Someone Else on Your WiFi: How to Find the Unknown Device

Four different things "someone is on my WiFi" can mean

Before you touch a setting, work out which of these you are actually dealing with. They look identical from the outside and need completely different work.

• A stranger in range who got past your password. Your password leaked, was guessed, or came from the sticker on a box someone photographed.
• A device that is yours, or your household's, and you do not recognise. An old phone still associated with the network, a smart plug from a previous flat, a visitor who joined once and never left the list.
• Someone using your connection without being on your network at all. Your client list will look perfectly clean, because the router has nothing to log.
• The router itself was taken over. Then its device list is not evidence of anything, because the thing drawing it changed.

The first two are an afternoon's settings work. The fourth is a recovery job. The third is a different question and no amount of staring at the router will answer it.

Step 1: read the router's own device list

From a laptop or phone already connected to the network, open a browser and go to the router's admin page. NETGEAR's documentation puts that at routerlogin.net or 192.168.1.1, with the username admin and the password being the one you set during setup, which is case sensitive.^[2]

The page you want is the device list. On a NETGEAR router it sits at BASIC > Attached Devices, split into wired and wireless sections, with a Refresh button to update it on demand.^[3] TP-Link's Deco app puts the same list under Manage Network Clients, where you can change a client's name and type, set it to high priority, and toggle mesh for that device.^[4] Every other brand calls it something like Network Map, Device Manager, or Clients. The sticker on the router usually carries the admin address.

Each row gives you three things to work with: a device name, when the device offers one; an IP address, assigned when the device joined; and a MAC address, which NETGEAR describes as a permanent unique identifier that is often printed on the product label.^[3] The MAC is the one worth writing down.

Step 2: work out which entry is the intruder

Three tests, cheapest first.

1. Kill one of your devices and hit Refresh. If the entry you could not place disappears, that was it: an old phone, a speaker, a laptop somebody forgot at your place. The Refresh button exists for exactly this.
2. Check whether it is one of your phones under a fake name. Apple hands each network a private Wi-Fi address, and on the rotating setting it "rotates to a different private address every 2 weeks".^[5] Android uses a randomized MAC address by default from Android 10 onward, and the persistent version stays the same until the device is factory reset.^[6] Both controls are per network: on iPhone it is Settings > Wi-Fi > your network > Private Wi-Fi Address, on Android it is the privacy option on the network's details page in Settings.^[5][6] So a MAC that has been stable for months is not suspicious, and an unnamed entry with a MAC you have never seen before might still be a device you own.
3. Flip the router into strict mode and see what breaks. NETGEAR's Access Control offers two settings, "Allow all new devices to connect" and "Block all new devices from connecting", and it identifies devices by MAC address.^[7] Turn on the second one, add your own gear to the allow list, and anything you did not add stops working. That entry is the one you did not expect.

Step 3: cut it off

Blocking one MAC address handles the device you found. Four settings handle the next one. CISA lists all four in its home Wi-Fi module:

• Change the router's login username and password. CISA's reasoning is blunt: "Your default router information may be publicly available for anyone to find, so it is crucial to change your credentials."^[1]
• Change the Wi-Fi password. CISA suggests "a memorable passphrase using 5 to 7 unrelated words totaling at least 16 characters", and not reusing it anywhere else.^[1]
• Turn off remote management. That setting "allows you to log in to your router over the internet to make changes", which is a way in that does not need your Wi-Fi password at all.^[1]
• Turn off WPS. CISA calls it out because the setting "increases the likelihood that a threat actor could gain unauthorized access to your Wi-Fi network".^[1]

Look at UPnP while you are in there too. It lets an app on your network open a port on the router without asking, and CISA notes that "threat actors can use UPnP to spread malware to devices in your network and control them remotely".^[1] If a smart device needs it during setup, switch it off afterwards.

None of this survives someone with their hands on the box. CISA's warning is worth taking literally: "Anyone with physical access to your router could perform a factory reset and use the default information displayed on the router to gain access to the network."^[1] A router sitting on the hallway table is a router on loan to whoever walks past.

What someone on your network can actually reach

Being on your WiFi does not hand over your accounts. CISA frames the home network risk as attackers "gaining access to your network and reading any unencrypted data that you send over the network".^[1] The encryption setting decides how much that is worth. CISA is unambiguous that WPA3 Personal or WPA2 AES "are the only two forms of encryption that are considered safe and secure against threat actors who might attempt to see what data you are sending across your network", and says that an open router or one on WEP or WPA2 TKIP should go back to the ISP or be replaced.^[1]

Reach matters as much as eavesdropping. The guest network exists so unfamiliar hardware does not mix with your own: CISA's advice is to put smart home and other IoT devices on the guest WiFi, which stops those devices "from discovering other devices on your home network, accessing your router settings, and potentially introducing vulnerabilities into your network".^[1]

One case the padlock cannot fix. CISA's own list of wireless threats includes an attacker who copies a legitimate access point and broadcasts a stronger signal, so that people connect through the attacker's system instead and their traffic is intercepted. If a second network turns up carrying your network's name, that is the shape of the problem to look for, and no amount of TLS will save you from it.^[8]

