How to check who is freeloading on a Xiaomi router? A new device notification popped up in the Mi Home app, and I pulled out an unfamiliar phone

last Wednesday at around 11 a.m., a push notification popped up on my phone: "New device connected to Xiaomi router." I clicked on it in a daze, and the device was called "honor-9X"—no one in my family used Honor. With just this one notice, I pulled out a WiFi phone that had been hidden in my home WiFi for internet access.

Xiaomi router actually offers a lot when it comes to anti-anti-anti-theft: new device notifications in the Mi Home app, backend device lists, and blacklist and whitelists for anti-theft—scattered across three places. In this article, I connected these three areas into a single thread, going through the entire process from detection to handling to preventing recurrence, using my AX3000T as a whole.

first, where to look: the 31.1 homepage is the device list. No need to scroll through menus

connect your phone to Xiaomi router's WiFi, enter 192.168.31.1 (or enter miwifi.com, same method) in the browser's address bar. The first thing you see is the device list card on the homepage. Each device takes up a line: device name, whether it's connected to 2.4G or 5G or cable, real-time upload and download speeds—scan at a glance and see who's online at home. If you can't access the login page, that's another issue. Most likely it's due to an incorrect IP or a browser forcing HTTPS restrictions. Follow the 192.168.31.1 login portal article to queue first.

any device you click in, you can see detailed information about that device: MAC address, assigned IP, signal strength, and connection duration. These fields are the foundation for recognizing people later. The list is displayed online by default. If you want to see history, check the "Frequently Used Settings→" device list, which contains records of recently connected devices. Even if you are offline and freeloader, it will be traced.

computer uses the same backend; plug in the network cable and open the browser directly, same operation. I'm used to reading on my phone; I can flip through it while lying down.

more convenient on mobile: Mijia App checks lists, new device notifications are the first line of defense

web backend checks, Mijia App monitors. After binding the router to Mi Home (on older phones, this feature might still be called the "Xiaomi WiFi" app, which is a thing), tap the router card on the app's homepage and enter the connected device list, just like the web backend. You can also directly select the device name, change the speed, and check the speed.

real treasure is the new device access alert . In router settings, enable push notifications, and every device connected for the first time will display notifications on your phone. If your new device pops up, just cross it out and that's it; If a phone you don't recognize pops up in the middle of the night, it's time to take action. That's exactly how I discovered it that time—those who use the internet even have the password right, connect silently, and without notifications, you can't even remember to check the list.

this feature has a hidden use: when you go on a business trip, you can check the Mijia app and see how many devices are online even when you're away. I've written a complete guide to remote management. In the Xiaomi router phone remote management , you can change passwords and kick devices remotely.

three tricks to recognize unfamiliar devices, don't treat your own people like thieves

Out of a dozen or twenty devices on the list, which ones are imported? My method is to prioritize convenience:

first trick, check the vendor and timing. Xiaomi's device recognition in the backend is stronger than most brands. Most devices can recognize brands and types, such as iPhone, Xiaomi TV, and iPad, which are directly labeled. Phones that use the internet often display the manufacturer. First, he matched each of his own households one by one, and the remaining ones he couldn't recognize were the suspects. Next, check connection time: your device's online routine matches your life. Those who use the internet often hang up all day or choose to be active when no one is home. That Honor-9X is just like that—still chasing traffic at 2 a.m., I don't have an Honor at home, nor any night owls.

second trick: check the signal and real-time speed. click into device details and check signal strength: around -40dBm, this means the device is next to the router; below -70dBm, it's in a remote room. A "mobile phone" is always -45 years old, but if your remote room is occupied by a TV, there will be ghosts. Looking at real-time speed, it's obvious who's running hundreds of megabytes of data. My internet mooch phone had over 3 megabytes of downlink that night, and watching videos was solid proof.

third trick: elimination as a backup. names are garbled or the manufacturer can't recognize them, turn off the WiFi of every device at home: turn off WiFi on your phone, unplug the cable from your TV—whoever doesn't disappear from the list is considered an outsider. Surveillance cameras like vacuum cleaners are hard to turn off for last; kicking the wrong camera can push offline and blow up the phone. If you have so many devices at home that the list is dizzying, let's slim down the device count first. I once wrote an article Xiaomi router with of devices, and the account of 62 devices slimming down to 20 units is all included.

"No internet" and "block" are two different things. Pressing the wrong button can cause trouble

but if you identify a thief, the handle button has two levels with completely different effects. First, distinguish:

disable the internet clicking it immediately disconnects the device, but it still connects to WiFi and remains in the list, so you can tap "Allow internet" again at any time. Retrieve it. I call this the observation period—if you're not sure if it's your own device, block it first. If someone at home calls for disconnection, it's a mistake, instant recovery, zero cost.

blacklist : Operate in the Mijia App's "Toolbox→ Anti-Internet → Blacklist." Devices on the blacklist can't even connect to WiFi, so they're completely rejected. Note that for models like the Redmi AX6000, the disconnect button in the device details directly blocks the device, not the prohibition option during the observation period. If you want to restore it, you have to manually delete the device from the anti-internet anti-theft blacklist, which is quite circuitous. The first time I worked on a friend's Redmi device, it took ten minutes to find the place to delete.

also has a whitelist mode. Once the anti-internet is enabled, only devices on the list can connect, and all others are rejected—the most ruthless option. But if you have smart devices at home, be cautious: after enabling the random MAC feature, each time you connect to the internet, you might change your "new identity," and if you're not on the whitelist, you'll be blocked immediately. This is how the tragic case of cameras and vacuum cleaners all disappearing happened in this way. The article about offline screening Mi Home devices really happened. I have more than a dozen smart devices at home, but the whitelist can't afford it, so I resort to simple methods: disable observation, confirm blocking, and change passwords.

to prevent recurrence: changing passwords is a cure. Turning off WPS and hiding SSIDs can add

blocking is just closing the door. Phones that are freeloading still have your home password stored. There's only one solution: change your WiFi password , mix 16 characters or more with alphanumeric characters, and everything is done—reconnect all devices, and those who freeload won't know the new password and can't get in, and even swapping random MACs with a new identity is useless. You can change your password in the 31.1 backend or the Mijia app. Just tap it on your phone and it takes five minutes.

changed the password and took care of two things while he was at it. First, turn off WPS. That 8-digit PIN code is an old vulnerability that has been brutally cracked. Mercury and ASUS have it, and some old Xiaomi firmware keeps this switch. The reasons and methods for turning it off are WPS explained thoroughly in the article on whether to close it or not. Second, consider whether to hide your SSID—if you do, no one can find your WiFi name, but the trade-off is that smart devices at home will have trouble configuring the network, and it's hard for the vacuum cleaner's camera to find hidden networks. I've reviewed the pros and cons, and I'll write about it in article about Xiaomi router hidden WiFi. My choice is not to hide it; as long as the password is long, it's enough.

also has a mindset of 'no one can stop it,' making those who free-load online question their own lives: limit that device to 512Kbps, and the videos become completely unwatchable. You can limit in both the Mi Home app and the 31.1 backend; the instructions are in Xiaomi router speed limiting article. Tu Lehe is fine, but it's a temporary fix, not the root cause. The password must be changed.

give a complete order at the end

from discovery to finishing. If you follow this order, will you avoid detours:

that's all I have to say. The general idea for freeloading (password grading, the three-layer protection for guest networks) is written more systematically the article on preventing anti-internet access. Together, your router basically has a solid barrel.