the hotspot was pwned and abused

this is a more detailed, and first order account of things from reliaquest itself.

https://reliaquest.com/blog/threat-spotlight-dns-poisoning-t...

apparently a full funnel VPN policy prevents the workflow.