DNS manipulation attacks can be implemented by different kinds of malicious actors, with the purpose of luring the victim into a different webpage compared to the one that was originally meant to be visited. However, the content of the malicious page can vary depending on the attacker’s reasons, which span from credentials theft to censorship. During the years, different kinds of methodologies have been proposed to identify when such attacks happen. One of the latest heuristics consist in exploiting information obtained by X.509 certificates, which can indicate if a manipulation attack has been put into place. This work focuses on DNS manipulation attacks implemented with the purpose of hiding domains and censoring them, typically implemented by malicious DNS resolvers.