Dummy rule - ISP blocked my public IP due to possible hacker attack?

hey guys

I received a call from ISP that my upload is too big, data flow 45000 Mbit?? 45Gb from me out to network, so they made my public IP to private due to suspicion of virus in of my devices behind router.

problem is that I was not at home for the past 4 days so no devices were uploading or something (and in this time frame ISP called me while nobody was home), i am not uploading anything etc… this is only as HOME AP, Mikrotik hAC lite. and I hooked it up just week ago, so its brand new, so the counters pretty much were at 0 +/- in firewall screen.

so when I returned yesterday I checked in to router and what I see is this!!! :

There are programs that track the network usage of all applications. Can’t remember the name now and not sure if this is the best way to identify the problem, but what an interesting screenshot :laughing:

See the interfaces where the upload is coming from.

See what device is connect with this interface with match upload capacity

Try to work with winbox, this is match better

See on my website http://www.wirelessinfo.be/index.php/mikrotik/pages/winboxe