Potential router malware? Receiving "Access Denied" and other weird blocks from various websites

Question

So I've been having some weird browsing behavior over the last few weeks and it's gotten a lot worse the last few days. I've been getting blocked/banned by various websites off and on. Here are a few examples:

Southwest.com: "Access Denied" You don't have permission to access "http://www.southwest.com/" on this server.

Google search: While in incognito I sometimes see "Unusual traffic from your computer network" and am presented with a captcha. This doesn't happen when I'm not in incognito, likely because I'm logged into one of my google accounts.

Yelp: I am sometimes presented with a captcha when viewing a business page (especially coming from a search engine).

Playstation Vue login: Same "Access Denied" response as southwest.com every now and then.

Schwab.com: I have been locked out of the entire site 3 times over the course of a few months. I just get a white screen. Called tech support and they said my IP was banned, that they would unban it, but couldn't give me a reason why.

Godaddy: I tried logging into my account once with the correct password and received a message saying I was locked out for 5 hours.

All of these happen from multiple devices and operating systems (and only when I'm connected to my home network), so clearly there's something weird going on with my network traffic. I just don't know how to track it down. I am somewhat familiar with Wireshark and have poked around with the filters and stats trying to pinpoint sketchy traffic but I haven't been able to find anything yet. It definitely seems like our network is either being used as a VPN/open proxy or one of us has malware.

I live with a roommate who I've talked to and he's adamant that he's not running anything sketchy and says he just recently ran virus/malware scans on his two devices. I personally have a desktop and laptop. Both have come back clean from all the virus/malware scans I've run and I'm generally pretty safe with software and browsing habits. Just to be extra safe I reformatted both machines this week. I also checked my router against VPNFilter using this URL: http://www.symantec.com/filtercheck/ and it came back clean, but I'm not certain that the router is actually clean. I recognize all devices that are connected to my router, and I recently configured the router to use Google's DNS. My next step is to reset the router back to factory settings in case that somehow got infected with anything else.

I have no clue what steps to take next. What's the best way to detect what's going on? Can I use Wireshark filters to isolate any potential traffic that's using our network as a VPN/proxy/tor exit node? Can I somehow filter for domain names or the IPs of the sites that I'm blocked from and try to capture any automated requests going to them?

Answer 1

Each taken on their own, each of these things listed may not be too much to be concerned about. Taken together, it's hard to say.

Southwest.com: I also get a Access Denied at http://www.southwest.com/ (and at https://www.southwest.com/). Their server is misconfigured. Nothing to worry about. Edit: Upon a closer investigation, the http://www.southwest.com/ page loads fine for me when I'm using an IP address in the USA, and gives me an Access Denied with an IP from anywhere in the world (that I've tried — several through Europe, India, Australia). So I'm not honestly sure about his one. They may filter IPs pretty aggressively, and it may be a similar situation to the Schwab.com issue you experienced (and if you've discovered your IP has been blacklisted, that may not be surprising).

Google search: I also get occasional CAPTCHAs when in incognito mode, though this might indicate genuine unusual traffic.

Yelp, Playstation Vue: I'm not a user of these sites and can't offer comment, but your description of these intermittent issues doesn't seem too unusual.

Schwab.com: This could indicate a genuine issue. If I can assume that you are using a normal home internet connection, then with most internet providers your IP address actually changes fairly often. This may mean that you were simply automatically assigned an IP that someone else has used to attack the Schwab website, either intentionally or (more likely) as an unwitting part of a botnet. If you have a dynamic IP (your IP changes regularly), I wouldn't be too concerned about this. If, however, you have a static IP (your IP is always the same), this is a concern, as it means it's something on your home network that's somehow become an unwitting part of a bot-net. Your IPS can tell you which (dynamic or static IP) you have, and may be able to switch you from one to the other if you like.

Godaddy: This is much more likely to indicate that someone is attempting to brute-force your Godaddy password than that there's an infection on your home computer/network/router. This is not that unusual, but there are some important steps to protect your accounts. Firstly, Godaddy supports two factor authentication, which you should enable immediately if you haven't (security professionals recommend enabling 2FA wherever it's supported). Secondly, you should register your email addresses with https://haveibeenpwned.com/, since if your login at a place like Godaddy is being attacked, there's an excellent chance that your credentials have been leaked somewhere, and it's very important to know what's happening with your data.

In short, I don't think you have much reason to worry at this point. Each of those symptoms has a separate, reasonable explanation. You've also taken some good steps so far. However, there are some further steps you can take to protect yourself.

1. haveibeenpwned.com, as mentioned above.
2. Always ensure your software (operating system, antivirus, etc) is fully up to date.
3. If you have any "smart" or "Internet-of-Things" devices (smart lightbulbs, app-enabled dishwashers, security cameras, what have you) be sure that they are also completely updated with their current firmware and software (people often forget these). If they don't need an external connection to the internet for their functionality, then consider blocking them from accessing the internet too. (Sadly, most of these devices need full internet connectivity to work, but still.)
4. Resetting your router to factory settings won't hurt, and is worth doing. You should also make sure, like with everything else, that the router software is fully up to date. I note in the comments you have separate modem and router; rinse and repeat for the modem.
5. If you want, you can start looking at your network like an attacker would. Tools like nmap can be used to find things on your network that may not appear (for whatever reason) in your router's interface. Wireshark can be used to investigate traffic, but if you're not able to run it directly on your router, it can take some effort to set up a system whereby your Wireshark can see all the traffic going in and out.

Hope this helps!