why dns change , change vulnerability alerts?

**jraju** · 10-15-17, 10:34 AM

Hi, I am using avast antivirus and Dlink router.
Avast in their free av, are having separate scans, of which wifi inspector is one. If i enable dhcp settings, to obtain address automatically, scanning with wifi inspector produced dns hijack, and showed some sites in foreign countries as hijacked domains. Probably avast would have included risky sites in their scan database and exe.
When i change the dns to google dns, i do not get this vulnerability alert with the same scan.Does that mean that there is some weakness in ISP dns?
I do not understand the terminology of hijacked domain sites? Does that means those demains are making dent in the concerned server?
Valuable experts may please give their views

**Philip** · 10-15-17, 05:21 PM

Google DNS may alter results to block potentially malicious/hijacked domains. Those are domains where the webmaster is asleep at the wheel, and have possibly been taken over (hijacked) by malicious content. Your ISP and some other DNS providers may not alter DNS results, so it would depend on the DNS servers.

This does not mean your ISP's DNS servers are worse necessarily, just that they do not filter/alter results. You can use either.. We have a list of alternate DNS providers here:
https://www.speedguide.net/faq/what-...-can-i-use-128

Note that some alter DNS results to "protect" you (Google, OpenDNS, Norton), while others don't (Level3, Comodo, Verisign, etc.)

**jraju** · 10-15-17, 11:29 PM

Hi, a wow reply from you. I do not understand this phenomena for quite long time. I raised those queries to avast and some leading forums, but they have not answered that much precisely. They say that DNS just changes domain name to IPs, without elaborating further. Thanks Philips.
While google DNs and opendns filter those dns results to protect us, why others do not? . how it filters while others do not. Is it the fact, that google also use a kind of av scan that includes sites like avast scan?
I also sent query to My ISP and they had not replied to me.
Normally one thinks about router/ modem as a gate way and need that much protection, as just another electronic device.
Would you kindly elaborate on how Google dns filters while others do not. Would it be possible for the domain webmaster to deliberately allow their websites to be used by hackers? not necessarily asleep?
Normally one switch on and if internet access is on, they do not bother about anything. I took interest after i started using avast. First, i was alerted Rompager attack. I could not use my modem, as my dns address had been changed in admin pw.I switched to another another new router to avoid this. Day by day , i am learning from this forum admin
Can not i enclose a screen shot? can i as, a OP, rate this topic,

**Philip** · 10-16-17, 08:13 AM

Hello,

Yes, it is possible for websites to have malicious intent as well..
Google is in the business of scanning websites for their search engine and ad-selling business from the start, so they have information on a vast number of domains. They also have some type of in-house anti-malicious site filter similar to an anti-virus, and they can just compare the current DNS query to an existing list very fast and easily.