all DNS queries are spoofed to 50.67.238.234