You think the router was hacked. Its admin page shows what it has been told to do.
Pages redirect somewhere odd, the connection drops, or the sign-in that used to work for the router no longer does. The router was installed once, has run for years, and mostly that is how it should be.
Windows Update and the antivirus on each computer never touch the router. It runs its own software, keeps its own settings, and hands some of them, including where to look up web addresses, to every laptop and phone on the network. This page reads five of those settings. The list of devices connected to the router is on the page about an unknown device on your network.
Signs worth acting on
- The FBI lists three for compromised routers: overheating, problems with connectivity, and changes to settings the administrator does not recognize.
- The password you set for the router’s admin page no longer works.
- Several computers and phones reach the same familiar sites and sign-in pages differently from before, with certificate warnings or redirects.
Before you change anything
- From a computer on the network, open the router’s admin page using the address and admin sign-in your installer or IT provider gave you. The maker’s manual says where the address is.
- Some offices have two boxes, a modem from the internet provider and a firewall behind it. Each has its own admin page. Check both.
- Photograph or screenshot every settings page you open, with the date. Changing a value and rebooting erases what it was.
Five settings and what an odd value looks like
- DNS servers (often under Internet, WAN, DHCP, or LAN). DNS is the directory that turns a web address into a destination, and the router passes its DNS addresses down to every device. The UK’s National Cyber Security Centre described attackers changing these on small-office routers so laptops and phones inherited them. Normal: automatic, your internet provider’s addresses, or addresses someone here chose and can name. Odd: an address nobody can name, especially an unfamiliar primary with the original as the secondary, which is the pattern the NCSC reported.
- Remote administration, also called remote management. Normal: off. Odd: on, or open to any internet address. The FBI says to disable it, save the change, and reboot. The NCSC: management interfaces must never be exposed to the internet. If your IT provider uses it on purpose, they can tell you the one address allowed.
- Port forwarding and UPnP (often under Virtual Server, NAT, or Applications). A forward sends traffic from the internet to one computer inside. Normal: none, or a short list where each entry has a person and a purpose. Odd: an entry nobody can attach to either. CISA advises turning UPnP off unless there is a specific need for it.
- Admin password. Normal: changed from the one printed on the label, known to a named person. CISA says to change it, because default credentials are not secure. The FBI’s advice is unique and random, at least 16 and no more than 64 characters. Odd: still the default.
- Firmware version and support status. Normal: the version on the maker’s site for your exact model number. CISA says to check the manufacturer’s website for the latest. Odd: a model the maker no longer sells or updates. The FBI calls that end of life, says such routers may be compromised, and says to replace them with an updated model if possible.
If one of them is off
- Write the value down, with the date and the screenshot.
- Apply any available firmware update.
- Change the admin password and turn off remote administration. Save, then reboot. The FBI gives the same sequence.
- If the DNS addresses were ones nobody can name, treat passwords typed on that network since you last know them to be right as exposed. The NCSC reported the aim was to harvest passwords and sign-in tokens. Change them from a device on a different network, such as a phone on cellular data, starting with email.
- Report to the FBI’s Internet Crime Complaint Center at ic3.gov if you believe the router was taken over.
What the admin page can’t show
It shows what the router is set to do today. It doesn’t show who changed a setting, when, or what the router passed along before you looked. A router that has been reset, or one whose firmware itself was altered, can show a clean page. Settings that look right cover only the settings you examined, on the day you examined them.
A router that is out of support can’t be brought back to a known state by settings alone.
What we check with you
The five settings above, on each box between your office and the internet, compared with what your installer or IT provider says they should be. A person compares each value with what it should be and tells you which ones differ, with dates.
The router decides where every device on your network looks for answers, and its settings tell you whether that is still your decision.
Related
Sources
Talk to a person about what you noticed.
Call (•••) •••-••••
Kristina or Anne will answer. Available during US Eastern time.
While you wait: run the Reveal Scan on the computer you use for this.
Run the Reveal Scan on that computerThe Reveal Scan shows every problem it finds, with no charge and no credit card needed. Step-by-step instructions for fixing them are in the detailed report, which is paid, and you’ll see its price before you buy. It reads one Windows computer at a time and can’t see a mailbox.
Or ask for a call back. Tell us which computer or mailbox, and what you noticed.
Request a call back
Written by Craig Peterson, 35+ years successfully running IT and security for businesses. Last reviewed October 27, 2026.