Automatic detection of DNS manipulations