Why check your home network for open doors

What "open" means

Your router normally acts like a locked front door: the internet can knock, and nothing answers. A device is "open" when something at your home does answer, such as a router settings page, a camera, a file-sharing service or a remote login. Sometimes that is on purpose. Often nobody remembers turning it on, or a gadget turned it on by itself. Network Check tells you which doors answer so you can decide.

What has actually happened

You do not need to guess at the risk. Government agencies have published what they saw. Here are three documented cases, in the agencies' own words where we quote them.

1. Home routers and cameras used in a huge attack (2016)

In October 2016 the US government's cybersecurity agency, CISA, issued an alert about a program called Mirai. It said the devices involved "were primarily home routers, network-enabled cameras, and digital video recorders." The program "continuously scans the Internet for vulnerable IoT devices," and it got in using "a short list of 62 common default usernames and passwords." CISA says that was enough to reach "hundreds of thousands of devices."

Those devices were then used to attack other people. One attack on a security journalist's website was described as "exceeding 620 gigabits per second." The owners of the routers and cameras were not the targets. Their devices were simply reachable and still had the password they shipped with.

2. A router door that ISPs use, found by attackers (late 2016)

The same CISA alert describes a variant that appeared in late November 2016. It "actively scanned TCP port 7547 on broadband routers" with a known flaw, and CISA says affected routers "use protocols that leave port 7547 open." That is the door our router remote management guide covers. Internet companies use it on purpose to manage the router they gave you, which is why seeing it open is not always a sign of trouble. The point is that attackers look for it.

3. Old routers turned into hiding places for criminals (2025)

In May 2025 the FBI's Internet Crime Complaint Center published a notice titled "Cyber Criminal Proxy Services Exploiting End of Life Routers." It says that routers that are "end of life" no longer get security fixes, and that some of them "with remote administration turned on" were compromised by a variant of a program called TheMoon. According to the FBI, "TheMoon does not require a password to infect routers; it scans for open ports and sends a command to a vulnerable script." The compromised router is then used to run a proxy, so that criminals can "conduct cyber crimes anonymously" through the victim's internet connection.

What this does and does not tell you

In all three cases the problem was a device that could be reached from the internet and was not protected well enough. None of the notices describe someone being picked out and watched. The FBI calls the routers "unsuspecting victim routers." The FBI lists signs of an infected router, such as "overheating devices, problems with connectivity, and changes to settings the administrator does not recognize," and the notices do not say how many owners ever noticed. We do not want to frighten you. The check takes a minute, and knowing is better than assuming.

What the agencies say to do

• Change default passwords. CISA: "Ensure all default passwords are changed to strong passwords. Default usernames and passwords for most devices can easily be found on the Internet." See how to change your router admin password.
• Install updates. CISA: "Update IoT devices with security patches as soon as patches become available." The FBI says the same for routers.
• Turn off UPnP unless you need it. CISA: "Disable Universal Plug and Play (UPnP) on routers unless absolutely necessary." See how to turn off UPnP.
• Turn off remote management. The FBI: "Login online to the router settings and disable remote management/remote administration, save the change, and reboot the router." See our router settings checklist.
• Replace a router that no longer gets updates. The FBI: "If the router is at end of life, replace the device with an updated model if possible." See how to tell if your router is too old.

If you think a router or camera is already compromised, CISA's advice for a Mirai-style infection was to disconnect it, reboot it, and change the password before reconnecting. The FBI asks people to report suspected compromise at ic3.gov.

How to use Network Check with this

The free check looks at the same kinds of doors these notices describe, from the outside, the way a stranger on the internet would. If something answers, the result links to a guide for it. Read what a check can and cannot see so you know how far to trust a clear result.

Sources

• CISA, "Heightened DDoS Threat Posed by Mirai and Other Botnets" (alert TA16-288A, released October 14, 2016, now archived): cisa.gov
• FBI Internet Crime Complaint Center, "Cyber Criminal Proxy Services Exploiting End of Life Routers" (alert I-050725-PSA, May 7, 2025): ic3.gov

Quotes are copied from those pages. We read them directly on November 8, 2026. Agencies revise and archive pages, so check the originals for anything you plan to rely on.