What are the signs that your router is hacked? Ads popping up on the webpage, secretly uploading in the middle of the night—I checked the backend and found these five issues

Last week, my

friend Old Li contacted me and said that whenever I open a certain website at home, casino ads pop up in the bottom right corner—just one after another. Even more bizarre, when he was at work during the day and no one was home, the carrier app showed he had uploaded 47GB in the morning. He tried the phone antivirus three times and it was clean, then suspected it was a broadband issue and almost called for repair.

first distinguish: is it being freeloaded, or is the router itself hacked

are two different things. Riding on the internet means your neighbor connects to your WiFi, but it's about using data. Changing the password usually solves the problem. I wrote an article about how to prevent internet use; just follow the instructions ( the article about catching the thief first and then blocking the door ). Being hacked means someone has accessed the router's backend from an external network, essentially occupying your house as a base. If you change the WiFi password, you can't drive them out—you have to run through the whole device.

here's a simple way to judge: turn off WiFi on your phone to use data and open the same website. The data is spotless, and as soon as the home WiFi pops up, the problem is mostly on the router side, not the phone or the website. Old Li tried it. Under data and watching for ten minutes, nothing happened, but on WiFi, it popped up every three seconds. At this point, you can access the backend.

first point: DNS settings—the main culprit behind ads popping up is usually here

DNS is a translator who translates the website address into an IP address. When you baidu.com it, it tells your phone which address to connect to. The hijacking tactic is simple: they point your DNS to an address controlled by a bad actor, and no matter which website you visit, they first pass it through and insert a segment of ad code into the page before forwarding it to you. The website itself is fine; the ads were inserted halfway.

the 192.168.1.1 backend, find two places: the router's own DNS in WAN port settings, and the DNS sent to all Home devices in DHCP settings. Different brands have different menu names, so scrolling through pages like "Network Parameters" or "DHCP" is definitely the right choice. On Old Li's machine, the DHCP issue section was changed to an unfamiliar overseas address starting with 45—meaning all FamilyMart phone URLs were translated from someone else's server, and ads were inserted from there.

verification, there's a command-line method: on your computer, type nslookup baidu.com. If the parsing server shown in the first two lines isn't your own 223.5.5.5, then it's been tampered with. Switching back is very convenient: enter DNS 223.5.5.5 and 119.29.29.29, save and restart the router. After Lao Li finished fixing it, he refreshed on the spot, and the ads were gone. There are more nuances to DNS—which should be filled in and which shouldn't. I previously wrote a separate article (DNS the configuration article ).

Second place: Remote management switches, demolition scripts scan your door every day

How was

DNS changed? The main suspicion is that remote management on the WAN side is enabled, with a weak password attached.

router has a feature called remote management, while others call it WEB remote management or WAN port management. Once enabled, you can access your router's login page from the external network. With it on, all scanning scripts from across the internet can knock on your door. The 2016 Mirai virus infected over 600,000 devices overnight. Routers and network cameras were the hardest hit areas, relying on Telnet's ports 23 and 2323 paired with a weak password dictionary, and the admin/admin combination was broken in seconds. The next year, the variant released quickly sold 100,000 home routers. These scanning scripts are still running online today. It's normal for your router's public IP to be scanned hundreds of times a day, but most doors are closed.

many new machines, this switch is off by default, but some older firmware versions are left on, while others are turned on by installers for convenience. Go to the backend menus like "System Tools" and "Security Management," find Remote Management, and confirm it is turned off. Old Li's old TP had remote management enabled, and the password was set by the installer—123456 cracking this kind of password required no skill, just scripts running overnight.

Old Li's machine left a solid evidence: checking the system logs in the background, from 2 a.m. to 5 a.m., every few dozen seconds, a login failure record appeared, densely swiped through several pages. This is what a script looks like when knocking on the door—a normal home router's logs shouldn't show any login attempts from external networks; even just one is worth a second glance. How to read logs and what keywords to use—I wrote about the routine in the article on running logs, but I won't elaborate here.

