[ars_technician]

What aren't you getting? The query for Facebooks server may use the ISPs DNS server, but that's not the problem. It's when dig's request is actually sent to that resolved address that the ISP intercepted the request.

That's exactly what that dig '@' symbol does. Why are you contending the very basic functionality of dig? Instead of a glib remark devoid of any evidence, I will provide you a link so you can understand. Read the first line of the synopsis of the man page: http://linux.die.net/man/1/dig

The server after the @ symbol is the one the DNS query for 'Google.com' is sent to, which is the IP address of www.facebook.com. That is the packet that is being hijacked. Get it?