For the past three days, Google Search has frequently shown an "unusual traffic" warning whenever I search from my phone over home Wi‑Fi without signing in. I don't use a VPN or iCloud Private Relay, and the problem only happens on my home internet connection.
I'm concerned that malware on one of the devices in the house could be generating automated searches, although the computers run Linux and the phones use iOS. I also unplugged the modem for several hours, hoping the ISP would assign a different public IP address, but the address stayed the same. Is there a practical way to determine what is triggering Google's warning, and could this be caused by my ISP sharing one public IP among multiple customers?
3 Answers
A modem reboot does not necessarily change your public IP. Your ISP may lease the same address again, or the address may be shared through CGNAT. You can compare the WAN address shown by your router with the address shown by an external IP-checking site; if they differ, that’s a strong sign of CGNAT. Your ISP can confirm this.
The warning alone isn’t proof of malware. First, try another browser, clear cookies, and temporarily disable extensions. Check the router’s connected-device list and make sure its firmware and Wi‑Fi password are up to date. If the warning occurs only on one device, inspect that device; if every device on Wi‑Fi gets it but cellular data does not, the shared public IP or ISP is the more likely explanation.
This may not be caused by anything on your devices. Many ISPs use carrier-grade NAT (CGNAT), which means lots of customers can appear to Google under the same public IP address. If another customer sharing that address generates suspicious traffic, Google may challenge everyone using it. Contact your ISP and ask whether you’re behind CGNAT and whether they can move you to a different address or provide a dedicated public IPv4 address.
The internal addresses assigned by the router are not public internet addresses. Devices may each have a private address inside the home, but Google generally sees them all through the router’s one public address.