Loading vulnerability page...

Interactive attack atlas

Choose any tab from the left. This walkthrough shows how a poisoned DNS answer can quietly send a user to the wrong place.

DNS spoofing Cache poisoning Misdirection
How to do it
Misdirection attack

DNS Spoofing / Cache Poisoning

Watch a normal DNS question get answered with a lie, redirecting the user to a fake website.

Story animation
Press play to follow the DNS lookup from question to fake destination.
User PC The browser wants the right address
Where is google.com?
google.com → 6.6.6.6
DNS lookup lane
DNS server Trusted cache answers
Hacker PC Injects poisoned data
Race the real answer
Fake IP entry: 6.6.6.6
https://google.com

Real website

This is the legitimate destination the user expected, but it stays out of reach in the background.

Fake login page

The user sees a familiar-looking page, even though the route was poisoned earlier.

Email
Password
Credentials at risk

Misdirected trust

The user typed a correct name, but the poisoned DNS answer quietly changed the destination and led them to the attacker-controlled site.

Press play to see a DNS question become a poisoned redirect.

Quick understanding

1. The user asks where a trusted website is located.
2. A poisoned DNS cache gets fed a fake IP before the real answer arrives.
3. The wrong IP is returned to the browser as if it were legitimate.
4. The browser opens a fake site while the correct URL still looks familiar.

Real tips to reduce risk

Use trusted resolvers and secure DNS options such as DNS over HTTPS or DNSSEC where available.
Understanding

DNS spoofing changes the answer to a lookup. The user can type the correct site name but still be routed somewhere malicious.

Why it matters

It breaks trust at the routing layer, so users may land on convincing fake pages before they realize anything is wrong.

Defense mindset

Protect DNS trust with secure resolvers, HTTPS validation, DNSSEC-aware infrastructure, and careful warning handling.

Common signs

Unexpected logins, certificate warnings, wrong pages behind familiar names, or traffic heading to strange IPs can all be clues.

DNSPoisoningFake IPHTTPS