Your ISP might be lying to your computer about where websites live
In short: When you type a URL, your computer asks a DNS server for an IP address. Usually, this is a neutral translation. But some providers hijack this process, redirecting your traffic to their own servers to show ads, collect data, or enforce censorship—even for websites that don't exist.
DNS hijacking occurs when a provider subverts the Domain Name System to redirect queries to rogue servers. While this can be done via malware or router exploits, it is frequently practiced by Internet Service Providers (ISPs). Many global providers, including AT&T, Verizon, and Deutsche Telekom, have used these tactics to serve advertisements or gather user statistics. In some regions, like Indonesia, it is legally mandated to hijack port 53 to block specific websites under government-led 'Internet Sehat' campaigns.
A primary mechanism for this is the manipulation of NXDOMAIN responses. Normally, if you type a non-existent domain, the server returns an error. Hijacking ISPs instead return a fake IP address belonging to the ISP. This creates significant technical friction: roaming laptops may falsely believe they are on a corporate network, VPN connections can suffer from cached false entries, and mail clients might attempt to send data to a paid-results web server instead of an internal mail server. In some cases, this can lead to the leakage of confidential user data.
The industry is moving toward defense through encryption. The widespread adoption of DNS over HTTPS (DoH) and DNS over TLS (DoT) allows modern browsers and operating systems to route queries through secure tunnels, preventing ISP interception. However, legacy systems remain vulnerable. While some users opt for public DNS services like Google or OpenDNS to avoid hijacks, these services come with their own privacy trade-offs. For high-security needs, researchers have proposed 'DNS-Sensor' systems that continuously scan cache records against authoritative data to detect anomalies with sensor-grade precision.
Opens the Intellect+ feed with this card first. Swipe up for the next one.
Sources
- Summary by Intellect · source: DNS hijacking
To cite this card, link to https://intellectplus.co.uk/app/health-dns-hijacking.
How we source, check and correct cards: Editorial standards.
General information, not professional advice. Spotted an error? Flag the card or see corrections and complaints.
Intellect Plus is a visual educational discovery platform for exploring fascinating facts and ideas. Brain Food, Not Brain Rot. What is Intellect Plus?
Related
More in Future Frontier · More in Health · Latest · A–Z · All topics
