I've noticed some very suspicious activity from my ISP.

Sometimes I would notice that when I ping google.com it would resolve to an IP which is owned by my ISP. I currently don't have an example since it is resolving normally at the moment. However, here's a weird thing. My ISP's DNS servers (,, and are all pinging at about 12ms. Here's a traceroute of all these IPs which shows that the traffic never leaves the ISPs network.


Tracing route to over a maximum of 30 hops

  1     4 ms     4 ms     3 ms
  2     *        *        *     Request timed out.
  3    11 ms    11 ms    11 ms
  4    11 ms    11 ms    11 ms

Google DNS:

Tracing route to google-public-dns-a.google.com [] over a maximum of 30 hops:

  1     4 ms     4 ms     3 ms
  2     *        *        *     Request timed out.
  3    11 ms    12 ms    11 ms
  4     *        *        *     Request timed out.
  5    12 ms    12 ms    12 ms
  6    48 ms    15 ms    13 ms
  7    13 ms    13 ms    12 ms  google-public-dns-a.google.com []

Level3 DNS:

Tracing route to b.resolvers.Level3.net []
over a maximum of 30 hops:

  1     6 ms     3 ms     2 ms
  2     *        *        *     Request timed out.
  3    11 ms    13 ms    11 ms
  4    14 ms    35 ms    16 ms  b.resolvers.Level3.net []

All the are in the ISPs private network which means none of this traffic left into the outside world. Can someone confirm if this is genuinely suspicious activity by my ISP, and is there something I can do about it?

  • 3
    I wouldn't call this hijacking exactly. More traffic shaping than anything else. It could be an attempt to reduce latency by providing proxy/cache servers of popular content. (Which is quite common amongst ISPs) Jan 10, 2014 at 13:01

1 Answer 1


Yes, your ISP is very clearly hijacking not only the DNS for google, but also DNS requests you try to send to outside DNS servers.

You are correct in your analysis that the traffic to Google is not leaving your ISPs network. Your traceroutes also show that your DNS queries to Google Public DNS, as well as to Level 3's open resolvers, are not leaving your ISP's network.

Furthermore, the DNS A records returned all point to an IP inside your ISP's network, regardless of which DNS provider you query. i.e., the A record provided is hijacked, as that is not the A record that Google themselves provides, but rather one that your ISP has provided in its place.

It would appear that your ISP is hijacking the actual DNS queries in order to prevent you from circumventing its hijacking of the DNS records.

No BGP tampering is required for them to do this. All they need to do (and likely all they are doing) is route all packets destined for UDP 53 to their own nameservers. A simple setting in their own router.

  • You can use a VPN service to bypass your ISP's DNS. You'll have to trust your VPN provider but you'll have choice. May 31, 2015 at 16:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .