Router DNS Hijacking, Rogue DHCP Servers, kple Encrypted DNS (DoH / DoT) Gbugbɔgaxɔ¶

Ɣesiaɣi si nàŋlɔ nyatakakadzraɖoƒe ƒe adrɛs abe chase.com, . google.com, alo apple.com le wò web-browser me la, wò mɔ̃a abia be Domain Name System (DNS) resolver be woaɖe ŋkɔ ma si amegbetɔ ate ŋu axlẽ la gɔme ɖe IP adrɛs si me xexlẽdzesiwo le (142.250.190.46). Ne amedzidzela aɖe trɔ Primary kple Secondary DNS server ƒe ɖoɖowo le wò aƒeme alo ɔfis Wi-Fi router me le ɖoɖoezizi me, etrɔ DHCP server si nye ameflutɔ le wò nutoa me network dzi, trɔ asi le wò kɔmpiuta ƒe ** ɣaɣla la ŋu.hosts file**, alo xea mɔ na wò biabiawo le amedzrodzeƒe alo yameʋudzeƒe ƒe network dzi la, wokpɔa wò internet ƒe telefongbalẽ dzi. Ne èŋlɔ wò gadzraɖoƒe, e-mail dɔwɔƒe, alo kɔmpiutadziɖoɖowo ɖɔɖɔɖodɔwɔƒe ƒe URL si sɔ pɛpɛpɛ, si woŋlɔ nyuie ɖe adrɛs ƒe akpaa dzi gɔ̃ hã la, DNS dɔwɔƒe si woxɔ le amewo si (DNSChanger, . ghostDNS, . ZuoRAT, alo nutoa me tɔ aɖe dnsmasq spoofer) ate ŋu aɖo wò kadodoa ɖe lookalike server vɔ̃ɖi aɖe, axe mɔ na wò antivirus software be wòagawɔ ŋɔdzinu ƒe gɔmesesewo ƒe kɔpi o, alo aɖe alakpa "Router Firmware Update / Chrome Critical Update" popup si dea infostealer trojan ɖe wò kɔmpiuta dzi la afia.

Mègaŋe aɖaba ƒu ** kpata dzi o .NET::ERR_CERT_AUTHORITY_INVALID** nuxlɔ̃amewo, "Ge ɖe Wi-Fi Network me" captive portal popups siwo mèle mɔ kpɔm na o le wò ŋutɔ wò aƒeme Wi-Fi dzi, alo browser ƒe mɔfiame yeyewo ne èyi nyatakakadzraɖoƒe gãwo dzi. To nusi DNS-dɔdzikpɔla si wode asi na wò fifia atrɔ gbɔ tsɔtsɔ sɔ kple nyatakakadzraɖoƒea ƒe nyawo gbɔ kpɔnu si dzi nèka ɖo (1.1.1.1, . 8.8.8.8, alo 9.9.9.9), wò router ƒe WAN kple DHCP ɖoɖowo me dzodzro, OS kple browser DNS caches siwo me aɖi le la kɔklɔ, kple DNS-over-HTTPS (DoH) alo DNS-ɖe-TLS dzi (DoT), àte ŋu aɖe DNS ƒe amedzidzedze ɖa le miniti 10 teti me.

--- .

Wɔ esia fifia¶

1. MEGBE nàzi edzi GBEÐE o Advanced -> Proceed to [website] (unsafe) ne wò browser ɖe a NET::ERR_CERT_AUTHORITY_INVALID alo MOZILLA_PKIX_ERROR_SELF_SIGNED_CERT nuxlɔ̃ame le gadzraɖoƒe gã aɖe, e-mail, alo alilikpo me nyatakakadzraɖoƒe. Modern HTTPS (TLS 1.3) kple HTTP Ʋuɖoɖo ƒe Dedienɔnɔ Sesẽ (HSTS) nye wò ametakpɔnu mamlɛtɔ ne woxɔ wò DNS le amewo si: DNS-dɔdzikpɔƒe si woxɔ le amewo si la fia mɔ wò web-browser la yi amedzidzela la ƒe IP adrɛs dzi, eye wò web-browser lé alakpa la elabena amedzidzela la ƒe server melé Google alo Chase ƒe cryptographic private key vavãtɔ ɖe asi o. Ne èzi "Yi edzi to mɔ sia mɔ nu" dzi la, àtsɔ wò nyagbewo kple session cookies ade asi na amedzidzela la tẽ.
2. MÈGAÐE kɔpi alo awɔ a. GBEÐE o "Browser Update.exe / .dmg" alo nàŋlɔ wò Wi-Fi WPA2/WPA3 nyagbe ɣaɣla ɖe popup si adze zi ɖeka le wò aƒeme alo ɔfis Wi-Fi dzi. Ne router-hijacking malware (ghostDNS, . Roaming Mantis) trɔa wò router ƒe WAN/DHCP DNS servers ɖe nuvlowɔha ƒe IP adrɛs dzi, eƒe aɖaŋu #1 enye be wòatrɔ mɔ na HTTP axa ɖesiaɖe ƒe agba ɖe alakpa "Wò Google Chrome / Safari / Router Firmware is Out of Date" axa alo alakpa ISP ƒe gegeɖeƒe ƒe mɔnu.
3. Duƒuƒu sɛkɛnd 10 nslookup alo dig tsɔtsɔ sɔ kple wo nɔewo dodokpɔ le wò terminal me fifia be nàkpɔe ɖa be wò DNS server si li fifia le alakpa dam na wò hã. Ʋu Command Prompt alo Terminal eye nàtsɔe asɔ kple wo nɔewo nslookup google.com (si zãa wò router/OS DNS server si wode asi na wò fifia) ɖe nslookup google.com 1.1.1.1 (si biaa nya Cloudflare tẽ). Ne wò DNS dɔwɔƒe gbãtɔ nye dutoƒo IP adrɛs wɔnuku aɖe si le dukɔ bubu me si mèɖo kpɔ o, alo trɔa alakpa IP siwo to vovo kura na gadzraɖoƒe/antivirus domenyinyiwo la, ke woxɔa wò DNS.
4. Trɔ wò mɔ̃a ƒe DNS ɖoɖowo ɖe Encrypted DNS (DoH / . DoT le 1.1.1.1, . 9.9.9.9, alo 8.8.8.8) HAFI nàge ɖe wò router me alo agbugbɔ aɖo passwordwo. Elabena DNS-over-HTTPS (DoH) ɖoa domenyinyi didiwo katã ɖe encrypted me TLS Port 443 tunnel tẽe yi Cloudflare, Quad9, alo Google, DoH ʋuʋu le wò browser alo OS me gbãa ŋku na router alo ISP resolver alakpatɔ si woxɔ le amewo si enumake ale be nàte ŋu age ɖe nyatakakadzraɖoƒe ŋutɔŋutɔwo dedie ahakɔ wò network la ŋu.
5. Ge ɖe wò aƒeme/ɔfis router me to Ethernet ka si wotsɔ ka blae dzi (192.168.1.1 alo 192.168.0.1), lé ŋku ɖe wo ame evea siaa ŋu WAN / Internet DNS EYE LAN DHCP Server DNS fields, eye ne dutoƒo IP adrɛs siwo mènya o le wo dometɔ ɖesiaɖe me la, wɔ hardware 30-second Pin-Hole Factory Reset enumake. Malware si trɔa router DNS ƒe ɖoɖowo gena ɖe eme ɣesiaɣi kloe to ** si woɖe ɖe go dzi.Remote Web Management (WAN Admin)** melidzeƒe, a ** .UPnP (Universal Plug and Play)** melidzeƒe-yiyi ƒe se, alo esi woɖo ɖi admin/admin nyagbe ɣaɣla (kpɔ Aƒeme routerwo kple IoT dɔwɔnuwo ƒe dedienɔnɔ).
6. Kpɔ wò kɔmpiuta ƒe teƒea ɖa hosts faɛl kple Proxy/PAC ƒe ɖoɖowo (C:\Windows\System32\drivers\etc\hosts le Windows dzi alo /etc/hosts le macOS/Linux dzi) eye nàkɔ wò OS DNS cache la me. Ne wò router la le dzadzɛ 100 le alafa me hã la, local adware alo trojans le PC alo Mac ɖeka dzi ate ŋu agblẽ DNS ƒe nyametsotso le teƒea to IP redirects dodo ɖe... hosts faɛl alo ɖoɖo alakpatɔ aɖe Automatic Proxy Configuration (PAC) URL le Windows Internet Tiatiawɔblɔɖe me.

flowchart TD
    A["Wosusu be DNS Hijacking: Cert Nuxlɔ̃amewo, Aʋatso Update Popups, alo Nyatakakadzraɖoƒe Vodadawo Loading"] --> B["1. Na Encrypted DNS (DoH) nawɔ dɔ le Browser / OS me enumake be nàto aɖi resolver ŋu"]
    B --> C["2. Ƒu du Terminal Diagnostic: Tsɔ 'nslookup kpɔɖeŋu.com' sɔ kple 'nslookup kpɔɖeŋu.com 1.1.1.1'."]
    C --> D{"Ðe wògblẽa nu le mɔ̃ siwo katã le Wi-Fi la dzi ŋua, alo kɔmpiuta/telefon ÐEKA koe kpɔa ŋusẽ ɖe wo dzia?"}
    D -->|"Mɔ̃ siwo katã le Wi-Fi dzi la gblẽ nu le wo ŋu"| E["Router WAN/DHCP Hijack alo Rogue DHCP Server le LAN dzi"]
    E --> F["Kpɔ Agbo Gbãtɔ & DHCP Dɔdzikpɔla IP ('ipconfig /all'). Ne MAC/IP si mènya o -> Ðe Mɔ̃ Vɔ̃ɖiwo Ðe vovo"]
    E --> G["Hardware Factory Reset Router -> Trɔ Firmware -> Trɔ asi le WAN Admin & UPnP ŋu -> Ðo Router DNS ɖe 1.1.1.1 / 9.9.9.9"]
    D -->|"Kɔmpiuta alo telefon ÐEKA koe wògblẽ nu le"| H["Nutoa me Dɔwɔnu Hijack: Kpɔ Network Adapter Static DNS, Hosts Faɛl, Teƒenɔla / PAC Script & Browser Kekeɖenudɔwɔwɔwo"]
    H --> I["Klɔ '/etc/hosts' alo 'C:\\Windows\\System32\\drivers\\etc\\hosts', ɖe Root Certs alakpatɔ ɖa, eye nàkɔ DNS cache me"]