By the way, what should you do first after logging into the backend? I've written about five security settings for beginners ( the first is to change the default password), won't be repeated here.

Third point: Port forwarding and UPnP mapping lists—not the ones you made are the most critical issues

After

access the backend, the intruder's next step is to leave a backdoor: add a port forwarding or trigger a UPnP mapping, so next time they can enter directly through this route without guessing passwords.

flip through the two list pages: "Port Forwarding" (sometimes called virtual server) and "UPnP". Unfamiliar entries, external ports you don't remember opening yourself—especially thousands or tens of thousands of high-level ports pointing to a specific device on the internal network—these are all worth being wary of. Old Li's port forwarding list contained a rule that forwarded over 50,000 external ports to his own computer, which he had never set himself, so he deleted it. How dangerous are these types of holes, and how to use them safely? I've written one each about port forwarding and UPnP ( port forwarding , UPnP ).

UPnP delete entries in the list that you don't recognize. For devices you really need, like PS5 or NAS, it will automatically reapply, so it's no problem.

Fourth and Fifth Locations: Accounts uploaded late at night, plus passwords and firmware locks

no one uploaded 47GB during the day, this account was checked in the backend. The running status page has traffic statistics. How to read this field I wrote about in the status page article ( explain the six fields one by one ). The total upload volume of the Lao Li router backend matches the curve of the carrier app, indicating that traffic indeed follows this route. Roughly speaking: if you don't have a NAS, no surveillance, no cloud storage at home, the upward curve during empty daytime hours should hover at zero year-round; With these devices, they should be just scattered little bumps, definitely not a flat line stretching tens of megabytes without letting go. Old Li's family line held on from nine in the morning without letting go, all the way until he got home from work.

routers that are taken over are generally assigned two types of tasks: one is acting as a proxy, where other people's traffic passes through your home and you earn money from selling nodes; Second, to act as a springboard to attack others. Proxy manipulation is the most common because it is the most stable and hard to detect.

device list is also casually scanned; if all the names are familiar, that's fine. If unfamiliar devices appear, it's just a freeloading route—another article will handle it. Then there are two old locks: don't use 123456 for management passwords, birthdays, phone last digits, what kind of password counts as qualified, and how to set default passwords ( 90% of machines don't recognize admins anymore); When firmware is upgraded to the latest version, once vulnerabilities in old firmware are exposed, it's like everyone has a door key. I've written separately about whether firmware upgrades can enable automatic software ( have suffered losses in that ).

really got caught: treatment sequence and recurrence prevention

Old Li's unit ultimately followed this order, just copying it: first, unplug the WAN port and cut off the external cable; Go to the backend, copy down your broadband account password, export a backup configuration to save on your computer ( how to configure backups ); Change DNS back to 223.5.5.5, delete unfamiliar port forwarding, turn off remote management, change the management password to a 16-bit hybrid, and upgrade the firmware to the latest version; after all changes, plug it back into the WAN port. The whole process lasted half an hour, no ads appeared again, and the upload curve for the next day flattened.

feeling uneasy, just reset to factory settings and start over. If your home setup isn't complicated, this is the cleanest option. Just one rule: Always back up before reset, otherwise you'll have to re-enter the work order for your broadband account and WiFi password. There are four main tasks for preventing recurrence—manage the 16-digit password, keep remote management off, upgrade firmware to the latest version, and manually assign DNS. It's really particular—just keep SPI enabled by default on the background firewall. Don't trust the old history of turning off SPI for speedup—I've already messed up that ( the firewall switch ).

troubleshooting sequence in one sentence: disconnect from the external network, check DNS, check for holes, change password, upgrade firmware, then observe the traffic curve overnight. If you still can't find the cause after checking five places, don't overdo it—reset and reconfigure it, and you'll be done within an hour.