“Unusual traffic from your computer network”: why websites think you’re a bot, and how to fix it

It means a website has decided that the traffic coming from your internet address looks automated. It has not found anything wrong with you. Google shows its message when “a network you use, including VPN networks, seems to be sending automated traffic” to Search (Google Search Help), and the CAPTCHAs and “checking your browser” pages on other sites come from the same kind of judgement. The cause is usually something you share without knowing it: an address used by many people, a VPN, or a device on your Wi-Fi that sends traffic in the background. Below: what the message means, the usual causes, the fixes in the order worth trying, and how to see what a site sees on your connection. The outside facts were checked on 20 October 2026.

What “unusual traffic from your computer network” means

Google’s block page says it “appears when Google automatically detects requests coming from your computer network which appear to be in violation of the Terms of Service”, and that “the block will expire shortly after those requests stop” (Google’s block page). It names the usual causes itself: “This traffic may have been sent by malicious software, a browser plug-in, or a script that sends automated requests.” If you share your connection, “a different computer using the same IP address may be responsible”, and you may also see the page if you use “advanced terms that robots are known to use” or send requests very quickly.

Most of the time the page shows a reCAPTCHA. Google’s help page says that once you solve it the message goes away and you can use Google again; if no reCAPTCHA appears, it says to check that your browser is supported and that JavaScript is on (Google Search Help).

Other sites word the same decision differently. A Cloudflare challenge page comes from rules the site owner sets, Cloudflare picks the kind of challenge itself, and most people pass its recommended kind without doing anything (Cloudflare). Google’s reCAPTCHA can score a visit without showing anything at all, where “1.0 is very likely a good interaction, 0.0 is very likely a bot”, and leaves the site to decide what a low score means (reCAPTCHA v3).

Why it happens: the usual causes

1. Many people share your address. A phone on mobile data, and some home connections, often sit behind carrier-grade NAT, a system “used to share the same IPv4 address among several subscribers” (RFC 6888); the internet’s standards even set aside a block of addresses for it, 100.64.0.0/10 (RFC 6598). A study published in 2016 found carrier-grade NAT in more than 90% of the cellular networks it measured (Richter et al.), and Cloudflare wrote in 2025 that one IPv4 address may stand for “hundreds or even thousands of users”, and that such addresses “are subject to rate limiting three times more often than non-CGNAT IPs” (Cloudflare). The problem was written down in 2011: a server that sees too many requests from one address may refuse them for a while, “or it may require completion of a CAPTCHA”, and on a shared address that catches everyone behind it (RFC 6269). Offices, schools, hotels and cafés share one address the same way: Google says you can get its message if others on the same network, “like at a school or business”, are sending automated searches (Google Search Help).

2. You use a VPN, a relay or a browser’s own VPN. A VPN gives you an address shared with its other customers. Google says you can get its message if “others that use the same Virtual Private Network (VPN) you use are sending automated searches to Google”, and that some VPNs and IPv6 tunnel services get all their traffic blocked because Google cannot tell the abusive traffic from the rest (Google Search Help). Browsers now carry their own: Microsoft Edge’s Secure Network, provided by Cloudflare, gives “5 GB of free data every month” (Microsoft Support), and Opera calls its VPN “completely free, built-in, unlimited, accountless” (Opera). On an iPhone, iPad or Mac, iCloud Private Relay gives Safari an address that “may be shared among more than one Private Relay user in the same area”, and Apple reminds website owners that protections built on IP addresses commonly answer with CAPTCHAs or blocks (Apple Developer). How sites treat a VPN beyond CAPTCHAs is its own subject: see how websites tell you are using a VPN.

3. Something on your network sends traffic you never see. Google says that “you or another user on your network might have malware”, and that some malware can cause the message (Google Search Help). It need not be a virus in the classic sense. Mellowtel, a library that pays browser-extension makers for their users’ spare bandwidth, loads websites in hidden frames inside the browser, over the user’s own connection, for Mellowtel’s customers. Secure Annex found it in 45 extensions in Chrome’s store, 129 in Edge’s and 71 in Firefox’s, and counted: “Nearly 1,000,000 users use extensions with Mellowtel installed.” (Secure Annex). A study from Northwestern University found that “only 16 of 116 Mellowtel-equipped extensions actively inject crawl iframes during a browsing session”, that browsers in the United States got up to 8.7 times more crawl tasks than others, and that the sites it loads include Google Search (Jang et al., IMC 2026). Mellowtel says users must opt in and that it does not collect or sell personal data (Mellowtel). Apps that pay you to share your internet, and cheap TV boxes that come with proxy software, do the same from your phone or your living room: see how to check whether your phone is being used as a proxy.

