If my session is under a Man-In-The-Middle attack, can I detect it by checking the ip addresses my machine is connected to? For example, I want to know if my connection to a certain website is MITMed or not, I can visit the site and then use
netstat -antp to find out the IP to which I am connected.
If I am MITMed, that IP will belong to the attacker, and be different from the actual website. Does that work in detecting an attack?