My router is always left on but I only log in to the ISP when I want. I usually do this by just issuing a "ping www.bbc.co.uk" at a terminal window. There's a few secs delay and I see the router light come on and then window shows the usual with the IP address and times.
Here's the problem.
I see an indication for the IP address _before_ the router logs in and this IP address is _not_ the BBC's. A whois lookup only shows it as part of a block in America. That is, instead of the window just showing my ping command only and _then_ when login has happened the IP and times show up, I _immediately_ see this -
ping www.bbc.co.uk (aa.bb.cc.dd) with bytes of data
the () brackets IP is the rogue address and normally no address is shown at this stage.
I have the ISP's DNS set in the router.
Is this a case of poisoned DNS or could there be a malware issue?