You could try some common banking website domain names and see if the IP addresses of the actual sites are returned or if, instead, IP addresses not associated with the banks are returned. Also you could try other sites such as PayPal.com, where people could be tricked by a fake website into revealing a userid and password that could give the malefactor access to funds. Also, if you are in the U.S., the FBI may be interested in hearing from you - see Check to see if Your Computer is Using Rogue DNS:
The FBI is seeking information from individuals, corporate entities,
and Internet Services Providers who believe that they have been
victimized by malicious software (“malware”) related to the
defendants. This malware modifies a computer’s Domain Name Service
(DNS) settings and thereby directs the computers to receive
potentially improper results from rogue DNS servers hosted by the
Put the DNS server's IP address in the field for "Check Your DNS" and have the FBI's site check the IP address. Even if the result is "Your IP is not configured to use the rogue DNS servers." that does not mean it is not a malicious DNS server, just that it isn't one of those the FBI is interested in for this case.
Can you provide the IP address of the rogue DNS server?