Recently a lot of communications spread starting from this analysis: OSX/MaMi analysis
When I read this analysis, I found that 2 DNS servers are defined as default ones for the IP configuration:
82.163.143.135
82.163.142.137
I discovered that these 2 addresses belongs to an Israelian company:
(see: IP info)
who developped a product GreenTeamDNS
to filter Internet accesses based on whitelist and blacklist upon DNS traffic requests. Thus, this software is clearly using DNS servers redirections.
I further tested these 2 addresses and they correctly reply as plain DNS servers or relays.
From your critical point of vue, which analysis is the right one?