My router have been hacked by this IP (74.82.207.26), I found that the dns changed from 8.8.8.8 to 74.82.207.26 and this will just happen if someone have the admin password of the router and this will just happen by brute force. after that I secured my router access with just local network ips. the ip 74.82.207.26 belong to caratnetworks in Canada so I emailed them to the abuse email.
**be careful of this way, it can log you to fake website and save your passwords **