DNS Hijacked to Phishing Sites: Your Response Checklist

Picture this. You click a link you have clicked a hundred times before, and your browser lands on a page that looks almost right, yet asks for credentials it never used to ask for. The address bar shows a familiar .com.au domain, but the certificate looks off and the login form feels slightly wrong. This is the classic pattern of DNS hijacking, where malicious software rewrites the phonebook your computer uses to find websites, steering you toward lookalike phishing pages even when you typed the correct address.

For Australians, this kind of attack has become increasingly common, often piggybacking on compromised home routers, dodgy downloads promoted through social media, or free public hotspots in places like Sydney CBD or Brisbane's Fortitude Valley. Because the redirection happens before your browser ever connects to the real site, ordinary users have no easy way to tell that anything is wrong until the credentials are already gone. A quick heads-up to your mates can also stop the same trap from snagging someone else.

How DNS hijacking silently redirects your browser

Every device on a network relies on a DNS resolver to translate human-friendly names like "yourbank.com.au" into numeric IP addresses. When malware alters that resolver, either by editing the network adapter settings on your PC, by poisoning the hosts file, or by attacking the router itself, every lookup goes through a server controlled by the attacker. The browser faithfully loads whatever IP the rogue resolver returns, which is why a genuine-looking page can appear at a legitimate-looking URL.

This is fundamentally different from a simple browser hijacker that only rewrites the home page. DNS tampering affects every app on the system, from email clients to banking software, making it a popular technique in fileless malware campaigns. If you want a deeper look at how such infections hide in memory, this eradicating fileless malware guide walks through the cleanup process step by step.

Switching to a safer DNS provider

Provider	Primary DNS	Secondary DNS	Notes for Australian users
Cloudflare	1.1.1.1	1.0.0.1	Fast global Anycast, supports 1.1.1.1 for Families
Google Public DNS	8.8.8.8	8.8.4.4	Widely supported, logs anonymised data
OpenDNS (Cisco)	208.67.222.222	208.67.220.220	Customisable filtering options
Quad9	9.9.9.9	149.112.112.112	Blocks known malicious domains
ISP default	Telstra / Optus / TPG	varies	Convenient, but may lack threat filtering

Replacing whatever your router currently hands out with one of the public resolvers above is often the quickest way to confirm whether your existing settings have been tampered with. If a site that used to load fine suddenly refuses to connect after the change, that is a strong indicator the previous values were rogue. Keep a note of the original values too, since your ISP's tech support may want to see them.

Telltale signs on a typical Australian home network

The first hint often appears when mates report an email you never sent, or when your bank calls to question a transaction you did not make. Other signs include sluggish name resolution, frequent CAPTCHA walls, and search results that look like paid ads even when you did not click anything. Some users notice that legitimate sites such as my.gov.au or ato.gov.au redirect through strange intermediaries, which is a strong red flag worth investigating straight away.

DNS tampering also has a habit of resurfacing after a reboot, especially when the router itself has been compromised. Because most Aussie households run a combined NBN modem and Wi-Fi router supplied by the ISP, the malicious settings often live in that box rather than on the laptop. Checking the router admin page at 192.168.0.1 or 192.168.1.1 should become a habit whenever something feels off.

First response steps to limit the damage

Disconnect the affected machine from the network straight away, whether that means unplugging the Ethernet lead or turning off Wi-Fi on a MacBook. This stops the rogue resolver from sending more queries to the attacker's infrastructure. Change passwords for any sensitive account from a known-safe device, ideally using a different network such as mobile data on a Telstra or Optus SIM while you clean things up.

Run a full scan with reputable anti-malware software, and pay close attention to anything flagged as a trojan, worm, or potentially unwanted program. Threats in the worms category frequently carry DNS-changing payloads, so do not ignore low-severity detections. Save the scan log, because you may need it later if you decide to lodge a report with ReportCyber.

Cleaning DNS settings from Windows and macOS

On Windows, open Network Connections, choose the active adapter, select Properties, then Internet Protocol Version 4, and tick "Obtain DNS server address automatically" if you intend to fall back to the router. If you prefer hard-coded resolvers, enter the values from the table earlier in this article. Repeat the process for IPv6, then clear the DNS cache by running ipconfig /flushdns from an elevated command prompt. Check the hosts file at C:\Windows\System32\drivers\etc\hosts for any unfamiliar entries pointing at suspicious IPs.

On macOS, head to System Settings, Network, select the active interface, then Details, and inspect the DNS tab. Remove rogue addresses, add a trusted pair such as 1.1.1.1 and 1.0.0.1, and confirm. Open Terminal and run sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder to clear local caches. If a fake security tool keeps popping up with alarming warnings, follow this fake antivirus removal walkthrough to get rid of the lock-screen variant cleanly.

Hardening the router and your devices against repeat attacks

Log into the router, change the admin password if it is still the factory default like "admin/admin", and update the firmware to the latest build. Most Aussie ISPs release patches regularly, and a quick reboot after the update helps the changes stick. Disable remote administration features you do not use, especially UPnP, which can let rogue software punch holes through the firewall.

On your computer, keep the operating system and browser updated, enable automatic certificate renewal, and consider running DNS-over-HTTPS through a supported browser. Make sure your anti-malware suite performs real-time scanning rather than just on-demand checks. For laptops used on the road, a small travel router with built-in DNS filtering adds a useful layer between you and an untrusted cafe network.

Reporting the incident and getting your accounts back

Australians can report phishing incidents to the Australian Cyber Security Centre through ReportCyber, and forward suspicious SMS messages to 0429 557 997 as part of the ACSC campaign. Banking-related scams should also be reported to your institution and to Scamwatch, the ACCC service that tracks emerging fraud patterns across the country. Quick reporting improves the chance that fraudulent domains are sinkholed before others fall into the same trap.

After the report, rotate passwords for every account that may have been exposed, enable two-factor authentication where it is not already on, and review transaction histories for the previous fortnight. With a clean DNS configuration, a hardened router, and a watchful eye on account activity, you should be back to browsing without those unsettling redirects in no time.