I found unusual behaviour that Norton ConnectSafe DNS servers responded an IP address hosting search.dnsadvantage.com to a google drive server doc-0g-1k-docs.googleusercontent.com.
[Reproduce]
$dig @199.85.126.30 doc-0g-1k-docs.googleusercontent.com
doc-0g-1k-docs.googleusercontent.com. 600 IN A 156.154.176.217
156.154.176.217:443 is hosting search.dnsadvantage.com
[Note]
I verified that the DNS server responded the same IP address to the DNS query from some online DNS query tools. So the cause may not be related to my local environment.
https://toolbox.googleapps.com/apps/dig/#A/doc-0g-1k-docs.googleusercontent.com@199.85.126.30
doc-0g-1k-docs.googleusercontent.com. 600 IN A 156.154.176.217
My laptop is in Japan and I have no idea if this behaviour is region specific or not. It is not possible to figure out if my DNS query to 199.85.126.30 is intercepted or not...
[Workaround] Use other DNS server such 8.8.8.8.
Any idea to solve this issue?