Ok so apparently that wasn't the place the pointer is hosted,
sudo killall -INFO mDNSResponder
dump the cache records to /var/log/system.log, but the record I'm looking for isn't there.
The issue is, only one computer in my network resolve an address (subdomain.mydomain.com) to a specific IP address that I'm not familiar with and looks like it might be phishing or some other scam\worm.
mdnsresponder didn't show this record, and /etc/hosts looks clean.
do you have any other suggestions where to look?
is there any command I can use to resolve an address to IP (like "ping") but to also show me where this record is hosted ("who" translate the address) ?
Many thanks!