If the router itself was tampered with

This is not hypothetical, and it is not limited to offices. In April 2026 the FBI and partner agencies published a joint advisory on Russian GRU actors compromising vulnerable home and small-office routers, altering each device's DHCP and DNS settings to point at actor-controlled resolvers. Laptops and phones inherited those settings automatically, and the actor-controlled infrastructure answered with fraudulent DNS answers, redirecting users to attacker-controlled infrastructure. The advisory describes the result as enabling "adversary-in-the-middle (AitM) attacks against encrypted traffic if users navigate through a certificate error warning".^[9]

That last clause is why the advisory tells home users to "carefully consider certificate warnings in web browsers and email clients", alongside updating firmware, changing default usernames and passwords, disabling remote management from the internet, and replacing devices that are out of support.^[9]

CISA and the FBI told router manufacturers the same thing from the other end. Their January 2024 alert tells vendors to eliminate exploitable defects in the web management interfaces of small office and home office routers, after Volt Typhoon had been found exploiting them, and to require a manual override before security settings can be removed.^[10] The management interface being quietly exposed and quietly reconfigurable is the whole problem.

Three checks are worth making on the router itself:

• Does the DNS server listed there match the one your ISP gave you?
• Is the firmware version the current one the vendor publishes?
• Are the admin password, the Wi-Fi password, and remote management exactly as you left them?

If any of those are wrong and you did not change them, do a factory reset, change the admin credentials from a device on the network rather than over Wi-Fi if you can, and reconfigure from scratch.^[1]

The ten-setting lockdown

CISA's module ends with a do-list. Run through it once and this page becomes a yearly check rather than an incident:

1. Change your default router username and password.
2. Update your router firmware, and turn on automatic updates where the router offers them.
3. Change your default SSID, and keep your own name out of it.
4. Change your default Wi-Fi password.
5. Make sure the router uses WPA3 Personal or WPA2 AES.
6. Disable remote management.
7. Disable WPS setup.
8. Disable UPnP.
9. Store the router somewhere physically secure.
10. Enable the guest Wi-Fi, give it a separate long random password, and put smart home and IoT devices on it.

If you want the stronger version of the last one, splitting your own devices onto a separate network is what the home network VLAN guide covers in detail.

When the unknown device is not a stranger

Sometimes the entry is a camera, an old tablet, or something a guest brought round. If the device you found is a camera, read local AI security cameras and your privacy and how to spot a hidden camera in a rental. If you suspect the phone itself rather than the network, start with how to tell if a phone has spyware.

And if you are simply trying to get a handle on what your router and your provider already know about your browsing, that is a different page: what your WiFi router and ISP collect.

Sources

1. CISA: Module 5, Securing Your Home Wi-Fi (Project UpSkill, Joint Cyber Defense Collaborative). Verbatim: "Your default router information may be publicly available for anyone to find, so it is crucial to change your credentials"; "These are the only two forms of encryption that are considered safe and secure against threat actors who might attempt to see what data you are sending across your network"; "Anyone with physical access to your router could perform a factory reset and use the default information displayed on the router to gain access to the network."
2. NETGEAR Knowledge Base: How do I log in to my NETGEAR router? (vendor documentation). Login address routerlogin.net or 192.168.1.1, username admin, case-sensitive password set at setup.
3. NETGEAR Knowledge Base: How do I view the devices on my network from my Nighthawk router? (vendor documentation). BASIC > Attached Devices, wired and wireless sections, Refresh button, and the device name, IP address and MAC address columns.
4. TP-Link Support FAQ: Deco App Overview, Features, and Settings (vendor documentation). Verbatim: "From the client detail view, you can change a client's name and type, enable high priority, and toggle Mesh Technology for that device."
5. Apple Support: Use private Wi-Fi addresses on Apple devices (vendor documentation). Per-network private addresses, and the rotating setting that "rotates to a different private address every 2 weeks".
6. Android Open Source Project: MAC randomization behavior (platform documentation). Randomized MAC addresses by default from Android 10, persistent addresses derived per network, and the per-network control in Settings.
7. NETGEAR Knowledge Base: How do I use access control to allow or block devices from accessing the Internet? (vendor documentation). The "Allow all new devices to connect" and "Block all new devices from connecting" modes, applied by MAC address.
8. CISA: Securing Wireless Networks (published 1 February 2021). Threat list including the copied access point broadcasting a stronger signal, and the mitigation list: change default passwords, restrict access by MAC and guest account, encrypt with WPA3, disable file sharing on untrusted networks.
9. FBI and partner agencies: Russian GRU Exploiting Vulnerable Routers to Steal Sensitive Information (PSA I-040726-PSA, 7 April 2026). DHCP and DNS settings altered to point at actor-controlled resolvers, fraudulent DNS answers, the certificate warning the advisory singles out, and the home-user mitigations.
10. CISA and FBI: Secure by Design Alert on SOHO routers (31 January 2024). Manufacturers told to eliminate exploitable defects in SOHO router web management interfaces and to require a manual override to remove security settings, after Volt Typhoon exploitation.