Whenever I do nmap scans, it seems that the information related to port
53 is altered by my ISP router as follows:
$ nmap -T4 -A -v stackoverflow.com PORT STATE SERVICE VERSION 53/tcp open domain MikroTik RouterOS named or OpenDNS Updater .... // Ports related to the actual stackoverflow.com scan: 21, 22, 25, 80...
This happens for every target IP or hostname: scanme.nmap.org, google.org, etc
However, if I do a scan using an online scanner such as https://hackertarget.com/nmap-online-port-scanner/, it shows the exact details and doesn't show this
Starting Nmap 6.46 ( http://nmap.org ) at 2015-12-26 22:11 CST Nmap scan report for stackoverflow.com (22.214.171.124) Host is up (0.00093s latency). Other addresses for stackoverflow.com (not scanned): 126.96.36.199 188.8.131.52 184.108.40.206 220.127.116.11 PORT STATE SERVICE VERSION 21/tcp filtered ftp 22/tcp filtered ssh 25/tcp filtered smtp 80/tcp open http cloudflare-nginx 443/tcp open ssl/https cloudflare-nginx 3389/tcp filtered ms-wbt-server
How do I avoid this.
Important: Off topic but my network may be in a MITM attack. Could a MITM cause this?