answer for the app's name, so devices can't find its address in the first place.

Stays contained: it only affects the DNS servers inside that country. Nobody abroad is touched.

Trade-off: easy to bypass — users can just switch to a public DNS (like 8.8.8.8) or use a VPN. It's a speed bump, not a wall.

2. IP / firewall blocking

What it is: ISPs configure their own firewalls to drop traffic going to the app's known IP addresses. The block lives inside the ISP's network only.

Stays contained: a firewall rule affects only that ISP's own traffic — unlike a BGP announcement, it is never advertised to other networks, so it can't leak globally.

Trade-off: apps on big clouds share IPs with many other services, so you risk blocking innocent sites too. Apps can also rotate IPs to dodge it.

3. Deep Packet Inspection (DPI) — the precise tool

What it is: equipment inside the ISP looks at the type of traffic flowing through and blocks or throttles connections that match the app — based on its traffic patterns or the server name in the connection — rather than just an IP.

Stays contained: the inspection happens on traffic passing through that country's ISPs only. It is a local filter, not a global announcement.

Trade-off: expensive hardware, and modern encryption increasingly hides the details DPI relies on. Still the most surgical option.

4. Internal (null) routing — done correctly

What it is: an ISP routes the app's addresses to "nowhere" (a black hole) inside its own network only. This is the same basic idea a hijack abuses — the crucial difference is the announcement is never shared with other networks.

Stays contained: as long as the route is filtered at the network's border and kept internal, it blocks only that ISP's customers and never reaches the global internet.

Trade-off: requires careful border filtering — get it wrong and it becomes exactly the global leak we want to avoid. That's why this is the line between a legitimate block and an accidental hijack.

The common thread: every safe method keeps the block inside the country's own networks. The danger with BGP is when an internal decision is announced to the whole world. Proper blocking is local; a hijack is global.

Comparison

Quick comparison

The same goal — "make this app unreachable for users here" — but very different blast radius.

MethodWhere it actsStays local?Easy to bypass?
DNS blockingCountry's DNS servers✅ YesEasy (change DNS / VPN)
IP / firewall blockISP firewalls✅ YesModerate (VPN, IP rotation)
DPIISP inspection gear✅ YesHard (but VPNs still work)
Internal null routingISP routing, kept internal✅ Yes — if filtered at the borderModerate (VPN)
BGP hijackingGlobal routing system❌ No — can leak worldwideN/A — it's the wrong tool
Reading the table: the first four methods all keep the impact inside the country. BGP hijacking is the odd one out — it operates on the global routing map, so its effects can spill across borders. That's why it's considered abuse of internet routing rather than a normal blocking technique.

Wrap-up

Key takeaways

  • The internet routes like a postal system: networks (post offices) announce which address blocks (postal codes) they can deliver to.
  • BGP is the language for those announcements — and it trusts them without verifying ownership.
  • BGP hijacking is a network falsely claiming someone else's addresses, so their traffic gets redirected, dropped, or spied on.
  • It's dangerous because it's global — a local decision can leak worldwide, spread in seconds, and do so silently.
  • To block an app inside a country, use contained methods — DNS blocking, IP/firewall rules, DPI, or strictly-internal routing — never a global routing announcement.
  • The golden rule: proper blocking stays local; a hijack goes global.