Is My ISP Spying on Me? How to Check DNS Manipulation, DPI & SSL Hijacking on Android (Free)
Posted on25 August 2026
Your Internet Service Provider (ISP) can see every website you visit, every app you use, and every connection your phone makes. Most people know this in theory — but few ever check whether their ISP is actively manipulating their traffic.
Some ISPs go further than passive logging. They redirect your DNS queries to inject ads. They use Deep Packet Inspection to read your data. They perform SSL certificate hijacking to intercept encrypted traffic. Some of this can be checked from the phone itself. Some of it cannot, and it is worth knowing which is which.
What Your ISP Can Actually See (And Do)
Before we get to detection, here’s what ISPs are technically capable of:
DNS Manipulation: Every time you type a website address, your phone sends a DNS query — essentially asking “what’s the IP address for google.com?” Your ISP controls the default DNS server. A manipulating ISP can redirect these queries to inject ads, block websites, or track every domain you visit.
Deep Packet Inspection (DPI): Even for encrypted traffic, your ISP can see the size, timing, and destination of every packet. DPI goes further — on unencrypted connections, ISPs can read the full content. Some ISPs use DPI to throttle streaming services, block competitors, or sell your browsing data.
SSL Certificate Hijacking (MITM): The most dangerous attack. If a certificate authority you did not choose is trusted on your phone — installed by a work profile, an app, or someone with access to the device — whoever runs the network can present its own certificates, decrypt your “secure” HTTPS connections, read the plaintext, then re-encrypt it. Some apps still show a working connection while this happens.
Transparent Proxy: Your traffic gets routed through an ISP-controlled proxy without your knowledge. The proxy can cache, modify, or log all traffic passing through it.
How DeviceGPT Checks Your Network
DeviceGPT runs a set of network checks from your phone. Each result also feeds the Network Trust section (35%) of its 0–100 Zero Trust security score. They are practical checks of the network you are on right now, not proof of what your ISP does with your data.
Check 1: DNS integrity
DeviceGPT asks more than one public DNS resolver (Google and Cloudflare) for the same names and compares the answers. A warning means:
- The address returned for a well-known domain does not match what the public resolvers return
- A lookup comes back pointing at a redirect or block page instead of the real site
What it means if it fails: something on the network may be rewriting DNS answers. Solution: enable Private DNS (DNS-over-TLS) in Settings > Network > Private DNS, or use a VPN.
Check 2: SSL certificate
DeviceGPT opens an HTTPS connection to google.com and checks who issued the certificate it receives. Google's certificates come from Google's own certificate authority. If a different issuer shows up, something between you and Google is presenting its own certificate.
What it means if it fails: a man-in-the-middle on your HTTPS connections is likely — on a work network this can be a company inspection proxy, anywhere else it is a reason to stop using this network for anything sensitive.
Check 3: Transparent proxy
DeviceGPT makes a plain HTTP request and looks for headers that proxies add on the way, such as Via and X-Forwarded-For. If they are present, your traffic is passing through a proxy you did not configure.
Check 4: Wi-Fi sign-in page (captive portal)
Hotel, airport and café networks often redirect you to a login page. DeviceGPT checks whether the connectivity test is being redirected, so you know when a network is intercepting your traffic before you have even logged in.
Check 5: Private DNS status
Are you already protected? DeviceGPT checks whether Private DNS (DNS-over-TLS) is active on your device — the simplest protection against DNS manipulation.
What it does not detect: deep packet inspection
A phone app cannot reliably tell whether your ISP runs deep packet inspection, so DeviceGPT does not claim to. Its ping check only tells you whether packets reach 8.8.8.8 without loss. If you are worried about DPI, assume it is possible on any network you do not control and use a VPN.
Speed Test
DeviceGPT measures download speed by fetching a 10MB file from Cloudflare's network, so the result reflects a real download rather than a single quick ping.
You also get:
- Latency and jitter measurements (important for video calls and gaming)
- WiFi signal strength
- IPv4 and IPv6 details
- VPN detection (is your VPN actually connected?)
Service Reachability Testing
DeviceGPT tests whether ten common services answer from your network, trying each several times so an intermittent failure does not hide behind one lucky check:
- Google, YouTube, Google Drive
- WhatsApp, Telegram, Instagram
- GitHub, Google DNS, Cloudflare DNS (1.1.1.1), Cloudflare's speed test
If any do not answer, you see which ones, which helps you tell a blocked service from a dead connection.
What To Do If Checks Fail
| Problem | Solution |
|---|---|
| DNS manipulation | Enable Private DNS: Settings > Network > Private DNS > “dns.google” or “1.1.1.1” |
| SSL certificate warning | Stop using this network for anything sensitive. Use mobile data or a trusted VPN |
| Transparent proxy | Use a VPN, and prefer HTTPS sites |
| Worried about DPI | Use a VPN. No phone app can confirm DPI either way |
FAQ
Q: Is this legal to run? A: Yes. You’re testing your own connection to check what’s being done to your traffic. You’re not intercepting anyone else’s data.
Q: Does this work on mobile data (not just WiFi)? A: Yes. Run it on both WiFi and mobile data — your mobile carrier and WiFi ISP may behave differently.
Q: Does DeviceGPT send my network data anywhere? A: The checks themselves contact public servers (Google and Cloudflare) from your phone. Scan scores and your phone model go to DeviceGPT's global leaderboard; the full report is shared only if you tap Ask AI. The app's source is on GitHub.
Q: My ISP says they don’t do any of this. Should I trust them? A: Run the checks and see for yourself. ISPs have been documented redirecting failed DNS lookups to their own search and ad pages.
Download
Free. No root required. Open source.
Checks for DNS manipulation, a substituted SSL certificate, transparent proxies and Wi-Fi sign-in pages, and shows which DNS servers you are actually using.
Install free on Google PlaySee what it does →