we have one computer in ours network that constantly send to 220.127.116.11 dns requests. I see this in Fortigate forward traffic log and the user of that computer have to solve reCAPTCHA a few times in hour when he use google search. This computer is a notebook with two network card, one is usually connected to ethernet LAN (fortigate) and wi-fi network card is usually connected in the same time to guest network from other SOHO router (with is send through DHCP 18.104.22.168 as main DNS).
My question is how to find with app/process on that computer send this unusually DNS request to 22.214.171.124?
So I do some checks. The case is definitely related with enabled and connected wi-fi network card. When I change SOHO router DHCP configuration to send different DNS configuration (not 126.96.36.199 but DNS server of my local internet service provider) in Fortigate forward trafic log there are now entries with source of ethernet IP address(and MAC) and destination to DNS server of my local internet service provider.
It is look like some process/app take DNS configuration from wi-fi and send request through ethernet.
Sysmon doesn' t show any unusually dns query. Any ideas?