I am trying to detect what is causing my DNS to return fake IP addresses for domains like apple, orange, etc. which obviously don't exist.

If I do following on my Windows machine:

  • ipconfig /flushdns - flush DNS cache
  • ping apple - invoke DNS query
  • ipconfig /display - see DNS cache

the ping command doesn't fail and I can see DNS entry in the output.

I tried visiting http://apple on both Windows machine and Android machine (which I checked are both using the same DNS config), my Android machine can't find the domain.

My question: What could possibly be acting maliciously between Windows' DNS client and the DNS server, or how could I go about finding where the malware is installed?

Note: my Windows machine is connected to router via Ethernet, while Android device uses Wi-Fi.

  • Do you mean the domain is literally "apple", with no TLD at all?
    – forest
    Commented Dec 30, 2018 at 1:43
  • @forest Yes, its just http://anything. Commented Dec 30, 2018 at 16:18
  • 1
    Where is the DNS server, and who controls it? Who controls the path between you and this DNS server? The DNS server can be configured to lie about responses and just fake some, or someone on the path may be altering your DNS requests or replies. Try to use first any open public resolver and see if issue persists:, or or or You can also try DoH and/or DoT some of the previous nameservers do provide that. Commented Jan 1, 2019 at 6:41
  • What is the IP address that is being returned on your windows machine for these web pages? Is the page that is displayed on the Windows machine simply a page saying that the site doesn't exist? I am trying to understand if there is a program on your Windows machine that is trying to handle DNS errors by redirecting you to a custom error page. Commented May 18, 2021 at 10:29
  • Most name resolution adds the local network/domain to bare names to make it easier to reference local systems by name only. For example an OpenWRT router defaults to lan for this so a bare name ends up as name.lan. Really need to see what addresses are being returned to figure out what is going on.
    – Brian
    Commented Sep 10, 2022 at 15:27

1 Answer 1


It is hard for me to fully understand your question and the problem you explained. If you mean you can access in your windows machine:


and you are presented a webpage, then something is wrong.

Because you say the same behavior does not happen in your Android and that it has the same DNS configurations of your windows machine, the router is perhaps not the source of the problem, meaning it is not compromised

I also noticed that you flush your DNS cache in your Windows machine, hence a DNS poisoning directly into your machine may also be excluded, unless it is persistent. There could be a malicious process running in the background and that has the rights to redirect your DNS traffic and give you some fake responses, either from hard coded webpages pages within the malware code or from some files hidden in your file system.

After pinging apple.com you should see what the IP address is. If it is your own, or one in your homenetwork, then clearly it is a man in the middle attack. If it is a public IP address, run a WHOIS request on some site that offers that service.

Finally what you can also do is install wireshark and run it while you make the ping request, this will allow you to see where the packets go exactly.

This is not a real answer, but without more details it is hard to provide you with one.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .