How to Tell If Your Router Is Hacked (10 Warning Signs & Fixes)

Most people assume that malware only infects laptops and smartphones. In reality, your home router is often the most attractive target on your network. Routers run continuously, rarely run antivirus software, and sit directly on the boundary between the public internet and every private phone, computer, and smart camera in your home.

When cybercriminals compromise a router, they don't usually make it obvious with flashing sirens. Instead, they quietly alter network configurations to redirect financial traffic, monitor internet habits, or hijack the router's processing power for botnet swarms. Here are the 10 telltale signs that your router has been compromised, how to verify each one, and the exact steps to reclaim your network.

10 warning signs that your router is hacked

• 1. Unexplained web redirects & DNS hijacking: You type in a normal URL (like your bank, search engine, or news site) and get bounced to an unfamiliar domain, a sketchy survey, or a page demanding that you download an "urgent browser update." Attackers do this by swapping your router's DNS settings with their own rogue nameservers.
• 2. Your router admin password suddenly stops working: If you try logging into your gateway (usually 192.168.1.1 or 192.168.0.1) and your known credentials fail, an attacker or automated bot may have locked you out. If you never changed the default factory credentials (such as admin/admin or admin/password), anyone on the local network or internet could have claimed administrative control.
• 3. Unfamiliar devices in your DHCP client list: When you review your router's connected devices table, you see unknown MAC addresses and hostnames that remain active even after everyone is asleep. (Before panicking, verify whether these are smart plugs or IoT chips; see our guide on identifying Espressif and mystery devices).
• 4. Remote management (WAN administration) is enabled: Consumer routers should never have their web configuration or command-line interfaces exposed to the outside world. If "Remote Management," "Web Access from WAN," or port 8080/8443 is turned on in your settings without your knowledge, external attackers can reach your login portal from anywhere on the internet.
• 5. Rogue port forwarding rules or UPnP entries you didn't create: Navigate to your router's Port Forwarding section. If you see open ports (like port 22 for SSH, 23 for Telnet, 3389 for Remote Desktop, or arbitrary high ports like 8088 or 5555) forwarding external traffic to an internal IP, an intruder or malware may have opened a backdoor.
• 6. Fake virus pop-ups appear on multiple devices at once: If one Windows PC has adware pop-ups, that individual PC is infected. But if your iPhone, Android tablet, and Mac all start displaying identical "Critical Virus Detected — Call Support" pop-ups while browsing regular websites, the infection is operating at the router level via DNS or script injection.
• 7. A rogue WiFi SSID or unexpected Guest Network appeared: Some router malware exploits create an open, unencrypted secondary WiFi network (SSID) beaconing from your router hardware. This allows passersby or attackers to siphon your internet connection without needing your WPA2/WPA3 password.
• 8. Extreme bandwidth consumption & network sluggishness: If your internet speeds crawl to a halt even when all streaming and downloads are paused, your router may have been co-opted into an IoT botnet (such as Mirai, Mozi, or TheMoon). These botnets utilize thousands of hijacked home gateways to launch massive Distributed Denial of Service (DDoS) attacks against third-party targets.
• 9. Automatic firmware updates are disabled or firmware is outdated: Many modern routers update security definitions automatically. If you discover auto-updates were toggled off, or your firmware version displays an unrecognized build number, an intruder may be freezing the router on an exploitable version.
• 10. Security software and operating system updates fail: Router-level DNS manipulators often block access to antivirus update servers (like Microsoft Defender, Malwarebytes, or Apple security updates) to prevent your endpoints from detecting the malicious redirection.

Step-by-step diagnostic: How to check your router right now

You do not need to be a cybersecurity professional to audit your router. Follow these three targeted checks:

Check 1: Verify your upstream DNS settings

DNS (Domain Name System) translates human web addresses (like probeshield.com) into numerical IP addresses. When a router is hacked, changing DNS is the attacker's primary objective:

1. Log into your router's management interface via your web browser (check our default router passwords directory if you need standard gateway IPs).
2. Navigate to Network, Internet, or WAN Settings.
3. Look at the Primary DNS and Secondary DNS fields.
4. They should either be set to "Obtain automatically from ISP" or match known, reputable public resolvers: Cloudflare (1.1.1.1 and 1.0.0.1), Google (8.8.8.8 and 8.8.4.4), or Quad9 (9.9.9.9).
5. If you see random foreign IP addresses you never configured, take a screenshot, note the numbers, and replace them immediately.

Check 2: Audit open management ports on your gateway

A secure home router should only listen on local administrative ports (like HTTPS port 443 or HTTP port 80) and should never expose legacy, unencrypted services like Telnet (port 23) or an unrestricted SSH daemon.

Using an on-device port scanner like ProbeShield on Android, run an immediate audit against your default gateway IP (such as 192.168.1.1). If Telnet port 23 is open or unknown debugging ports are listening, your gateway has critical exposure. Read our in-depth analysis on open ports and network vulnerabilities.

Check 3: Inspect active UPnP and Port Forwarding rules

Universal Plug and Play (UPnP) allows software on your network to request port forwarding automatically. While convenient for gaming consoles, malicious software can abuse UPnP to punch holes straight through your router's firewall without asking for your admin password.

Check your router's Advanced > UPnP or Port Forwarding page. If you see active rules forwarding traffic to IP addresses that don't match your gaming consoles or approved servers, delete the rules immediately.

How to fix and sanitize a hacked router (Recovery Protocol)

If you have confirmed or strongly suspect that your router has been compromised, do not simply change your WiFi password — that will not remove malware embedded in router memory. Follow this step-by-step sanitation protocol:

1. Step 1: Disconnect the internet cable. Unplug the Ethernet or coax cable connecting your router to your modem or fiber ONT. This cuts off the attacker's active remote connection while you clean the device.
2. Step 2: Perform a physical factory reset. Locate the small recessed reset button on the back of the router. While the unit is powered on, press and hold it with a paperclip for 15 to 30 seconds until the LEDs flash in unison. This completely clears volatile memory, wipes rogue DNS modifications, and removes temporary malware payloads.
3. Step 3: Connect locally and update firmware. Connect one computer via an Ethernet cable. Log in using the factory default credentials printed on the physical sticker. Immediately navigate to Firmware Update, reconnect the internet briefly, and flash the latest vendor patch. If the router cannot auto-update offline, download the verified firmware file from the manufacturer's official website using cellular data and upload it manually.
4. Step 4: Create a strong, unique administrator password. Never leave the router admin password as admin or blank. Use a unique 16+ character password stored in a password manager. This password controls router configuration and must be different from your WiFi password.
5. Step 5: Disable high-risk legacy settings. In the router interface, disable Remote Management (WAN access), disable WPS (Wi-Fi Protected Setup), and disable UPnP if your household doesn't require it for multiple gaming consoles.
6. Step 6: Update your WiFi WPA2/WPA3 network passphrase. Change your wireless password to evict any unauthorized devices that previously connected.

Audit your home gateway with ProbeShield

ProbeShield helps you stay ahead of network intruders by giving you complete visibility into your local WiFi environment. Right from your Android device, ProbeShield scans your subnet, identifies active hosts, verifies hardware manufacturers, and tests your gateway for dangerous open ports (like Telnet 23 and insecure web management). Everything runs 100% locally on your phone with zero cloud accounts or telemetry tracking.

Frequently asked questions

Can a router get hacked without me clicking a suspicious link? Yes. Attackers frequently scan the public internet for routers running unpatched firmware or exposed management ports (such as Telnet 23 or remote web administration on port 8080). Automated exploit scripts and botnets can breach a vulnerable router directly over the internet without anyone in your household clicking a link or downloading malware.

What can a hacker do if they compromise my home router? A compromised router gives an attacker complete control over your home network traffic. They can hijack your DNS to redirect legitimate websites to phishing clones, inject ads into unencrypted web sessions, monitor unencrypted network requests, forward external ports into your smart home devices, or enlist your router into a DDoS botnet or proxy relay.

How do I check if my router DNS has been hijacked? Log into your router's administration portal and check the WAN or Internet DNS settings. If the DNS servers are set to unfamiliar IP addresses instead of your ISP's official servers or reputable public resolvers (like Cloudflare 1.1.1.1, Google 8.8.8.8, or Quad9 9.9.9.9), your DNS has likely been modified or hijacked.

Does a physical factory reset remove malware from a router? In almost all cases, yes. Most router malware resides in temporary memory (RAM) or non-persistent system partitions that are completely wiped during a hard factory reset (holding the physical reset pinhole for 15–30 seconds). However, you must update the firmware immediately after resetting to patch the vulnerability that allowed the initial breach.

Can an attacker compromise my phone or computer through my router? Directly hacking modern operating systems from a router is difficult due to HTTPS encryption and endpoint sandboxing. However, an attacker can redirect your web browser to credential-harvesting phishing pages, prompt fake software updates (such as Trojanized browser extensions), or probe local devices for unpatched vulnerabilities like exposed SMB or Telnet ports.

How do I find my router gateway IP address to log in? On Android, open Settings > Network & internet > Internet, tap the gear icon next to your WiFi, and look for 'Gateway' (commonly 192.168.1.1, 192.168.0.1, or 10.0.0.1). On Windows, open Command Prompt and type 'ipconfig' to find the 'Default Gateway'. ProbeShield also automatically identifies and displays your gateway IP upon opening the app.