What it is, why it's dangerous — and the cleaner ways a country can block an app inside its own borders without breaking the internet for everyone else.
Before we can understand BGP hijacking, we need one simple picture. The internet is not one big machine — it's thousands of separate networks (run by ISPs, companies, and clouds) that agree to pass traffic to each other. Think of them as post offices.
When you open an app, your data is like a letter. You don't decide the route — you just hand the letter to your local post office (your ISP). It looks at the destination and forwards it to the next post office, which forwards it onward, until it reaches the right one. Each post office only needs to know one thing: "for this destination, who do I hand the letter to next?"
Every app's servers live at a range of IP addresses, written like 149.154.160.0/20. Think of it as a postal code — a region of addresses, not one single house.
Each network is called an Autonomous System (AS) and gets a unique number. It's the post office that says: "I can deliver mail for these postal codes — route through me."
BGP (Border Gateway Protocol) is simply the language post offices use to tell each other which addresses they can deliver to. One network announces to its neighbours: "I own this address block — send that traffic to me." Each neighbour writes it down and passes the message along. That's how the internet's whole map gets built.
There's one rule to remember: if a network hears about the same address block from two directions, it picks the one that looks "closer" or more specific. The winner gets all the traffic for that block. That tie-breaker is exactly the lever a hijacker pulls.
Here's the shocking part: when a network announces "I own these addresses," nobody checks if it's true. BGP was designed decades ago between a few trusting networks, so it runs on the honour system — it has no built-in way to verify ownership.
So if a network announces an address block it does not own, neighbours believe it and start sending that traffic the wrong way. That's BGP hijacking in one line:
It comes in two intents, and the difference matters:
The most common case — an engineer makes a config mistake, or a network forgets to filter an announcement, and a route escapes that should have stayed internal. No malice, just a slip.
An attacker claims someone's addresses on purpose — to knock a service offline, intercept traffic, or steal data — then disappears.
The whole danger of BGP hijacking is that it has no respect for borders. BGP is a global system — an announcement made in one country can spread to networks all over the world in seconds. So if a network tries to redirect an app's traffic but the announcement isn't kept strictly internal, it can leak worldwide and break the app for people in completely unrelated countries.
A route meant for "my own users" can escape to international networks. Now their users are affected too — even though the original intent was local.
A false route ripples across the internet in seconds. Pulling it back means waiting for every network that learned it to hear the correction. The damage is done long before cleanup finishes.
No alarm goes off. Users just see the app "not working" with no error explaining why. Only engineers watching global routing tables can spot it.
If a country genuinely needs to restrict an app inside its own borders, there are well-understood techniques that stay contained to that country's own networks — they don't leak onto the global internet the way a bad BGP announcement does. Here are the main ones, from simplest to strongest.
What it is: DNS is the internet's phone book — it turns a name like app.com into an IP address. ISPs in the country are told to make their DNS servers refuse to answer for the app's name, so devices can't find its address in the first place.
Stays contained: it only affects the DNS servers inside that country. Nobody abroad is touched.
Trade-off: easy to bypass — users can just switch to a public DNS (like 8.8.8.8) or use a VPN. It's a speed bump, not a wall.
What it is: ISPs configure their own firewalls to drop traffic going to the app's known IP addresses. The block lives inside the ISP's network only.
Stays contained: a firewall rule affects only that ISP's own traffic — unlike a BGP announcement, it is never advertised to other networks, so it can't leak globally.
Trade-off: apps on big clouds share IPs with many other services, so you risk blocking innocent sites too. Apps can also rotate IPs to dodge it.
What it is: equipment inside the ISP looks at the type of traffic flowing through and blocks or throttles connections that match the app — based on its traffic patterns or the server name in the connection — rather than just an IP.
Stays contained: the inspection happens on traffic passing through that country's ISPs only. It is a local filter, not a global announcement.
Trade-off: expensive hardware, and modern encryption increasingly hides the details DPI relies on. Still the most surgical option.
What it is: an ISP routes the app's addresses to "nowhere" (a black hole) inside its own network only. This is the same basic idea a hijack abuses — the crucial difference is the announcement is never shared with other networks.
Stays contained: as long as the route is filtered at the network's border and kept internal, it blocks only that ISP's customers and never reaches the global internet.
Trade-off: requires careful border filtering — get it wrong and it becomes exactly the global leak we want to avoid. That's why this is the line between a legitimate block and an accidental hijack.
The same goal — "make this app unreachable for users here" — but very different blast radius.
| Method | Where it acts | Stays local? | Easy to bypass? |
|---|---|---|---|
| DNS blocking | Country's DNS servers | ✅ Yes | Easy (change DNS / VPN) |
| IP / firewall block | ISP firewalls | ✅ Yes | Moderate (VPN, IP rotation) |
| DPI | ISP inspection gear | ✅ Yes | Hard (but VPNs still work) |
| Internal null routing | ISP routing, kept internal | ✅ Yes — if filtered at the border | Moderate (VPN) |
| BGP hijacking | Global routing system | ❌ No — can leak worldwide | N/A — it's the wrong tool |