DNS Anomaly

DNS is the directory your device uses to turn a name like your-bank.com into an IP address. A DNS anomaly is an unexpected change to which resolver your device is trusting for those lookups.

If an attacker controls your DNS, they can quietly send you to servers they control — even for sites you type correctly. That makes a resolver change one of the clearer fingerprints of an evil-twin or man-in-the-middle setup.

The directory your device trusts to find websites has been quietly swapped.

On a network they control, an attacker hands out their own DNS server through DHCP, or intercepts DNS traffic and answers it themselves. Even when they forward queries so resolved names look correct, the resolver doing the answering has changed — and that change is detectable even behind a transparent DNS proxy.

WifiThreatWatch reads the system’s DNS resolver and remembers a per-network baseline. A change to the resolver that isn’t explained by the app’s own actions is flagged as a high-severity DNS anomaly, once per unique value, then re-baselined.

On its own, a DNS-only mismatch is treated as “soft” — too unreliable to disconnect you over by itself — so it’s surfaced as a warning rather than a full alarm. Combined with a BSSID or gateway mismatch, it becomes part of a confirmed evil-twin alert.

When you connect through Active Defense, your traffic — including DNS — routes through the encrypted tunnel, out of the attacker’s reach.