--- .

Diagnostic matrix: 5 laers afisi DNS kple network routing xɔa hijacked¶

Ne domenyiŋkɔ aɖe kpɔ egbɔ na server si mesɔ o la, amedzidzedzea le dzɔdzɔm le mɔ̃ɖaŋununya ƒe ƒuƒoƒo vovovo atɔ̃ siwo le nyametsotso ƒe kɔsɔkɔsɔa me la dometɔ ɖeka dzi. Zã kplɔ̃ sia nàtsɔ afia ƒuƒoƒo si ŋu wogblẽ nu le:

--- .

Akpa 1: Sekɛnd 60 ƒe Sedede-Fli DNS & DHCP Ʋɔnudrɔ̃nyawo me Dzodzro¶

Hafi nàgbugbɔ aɖo naneke la, ʋu terminal aɖe le wò kɔmpiuta dzi eye nàwɔ sedede siawo siwo sɔ pɛpɛpɛ siwo woate ŋu axlẽ ko be nàlé kpeɖodzi siwo fia be DNS server kple DHCP server siwo wò mɔ̃a le zazãm fifia.

1. Fesre 10 & Fesre 11 (Command Prompt alo PowerShell) .¶

# 1. Inspect your active Default Gateway, DHCP Server IP, and configured DNS Servers:
ipconfig /all

# 2. Check if any non-commented IP redirect lines exist in your local Windows hosts file:
findstr /V "^#" "%SystemRoot%\System32\drivers\etc\hosts" | findstr /V "^$"

# 3. Check if a rogue Proxy Server or Automatic Configuration Script (PAC) is hijacking browser traffic:
reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyEnable
reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyServer
reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v AutoConfigURL

# 4. Compare what your current default DNS server returns vs. Quad9 (9.9.9.9) and Cloudflare (1.1.1.1):
nslookup www.microsoft.com
nslookup www.microsoft.com 9.9.9.9

• Alesi woaxlẽ Afɔɖeɖe 1 ƒe emetsonu (ipconfig /all):
• Kpɔ ** ɖa.DNS Servers. Zi geɖe la, esia ɖea wò aƒeme router ƒe private LAN IP (192.168.1.1, . 192.168.0.1, . 10.0.0.1), dutoƒonyawo gbɔ kpɔla xɔŋkɔ aɖe si nèɖoe koŋ ɖo (1.1.1.1, . 1.0.0.1, . 8.8.8.8, . 8.8.4.4, . 9.9.9.9, . 208.67.222.222), alo wò broadband ISP vavãtɔ ƒe nutome DNS dɔwɔƒewo (ɖo kpe IP ɖesiaɖe si mènya o dzi le https://bgp.he.net alo ** .whois: ne IP la nye VPS hosting provider si me tu mele o si le dukɔ bubu me tɔ tsɔ wu wò ISP la, aɖi le wò DNS me).
• Kpɔ ** ɖa.DHCP Server** kple ** .Default Gateway**. Le aƒeme kadodowo ƒe alafa memama 99 dzi la,... DHCP Server IP kple... Default Gateway Ele be IP nanye nu ɖeka (e.g., evea siaa 192.168.1.1). Ne woto vovo (eye menye wò ŋutɔe tu Pi-hole alo Windows Server domain controller o) la, DHCP server alakpatɔ aɖe le asiwò le wò local network dzi.

2. macOS & Linux (Terminal) .¶

# 1. On macOS: Display all active DNS resolvers, search domains, and interface bindings:
scutil --dns | grep -E "nameserver|domain|interface"

#    On Linux (systemd-resolved / NetworkManager):
resolvectl status

# 2. Inspect the local /etc/hosts file for unauthorized redirects (anything other than 127.0.0.1 localhost / ::1):
grep -v '^#' /etc/hosts | grep -v '^$'

# 3. On macOS: Check if a malicious Web Proxy or PAC Auto-Config script is enabled on Wi-Fi:
networksetup -getwebproxy Wi-Fi
networksetup -getsecurewebproxy Wi-Fi
networksetup -getautoproxyurl Wi-Fi

# 4. Compare DNS answers and check DNSSEC authentication (ad flag) using dig:
dig www.google.com
dig @1.1.1.1 www.google.com +dnssec

3. Adedada Kple DHCP Server Gbegblẽ aɖe Ðeɖe Ðe Vo le Wò Nutoa Me Network Dzi¶

Ke ne ipconfig /all (alo ip route / . networksetup -getinfo Wi-Fi) ɖee fia be wò kɔmpiuta xɔ eƒe IP hayahaya kple DNS ɖoɖowo tso teƒea ƒe IP adrɛs si mènya o abe 192.168.1.142 le esi teƒe be nàzã wò router ŋutɔŋutɔ (192.168.1.1)? 1. De dzesi xɔtunua enumake MAC Adrɛs (Physical Address) kple mɔ̃ si nye ameflunuwɔla (192.168.1.142) to wò ARP kplɔ̃a me toto me:

# On Windows, macOS, or Linux, display the hardware MAC address mapped to the rogue DHCP IP:
arp -a

--- .

Akpa 2: Afɔɖeɖe ɖesiaɖe tsɔtsrɔ̃ ɖa na Router WAN/DHCP Hijacking¶

Ne wò agbalẽdzikpɔkpɔ le Akpa 1 lia me ɖo kpe edzi be wò Wi-Fi router le DNS adrɛs vɔ̃ɖiwo mam (alo be wotrɔ asi le wò router ƒe WAN DNS ememetɔ ŋu) la, ɖeko nàge ɖe router la me ahaŋlɔ 1.1.1.1 trɔ yi aɖaka la me mesɔ gbɔ o. Ele be nàtu afɔku si na amedzidzela la ge ɖe wò router me le gɔmedzedzea me:

Afɔɖeɖe 1: Wɔ Hardware 30-Second Factory Reset le Router la dzi¶

Nukatae wogbugbɔ ɖo dɔwɔƒe bliboa tsɔ wu be woatrɔ asi le DNS ƒe akpaa ŋu ko? Elabena router malware (ZuoRAT, . VPNFilter, . Cyclops Blink, . Mirai variants) tsɔa ɣaɣla kpena ɖe eŋu enuenu iptables NAT ƒe mɔfiame gbugbɔgaɖoɖo ƒe sewo (REDIRECT --to-ports 53), dea cron dɔ si nɔa anyi ɖaa ɖe /tmp alo NVRAM, alo naa adzɔge SSH/Telnet dzikpɔkpɔ akɔnta ɣaɣlawo wɔa dɔ. 1. Ðe router la ƒe WAN / Internet Ethernet cable (ka si tso wò fiber ONT alo cable modem me) ɖa ale be amedzidzela la mate ŋu agbugbɔ aɖo kadodoa me esime nèle eɖom o. 2. Ne router la le dɔ wɔm la, zi Reset pinhole button si le eme la dzi eye nàlée ɖe asi le router la ƒe megbe kple paperclip hena sɛkɛnd blibo 15 va ɖo 30 vaseɖe esime ŋgɔgbekpa dzi LEDwo katã naklẽ le ɣeyiɣi ɖeka me. 3. Lala miniti 3 hafi router la nagbugbɔ adze eƒe dɔwɔƒe ƒe nɔnɔme dzadzɛ me, emegbe nàtsɔ kɔmpiuta dzadzɛ aɖe aƒo ƒu to Ethernet ka dzi (alo dɔwɔƒea ƒe Wi-Fi sticker ƒe ɖaseɖigbalẽwo) eye nàge ɖe eme 192.168.1.1 (alo 192.168.0.1).

Afɔɖeɖe 2: Do 5 Router Settings Amedzidzelawo Exploit to Hijack DNS¶

Hafi nàgbugbɔ WAN / Internet ka la ade eme la, trɔ asi le ɖoɖo atɔ̃ siawo siwo wòle be nàwɔ ŋu le wò router ƒe administration console me (kpɔ míaƒe mɔfiame bliboa le Aƒeme routerwo kple IoT dɔwɔnuwo ƒe dedienɔnɔ hena sesẽme goglo): 1. Ðo 16+ Character Router Admin Password Tɔxɛ (MELE ɖeka kple wò Wi-Fi password o): Mègagblẽ router dzikpɔkpɔ ƒe gege ɖe eme me gbeɖe abe admin / admin alo admin / password. CSRF DNS-hijacking exploit kit ɖesiaɖe si le nyatakakadzraɖoƒea bua ɖaseɖigbalẽ siwo woɖo ɖi la le eɖokui si ne ètsɔ aflaga ƒe boblododo vɔ̃ɖi aɖe de wò web-browser me. 2. Ðo kpe edzi Remote Management / WAN Administration nye Strictly DISABLED: Kpɔ ete Advanced -> Administration -> Remote Management eye nàkpɔ egbɔ be ame aɖeke le dutoƒo internet dzi mate ŋu age ɖe wò router ƒe login page alo SSH/Telnet ports me tso WAN ƒe akpa dzi o. 3. Tɔwɔ nuwɔametɔe UPnP (Xexeame Katã ƒe Plug and Play): Le ete Advanced -> UPnP (alo NAT Forwarding -> UPnP), trɔ UPnP OFF. Malware si le mɔ̃ ɖesiaɖe si le wò aƒe me dzi zãa UPnP (IGD SOAP biabia) be nàde se na wò router le ɖoɖoezizi me be wòaʋu ʋɔtruwo alo atrɔ WAN ɖoɖoɖa sewo nyagbe aɖeke manɔmee. 4. DNS Servers (IPv4 KPL IPv6) siwo dzi woka ɖo, siwo xea mɔ na malware le Router la dzi: Yi Internet / WAN Setup -> DNS Server (kple LAN -> DHCP Server) eye nàtrɔ tso Get Automatically from ISP yi Zã DNS Server Siawo: * Alilikpo me ʋuʋu (1.1.1.1 for Families - Malware Blocking): IPv4 Gbãtɔ: 1.1.1.2 | IPv4 evelia: 1.0.0.2 (alo standard unfiltered 1.1.1.1 / . 1.0.0.1). IPv6: 2606:4700:4700::1112 kple 2606:4700:4700::1002. * Quad9 (Malware & Phishing Blocking + DNSSEC): IPv4 Gbãtɔ: 9.9.9.9 | IPv4 evelia: 149.112.112.112. IPv6: 2620:fe::fe kple 2620:fe::9. * Google Dutoƒo DNS: IPv4 gbãtɔ: 8.8.8.8 | IPv4 evelia: 8.8.4.4. IPv6: 2001:4860:4860::8888 kple 2001:4860:4860::8844. 5. Gbugbɔ do ka kple WAN Cable eye nàde Router Firmware Update Yeyetɔa Enumake: Ne wò router ƒe kpɔɖeŋua to ewɔla ŋu End-of-Life (EoL) ŋkeke eye megaxɔa dedienɔnɔ ƒe patches o (kpɔ Zero-day exploit kpata ƒe patching kple End-of-Life device isolation), ɖɔli router hardware enumake ale be womate ŋu agbugbɔ CVE siwo wonya siwo womeɖɔ ɖo o la awɔ dɔ etsɔ o.

--- .

Akpa 3: Kɔmpiuta si le nutoa me si me aɖi le la ŋu kɔklɔ (Hosts Faɛl, Adapter DNS, & Cache Flush) .¶

Ne èkpɔ wò router la ta (alo ne kɔmpiuta ɖeka koe woxɔ le ame si) vɔ la, wɔ sedede siawo pɛpɛpɛ be nàgbugbɔ aɖo wò kɔmpiuta si le mia gbɔ ƒe network stack eye nàkɔ DNS nuŋlɔɖi ɖesiaɖe si me aɖi le si wodzra ɖo ɖe cache me la ɖa:

1. Windows 10 / 11 DNS, Hosts, Winsock, & Browser Cache Reset bliboe¶

Ʋu Sedede ƒe Nyabiase abe Dɔdzikpɔla ene (Win + X -> Terminal (Admin) / Command Prompt (Admin)) eye nàƒu du:

:: 1. Reset all network adapters back to automatic DHCP DNS (removes static Trojan DNS overrides):
powershell -Command "Get-NetAdapter | Where-Object {$_.Status -eq 'Up'} | Set-DnsClientServerAddress -ResetServerAddresses"

:: 2. Disable any rogue Windows Registry Proxy or PAC AutoConfig script:
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyEnable /t REG_DWORD /d 0 /f
reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v AutoConfigURL /f 2>nul

:: 3. Flush the Windows OS DNS Resolver Cache, Winsock Catalog, and NetBIOS table:
ipconfig /flushdns
nbtstat -R
netsh winsock reset
netsh int ip reset

• Ne wò... C:\Windows\System32\drivers\etc\hosts faɛl si me fli siwo ŋu womeɖe mɔ ɖo o le: Ʋu Notepad as Administrator, ʋu C:\Windows\System32\drivers\etc\hosts, tutu fli ɖesiaɖe si womeyɔ o (Windows si le dzadzɛ si woɖo ɖi hosts file la le zero active uncommented fliwo, eye nyaŋuɖoɖo ƒe fli ɖesiaɖe dzea egɔme kple #), dzra faɛl la ɖo, eye nàƒu du ipconfig /flushdns.
• Kpɔ Rogue Root Ðaseɖigbalẽwo ɖa (certmgr.msc): Ne amedzidzela alo nutoa me kɔmpiutadziɖoɖo vɔ̃ɖi aɖe hã de aʋatso Root Certificate Authority (CA) ɖe wò kɔmpiuta dzi ale be woate ŋu axe mɔ na HTTPS ƒe ʋuwo evɔ womahe browser ƒe nuxlɔ̃amewo vɛ o, zi edzi Win + R, ŋlɔ ** .certmgr.msc**, keke Ke ƒe Ðaseɖigbalẽ Dɔwɔƒe Siwo Dzi Woka Ðo -> Ðaseɖigbalẽwo, ɖoe ɖe ɖoɖo nu Issued By alo Expiration Date, eye nàtutu ke ƒe ɖaseɖigbalẽ ɖesiaɖe si nède asi na ɖokuiwò si mènya o si mède dzesii o la ɖa.

2. macOS & Linux Blibo DNS Reset kple Cache Flush¶

# On macOS: Clear any static DNS overrides on Wi-Fi (reverts to DHCP) and flush mDNSResponder cache:
sudo networksetup -setdnsservers Wi-Fi Empty
sudo networksetup -setautoproxystate Wi-Fi off
sudo networksetup -setwebproxystate Wi-Fi off
sudo networksetup -setsecurewebproxystate Wi-Fi off
sudo dscacheutil -flushcache && sudo killall -HUP mDNSResponder

# On Linux (Ubuntu / Debian / Fedora with systemd-resolved):
sudo resolvectl flush-caches

3. Klɔ Wò Nyatakakadzraɖoƒe ƒe Socket & DNS Cache (Chrome, . Edge, . Brave, . Firefox) .¶

Mɔ̃ Vevi: Egbegbe web-browserwo léa woƒe wo ŋutɔ ƒe ememe DNS cache ɖe vovo eye woʋua TCP socket pool keŋkeŋ le wo ɖokui si tso ipconfig /flushdns. Ne èɖɔ wò router ɖo eye nèƒu du vɔ gɔ̃ hã ipconfig /flushdns, Chrome alo Edge ate ŋu ayi edzi anɔ wò ɖom ɖe amedzidzela ƒe IP dzi aɖabaƒoƒo 15 bubu vaseɖe esime nàkɔ browser la ƒe ememe cache me: 1. Le Chrome, Edge, alo Brave me: * Ŋlɔ ** .chrome://net-internals/#dns** (alo edge://net-internals/#dns) yi adrɛs ƒe akpaa dzi eye nàzi ** .Clear host cache. * Enumake zi ** dzi.Sockets le miame ƒe axadzinuŋɔŋlɔ (chrome://net-internals/#sockets) eye nàzi ** dzi.Flush socket pools** (esia wua HTTP/2 alo QUIC kadodo ɖesiaɖe si le dɔ wɔm si nɔa anyi ɖaa si gakpɔtɔ le ʋuʋu ɖi na amedzidzela ƒe IP). 2. Le Mozilla Firefox me: * Ŋlɔ ** .about:networking#dns** yi adrɛs ƒe akpaa dzi eye nàzi ** dzi .Clear DNS Cache. 3. Le Apple Safari (macOS kple iOS) me: * Le macOS dzi la, ʋu Safari -> Ðoɖowo -> Deŋgɔ, kpɔ ** .Show features for web developers, eye nàzi ** dzi.Develop -> Empty Caches** (Opt + Cmd + E), emegbe nàdzudzɔ eye nàgadze Safari gɔme ake. * Le iPhone alo iPad dzi la, trɔ Yameʋu ƒe Nɔnɔme ON hena sɛkɛnd 5 eye nàtrɔ ɖe megbe OFF, si zi iOS dzi mDNSResponder be nàkɔ eƒe DNS cache bliboa si me gblẽ la ŋu enumake evɔ màtutu wò nyatakakadzraɖoƒe ƒe nyatakaka siwo nèdzra ɖo la ɖa o.

--- .

Akpa 4: DNS Si Wotsɔ Nya Ɣla Ðo (DoH / . DoT) eyata router, amedzrodzeƒe, alo ISP aɖeke mate ŋu axɔ wò DNS la azɔ o¶

Nukatae nye DNS si wozãna tsã (UDP Port 53) ale gbegbe be wòle bɔbɔe na aƒeme router, kɔfidzraƒe Wi-Fi, alo ISP si ŋu wogblẽ nu le be wòatsa ŋku ahaxɔe le amewo si? Elabena wowɔ DNS si wozãna ɖaa le ƒe ƒe 1983 me (RFC 882) kple nya ɣaɣla zero kple kpeɖodzi zero: biabia ɖesiaɖe zɔa mɔ to ka la dzi le nuŋɔŋlɔ dzrowo me, eye mɔ̃ ɖesiaɖe si le mɔa dzi ateŋu awɔ aʋatso UDP ŋuɖoɖo le ɣeyiɣi si mede milisekɔnd ɖeka o me (DNS Spoofing).

To DNS-over-HTTPS (DoH, . RFC 8484) alo DNS-ɖe-TLS dzi (DoT, . RFC 7858), wò mɔ̃a xatsa DNS biabia ɖesiaɖe ɖe nya ɣaɣla si ŋu woɖo kpee me TLS 1.3 tunnel tẽe ayi egbɔkpɔnu si dzi woka ɖo gbɔ (Cloudflare 1.1.1.1, . Quad9 9.9.9.9, . Google 8.8.8.8, alo NextDNS). Ne router alo amedzrodzeƒe ƒe Wi-Fi alakpatɔ aɖe dze agbagba be yeatrɔ ŋuɖoɖoa la, TLS ƒe asidede agbalẽ te do kpo nu eye wò mɔ̃a gbe aʋatsokaka la enumake.

Ale Si Nàwɔ Awɔ DNS Si Wotsɔ Nya Ɣla Ðo (DoH / . DoT) Le Mɔ̃ Ðesiaɖe Dzi le Sɛkɛnd 60 Me¶

--- .

Nya siwo wobiaa amewo enuenu¶

Nukatae nye browser ɖee fia NET::ERR_CERT_AUTHORITY_INVALID le google.com alo nye gadzraɖoƒe esime woxɔ nye router ƒe DNS?¶

Browser ƒe vodada ma na nègafi wò akɔnta ŋutɔŋutɔ o. Ne amedzidzela aɖe xɔ wò router ƒe DNS ɖoɖowo la, wotrɔa IP adrɛs na... `www.yourbank.com` eyata wò kɔmpiuta doa ka kple amedzidzela la ƒe web server tsɔ wu be wòado ka kple wò gadzraɖoƒe ŋutɔŋutɔ. Gake ne wò web-browser dze HTTPS si wotsɔ nya ɣaɣlawo ŋlɔe gɔme (`TLS`) asiléle kple amedzidzela ƒe dɔwɔƒe, amedzidzela ƒe dɔwɔƒe mate ŋu awɔ dijitaal TLS ɖaseɖigbalẽ si sɔ si dzi Ðaseɖigbalẽ Dɔwɔƒe si dzi woka ɖo de asi ete le nya ɣaɣla me na `yourbank.com`. Wò web-browser la tɔa kadodoa enumake eye wòɖenɛ fiana `NET::ERR_CERT_AUTHORITY_INVALID`. Zi alesi mèzi "Yi edzi to mɔ sia mɔ nu" gbeɖe o eye mède Root Certificate alakpatɔ aɖeke ɖe wò kɔmpiuta dzi gbeɖe o (`CA`) ɖe wò mɔ̃a dzi la, DNS ƒe amedzidzedze ɖeɖe mate ŋu aɖe HTTPS nyatakakadzraɖoƒe si HSTS kpɔ ta na la gɔme alo aflue o.

Aleke hacker aɖe wɔ trɔ DNS ƒe ɖoɖowo le nye aƒeme Wi-Fi router me evɔ menya nye Wi-Fi password o?¶

Mehiã be amedzidzelawo nanɔ Wi-Fi ƒe didime si le wò aƒea me hafi atrɔ wò router ƒe DNS ɖoɖowo o. Wozãa mɔnu eve siwo wozãna le didiƒe: gbãtɔ, bots siwo wowɔna le wo ɖokui si (`Shodan` / . `Censys` scanners kple botnets) skan dutoƒo IP adrɛs ɖesiaɖe si le internet dzi hele aƒeme router siwo si **Remote Web Management (`WAN Admin`)** alo ** .`UPnP`** wogblẽe ɖi wòʋu kple firmware ƒe afɔku siwo wonya. Evelia, ne wotu WAN Admin gɔ̃ hã la, ne ègblẽ wò router ƒe ememe dzikpɔkpɔ ƒe nyagbe ɣaɣla ɖe dɔwɔƒea ƒe ɖoɖo si woɖo ɖi (`admin / admin` alo `admin / password`), ne èzi boblododo alo nyatakakadzraɖoƒe vɔ̃ɖi aɖe dzi le wò kɔmpiuta dzi ana JavaScript ɣaɣla si le wò web-browser me naɖo **Cross-Site Request Forgery (`CSRF`)** alo **DNS Rebinding** biabia tẽ tso wò kɔmpiuta dzi yi `http://192.168.1.1`, gege ɖe wò router la me tso eme eye nàgbugbɔ aŋlɔ wò DNS ƒe ɖoɖowo le ɖoɖoezizi me.

Ne mewɔ Encrypted DNS ( .DoH) le Chrome alo Firefox me la, ɖe ema kpɔa dɔwɔnu bubu siwo le nye kɔmpiuta dzi ta?¶

DNS Dedie ƒe Dɔwɔwɔ (`DoH`) le Chrome, Edge, Brave, alo Firefox me tsɔa nya ɣaɣlawo ɣlana ɖe DNS didi siwo katã wowɔ **le web browser ma koŋ me** me hekpɔa wo ta, si xea mɔ na ameflunyawo ƒe asitɔtrɔ siwo wotu ɖe web-browser dzi kple aʋatso asitɔtrɔ ƒe axawo enumake. Gake megbenyawo ƒe dɔwɔnu bubu siwo le wò kɔmpiuta dzi (abe wò email client, Slack, fefewo, alo OS updater ene) gakpɔtɔ zãa dɔwɔɖoɖoa ƒe system-wide DNS resolver negbe ɖe nèɖo Encrypted DNS hã ɖe dɔwɔɖoɖo ƒe ɖoɖo nu (to Windows 11 Native DoH, Android Private DNS dzi `DoT`, alo macOS/iOS Encrypted DNS profile si wode asi ete) eye nàɖɔ wò router ƒe WAN/DHCP DNS ɖoɖowo ɖo.

Nukae nye vovototo si le wo dome 1.1.1.1 (Alilikpo me ʋuʋu) kple 9.9.9.9 (Quad9), eye wo dometɔ kae wòle be matsɔ ade nye router me?¶

Wo ame evea siaa nye xexeame katã ƒe anycast DNS resolver siwo zɔna kabakaba, siwo dea bubu ameŋunyatakakawo ŋu, womekplɔa wo ɖo o, siwo habɔbɔ siwo ŋu ŋkɔ le zãna, eye wo dometɔ ɖesiaɖe akpɔ tawò tso ISP alo rogue-router hijacking me. Dzidzenu ** .`1.1.1.1`** (Alilikpo ƒe keklẽ) kple ** .`8.8.8.8`** (Google) trɔa DNS ŋuɖoɖo dzadzɛ siwo womeɖe o na domenyinyi ɖesiaɖe le internet dzi. ** ** .`9.9.9.9`** (Quad9 Foundation si mekpɔa viɖe aɖeke tso eme o ye kpɔa edzi) kple **`1.1.1.2`** (Cloudflare for Families - Malware Blocking) le eɖokui si cross-check domenyiŋusẽfianu ɖesiaɖe didi ɖe ɣeyiɣi ŋutɔŋutɔ me xexeame katã ƒe ŋɔdzidoname-nyatakaka nuɖuɖu siwo wonya le phishing nyatakakadzraɖoƒewo, ransomware sedede-kple-dziɖuɖu (`C2`) servers, kple infostealer domains, si xea mɔ na kadodoa le DNS layer la dzi hafi axa vɔ̃ɖi aɖe nate ŋu axɔ agba gɔ̃ hã.

--- .

Mɔfiame siwo do ƒome kplii¶

• Aƒeme routerwo kple IoT dɔwɔnuwo ƒe dedienɔnɔ
• Dutoƒo Wi-Fi, Evil Twin hotspots, kple USB detsiƒonu-jacking ametakpɔnu
• Browser ƒe kekeɖenudɔ vɔ̃ɖiwo, clipboard hijackers, kple adware ɖeɖeɖa
• Zero-day exploit kpata ƒe patching kple End-of-Life device isolation
• Domain ŋkɔwo xɔxɔ, DNS si ƒe ɣeyiɣia wu enu, kple nyatakakadzraɖoƒea xɔxɔ
• Xexeame katã ƒe xexlẽdzesi siwo ku ɖe nudzɔdzɔ kpatawo ŋu

--- .

Wolé ŋku ɖe dzɔtsoƒewo ŋu¶

• Internet Dzi Dedienɔnɔ Kple Dɔwɔƒewo ƒe Dedienɔnɔ Dɔwɔƒe (CISA) & Dukɔa ƒe Dedienɔnɔ Dɔwɔƒe (NSA) (United States): Internet Dzi Dedienɔnɔ Ŋuti Nyatakakagbalẽvi (DNS (PDNS) Dɔwɔƒe si Kpɔa Ame Ta Tiatia kple DNS Siwo Woɣla Zazã DoH / . DoT le Dɔwɔƒewo Kple Aƒeme Nɔnɔmewo me).
• Internet Mɔ̃ɖaŋudɔwo ƒe Dɔwɔha (IETF) (Dukɔwo Dome): RFC 7858 (DNS ƒe Nyatakaka tso Ʋuɖoɖo ƒe Ƒuƒoƒo ƒe Dedienɔnɔ dzi DoT), RFC 8484 (DNS Nyabiasewo to HTTPS dzi DoH), kple RFC 9462 (Nyatakpɔnu Siwo Wotia ƒe Kekeɖenuŋu DDR).
• ICANN ƒe Dedienɔnɔ Kple Liƒo ƒe Aɖaŋuɖoha (SSAC) (Dukɔwo Dome): Aɖaŋuɖoɖo le DNS Dɔwɔƒewo ƒe Tɔtrɔ, Router WAN ƒe Ðoɖowɔwɔ Gbugbɔgaɖɔɖo, kple DNSSEC ƒe Dzesidede Ŋu.
• Dukɔa ƒe Internet Dzi Dedienɔnɔ Dɔwɔƒe (NCSC) (United Kingdom): DNS Xɔtuɖaŋu Takpɔnu Kple DHCP Gbegblẽwo Kple Nutoa Me Nyatakakadzraɖoƒewo ƒe Amedzidzedzewo Dzi Ðeɖe Akpɔtɔ.