Help with Google Unusual Traffic issue

RouterOS General
1

Environment:
MikroTik CCR1016 as Core router
Static IP
500 PPPoE connected clients

Recently we’ve been getting the Unusual Traffic warning when doing a Google Search.Copied below:

About this page

Our systems have detected unusual traffic from your computer network. This page checks to see if it's really you sending the requests, and not a robot. Why did this happen?

IP address: 45.45.45.3
Time: 2018-10-02T07:11:41Z
URL: https://www.google.co.za/search?q=nano+select+all&oq=nano+select+all&aqs=chrome..69i57j69i60j69i59.5174j0j4&sourceid=chrome&ie=UTF-8

I have searched around, even on this forum, but could not solve this issue yet, any help or guides in the right direction will be highly appreciated

2

Are all your 500 clients sharing the same address? Then this issue really cannot be avoided, because there will always be bad guys in there.
However, you should still make sure your router and any client routers that you manage are properly configured and not part of the botnet.

3

Yes, all are sharing the same IP. How would I split up groups to use different IPs? I have a /29 available
By properly configured could you give me some details?
How would I know if they are or are not part of the botnet?

I am supposing that I have to narrow down traffic to the culprit/s, but I don’t know what to look for.

4

You should implement a proper firewall so outsiders cannot connect into your router.
At least read https://blog.mikrotik.com/security/

For configuration hints you should first post your current configuration: /export hide-sensitive file=config
then download config.rsc from the router and post it here.

There are some common problems:

  1. your router(s) and those of your customers becoming attacked because of running old firmware and not having a firewall
  2. the equipment of your customers (PCs, cameras and other smart devices) becoming infected, for the same reason.
  3. your customers willfully engaging in illegal or abusive practices

Logging and analyzing all the traffic to see where the problem exactly is can be a lot of work, and it may in fact be illegal
to do that (due to privacy laws). You can only do your best to keep your router configuration safe, but you likely cannot
control your customers so this problem cannot be completely solved for a network setup like that.