Running "nslookup google.com" yields IPs of my ISP (as Non-authoritative answer). I think this started occurring recently. Probably they are making cache or something, as nearest Google data center is quite far away.

First of all, how is that even possible? I thought the worst they could do is block me from sending a DNS request to (say by blocking remote port 53), but how can they trick from sending me a correct address?

Second, how can I bypass this, if at all?



Microsoft Windows [Version 6.1.7601]

Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Users\asdf nslookup google.com

Server: google-public-dns-a.google.com


Non-authoritative answer:

Name: google.com

Addresses: 2a00:1450:4017:801::1006


And using DNSCrypt (with and without option of DNSCrypt over port 443):

Microsoft Windows [Version 6.1.7601] Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Users\asdf>nslookup google.com

primary name server = localhost

responsible mail addr = nobody.invalid

serial = 1

refresh = 600 (10 mins)

retry = 1200 (20 mins)

expire = 604800 (7 days)

default TTL = 10800 (3 hours)

Server: UnKnown


Non-authoritative answer:

Name: google.com

Addresses: 2a00:1450:4017:800::1008


Formatting is a bit off, sorry about that.

  • What IPs is it returning? It's actually quite trivial for an ISP to intercept the connection to (or any non-encrypted connection) and inject whatever data they want; However, that kind of hijacking would be suicide for an ISP's reputation. Aug 7, 2013 at 21:48
  • It returns some of the ISP addresses, the exact IP is not really relevant I guess. This is not the US or western Europe btw, so ISP can do whatever they want without anyone even noticing something is wrong. Aug 7, 2013 at 21:58
  • If you remind me how to copy the contents of CMD on Windows, I'll paste the results. Aug 7, 2013 at 21:59
  • So you're also saying that if you go to google.com, it redirects to one of the IPs you get returned in your nslookup? All systems? One system? This could easily be a trojan or virus which is redirecting
    – ernie
    Aug 7, 2013 at 22:00

3 Answers 3


I don't think what you think is hijacking is hijacking (I am not saying it is not happening, just the evidence does not point to it.)

From what it looks like you are just seeing 3rd party location based CDNs Google uses for it's servers.

Google would never be able to serve up pages at the speed it offers if every query had to go through a master database back in Mountain View, CA. So they have 1000's of mirrored servers at ISP's all over the world to help serve up content quicker. They do not necessarily manage the servers that are hosting the page, only the software running on the server. Heck it could be done all with VPS's.

So you are likely seeing the IP's belonging to the hosting company/CDN that Google is using for serving pages in your area.

(P.S. The way they are poiting you to the correct CDN (the reason you get a different set of numbers vs ping.eu) is the DNS servers sitting on look at the requesting IP and reply with the IPs for the CDN serving that area by doing a IP Geolocation Lookup)

  • I think that you're probably right, it's the most logical answer at this point. Aug 7, 2013 at 23:01

Do you get the same results when using as a DNS server? ? ?

If your ISP is hijacking connections to, there's not much you can do other than complain to them and connect to over a VPN.

I would very much like to see the DNS report from NameBench, a DNS testing utility which is primarily used for comparing and finding the fastest DNS server available, but also checks for hijacking. It will tell you if your ISP is doing Bad ThingsTM with your internet.

  • Same thing with all of them (I noticed some give slightly different IP addresses still of my ISP, but that may be due to time of day as well). Also, I just now downloaded DNSCrypt, which supposedly combats against hijacking. I even marked for it resolve on port 443. Still same damn thing! I'll paste those results as well momentarily. Aug 7, 2013 at 22:22
  • Gah! Just tried it with my phone on cellular network, even here there's a DNS hijack! To different local ISPs addresses, but still...for example one of the addresses: whois.net/ip-address-lookup/ When did this phenomenon start happening...I swear this didn't happen a few years ago Aug 7, 2013 at 22:33

Sounds like your ISP is transparently proxying outgoing UDP 53 and forcing it to go their DNS servers.

If you have Tor running, you can have it resolve DNS queries. You'll need to set your local DNS servers to point to the internal IP address on which you are running Tor.

I believe OpenDNS accepts DNS queries on UDP port 5353. You'll need a locally running proxy that accepts DNS requests on localhost and then redirects them to OpenDNS on port 5353. Something like Acrylic DNS Proxy can be used on Windows.

  • Would DNSCrypt ensure what you said above? Because that still didn't help. Aug 7, 2013 at 22:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .