So I've been having some weird browsing behavior over the last few weeks and it's gotten a lot worse the last few days. I've been getting blocked/banned by various websites off and on. Here are a few examples:
Southwest.com: "Access Denied" You don't have permission to access "http://www.southwest.com/" on this server.
Google search: While in incognito I sometimes see "Unusual traffic from your computer network" and am presented with a captcha. This doesn't happen when I'm not in incognito, likely because I'm logged into one of my google accounts.
Yelp: I am sometimes presented with a captcha when viewing a business page (especially coming from a search engine).
Playstation Vue login: Same "Access Denied" response as southwest.com every now and then.
Schwab.com: I have been locked out of the entire site 3 times over the course of a few months. I just get a white screen. Called tech support and they said my IP was banned, that they would unban it, but couldn't give me a reason why.
Godaddy: I tried logging into my account once with the correct password and received a message saying I was locked out for 5 hours.
All of these happen from multiple devices and operating systems (and only when I'm connected to my home network), so clearly there's something weird going on with my network traffic. I just don't know how to track it down. I am somewhat familiar with Wireshark and have poked around with the filters and stats trying to pinpoint sketchy traffic but I haven't been able to find anything yet. It definitely seems like our network is either being used as a VPN/open proxy or one of us has malware.
I live with a roommate who I've talked to and he's adamant that he's not running anything sketchy and says he just recently ran virus/malware scans on his two devices. I personally have a desktop and laptop. Both have come back clean from all the virus/malware scans I've run and I'm generally pretty safe with software and browsing habits. Just to be extra safe I reformatted both machines this week. I also checked my router against VPNFilter using this URL: http://www.symantec.com/filtercheck/ and it came back clean, but I'm not certain that the router is actually clean. I recognize all devices that are connected to my router, and I recently configured the router to use Google's DNS. My next step is to reset the router back to factory settings in case that somehow got infected with anything else.
I have no clue what steps to take next. What's the best way to detect what's going on? Can I use Wireshark filters to isolate any potential traffic that's using our network as a VPN/proxy/tor exit node? Can I somehow filter for domain names or the IPs of the sites that I'm blocked from and try to capture any automated requests going to them?