A junior administrator reported that the website used for anti-malware updates is not working. The senior administrator then discovered all requests to the anti-malware site are being redirected to a

Data Loss Prevention (DLP) tools are designed to prevent sensitive data from leaving the organization's network, not to diagnose website redirection issues.

A File Integrity Monitor (FIM) tracks changes to critical system files and configurations; while a hosts file change could be detected by FIM, a network sniffer would more directly reveal the redirection behavior itself, regardless of its root cause (e.g., DNS server compromise, router compromise, hosts file, proxy).

A port scanner identifies open ports on a network device, which is not directly relevant to diagnosing a website redirection issue.

A sniffer, also known as a packet analyzer or network monitor, allows the senior administrator to capture and examine network traffic, including DNS requests and HTTP/HTTPS traffic. This will help identify if the redirection is happening at the DNS resolution stage (e.g., DNS poisoning) or at the HTTP redirection stage, pinpointing the cause of the malicious redirection.