Registry redirection is a traffic diversion technique that sends clients from a legitimate software registry or distribution host to attacker-controlled infrastructure. The client may still believe it is talking to the trusted service, but DNS, routing, proxy, or other network manipulation changes where requests actually land.
This matters because many security tools, package managers, and infrastructure-as-code platforms automatically fetch modules, images, or dependencies from registries. If that path is redirected, attackers can serve tampered packages, harvest credentials, or deliver malicious updates before defenders notice. In real attacks, redirection is often paired with supply chain compromise: the registry lookup succeeds, but the response content or destination is controlled by the attacker. Defenders reduce risk by pinning versions, validating signatures and checksums, monitoring DNS and egress logs, and treating unexpected registry endpoints as a trust-boundary failure.