add dns hijacking observation