Help: BGW320-505 blocking malicious unknown device
A few times a week Smart Home Manager will rapid file me 5 to 10 alerts with the following message about blocking a website:
Device: Google Nest WiFi Router
Description: We noticed that Google Nest WiFi Router tried to visit a website that posed a fraud risk. This risk tries to trick you into sending money with the intent of obtaining unlawful gain. We blocked the connection to stop private data from being exposed.
The alert provides the website address that was blocked. It changes and the address always looks sketchy. Firewall working, all good.
Here is the problem. I don’t have a “Google Nest WiFi Router” on my network. Smart home manager only provides the device “name” and no other information. No IP address and no MAC address so I have no way to track down the device. I have about 60 devices (between speakers, IOT devices, phones, etc), so the malware could be anywhere.
I’m not sure how it’s happening, but it appears the offending device is spoofing its identity to Smart Home Manager.
Since it happens at random times, sometimes daily, sometimes it won’t happen for a week, I can’t just disconnect devices to see what is causing the alert.
Any ideas on how to track down the device? firewall settings, logs, traffic sniffers, anything?
Thank you.