They will analyze your digital modus vivendi (e.g. what's sites you use most etc) and by exploting DNS they will forward you to a mock site that looks in every way to identical but is designed to drop malware.

One time I connected to youtube and sure enough netstat revealed some IP in virginia instead of the normal google one.

Also if you find this IP in your logs: 172.31.254.146 you being targetted for information