So I just tried Safer.com and some other DNS leak test sites and they report that if I have Web Protection enabled on my iPhone, then I am on a DNS server from Cisco OpenDNS LLC. If I disable web protection, it is report that I am on a DNS server from my ISP. No Sign of this Malaysian IP anywhere else but the Network Analyser app.
I have also tried on my Mac and it is weird. One time it is report that I am on a DNS from my ISP and other time report that I am on a DNS from Avast.
In the mean time, I have also booted up my old Linux desktop and nor Firefox and Chrome wanted to let me visit google.com or avast.com because my connection was not secure. The Linux desktop has no protection or VPN or anything, connected with ethernet to my router directly similar to my Mac but I did not had this problem with my Mac which is protected by Avast. After updating and restarting, the problem was solved on my Linux desktop and safer.com reported I am on a DNS from my ISP.
At this point I am really lost, I guess I give up if I am hacked there is noting I can do about it, Avast was my attempt to avoid being hacked.
If anyone could share ideas how to know for certain if I am hacked and could also answer the following questions I would appreciate that.
Is it normal for Avast to use this 121.121.121.121 Malaysian IP? As I get this IP in the network analyser app only when I have Avast Web protection enabled on my iPhone.
Could this 121.121.121.121 IP just a local IP on my local network to point to the Avast VPN settings? As it is shown only in the Network Analyser app on my iPhone, nowhere else.
Is it normal for Avast to use a DNS server from Cisco OpenDNS LLC? As I am connected to this DNS only when I have Avast Web protection enabled on my iPhone.
Thanks in advance.