4. Your browser does not look like a normal browser. These checks read the browser as well as the address. Cloudflare’s challenge pages need both JavaScript and cookies: “Visitors must enable JavaScript and cookies” (Cloudflare). Cloudflare does not support extensions that change the browser’s User-Agent or Web APIs such as Canvas and WebGL (Cloudflare), and says script blockers, fingerprinting protection and canvas blockers can interfere (Cloudflare). The record that you passed is a cookie, cf_clearance, which lasts 30 minutes by default (Cloudflare), so a private window that starts without cookies, or a browser that clears them, has to pass again. Chrome also blocks third-party cookies in Incognito by default (Chrome Help). One CAPTCHA provider puts it plainly about its own product: you are asked often when “the browser is not allowed to save cookies, which tell the server you’ve already solved a captcha”, in Incognito mode and with a VPN (Yandex SmartCaptcha). If reCAPTCHA shows only the harder puzzles, Google’s advice is to update the browser, check that JavaScript is enabled and try disabling plug-ins that might conflict (reCAPTCHA Help).

5. You use Tor. The Tor Project says CAPTCHAs happen “because many people share the same Tor exit relays, not because Tor itself is unsafe”, and suggests asking Tor Browser for a new circuit for the site (Tor Support).

6. The site is under attack, or just strict. Google’s reCAPTCHA FAQ gives three reasons good users get stopped: “You may be on a shared network that is being used abusively”, your internet provider “may have recently assigned you a suspicious IP address”, or the site “may be currently under heavy attack” (reCAPTCHA FAQ). Cloudflare lists the inputs on its side: the address’s reputation (“If your IP has a history of suspicious activity, it may be flagged”), bot detection, and rules the site owner sets, for example for some regions or user agents (Cloudflare).

How to make it stop, in the order worth trying

1. Solve it once, then give it time. Solving Google’s reCAPTCHA clears its message, and the block lifts by itself shortly after the automated requests stop. A Cloudflare pass lasts 30 minutes by default.
2. Turn off any VPN, relay or browser VPN for that site. To show one site your own address in Safari, tap the Page Menu button and then Show IP Address on an iPhone or iPad, or choose View, then Reload and Show IP Address, on a Mac; your network provider can then see which site you visit (Apple Support). Google’s advice for a VPN that keeps triggering its message is to uninstall it or contact its provider.
3. Try another network, to find out where the problem is. Switch between Wi-Fi and mobile data. Cloudflare suggests a different network or device for challenges that keep failing (Cloudflare). If the checks stop on the other network, the address was the problem; if they follow you, look at the device and the browser.
4. Find what is sending the traffic. Remove browser extensions you do not recognise: Google’s Chrome Help counts unwanted extensions that keep coming back among the signs of malware (Chrome Help). Uninstall apps that pay you to share your internet, and check the other devices on your Wi-Fi, such as a no-name TV box (how to check).
5. Make your browser ordinary again. Update it, allow JavaScript and cookies for the site, and switch off extensions that change what the browser reports about itself.
6. On a shared network, tell whoever runs it. At a school, an office or an internet provider, Google’s advice is to contact the network administrator or the provider, who can find the source and stop it (Google Search Help).
7. If nothing helps, write to the site. Give the time and your IP address. On sites behind Cloudflare, “Only the website owner can configure their Cloudflare settings to stop the Challenge being presented” (Cloudflare).

Is my IP address flagged? How to see what a site sees

A site will rarely tell you why it stopped you, but you can run the same kind of check on your own visit. The live check on Maskbreak’s homepage and the VPN checker read the connection your visit came through and check the browser itself. They show the decision those checks lead to (allow, review or block), whether the connection was flagged as a VPN, a proxy or Tor, the VPN service by name when it is known, and what the browser check found. There is nothing to install and no account to make.

A clean result means this checker did not flag your connection at that moment, not that no site will: every provider’s data differs, and a shared address can be quiet one hour and busy the next. An address typed into a lookup box is not a visit and says much less: Maskbreak’s lookup of an address checks only the Tor exit list and published cloud ranges.

Why websites check at all

Sites put these checks in front of logins, signups, searches and checkouts because automated traffic is cheap to run: scripts that try stolen passwords, open fake accounts or copy whole sites. An address is the cheapest clue a site has, which is why shared addresses catch innocent people, and why better checks look at the browser too. A clean home connection does not get an automated browser through. This is the public sample answer from Maskbreak, the fraud detection API this blog belongs to, for a script driving a tampered browser over an ordinary home connection, from /v1/evaluate/sample?scenario=bot:

The address in that sample is clean; the browser gave it away. Under Maskbreak’s default policy a VPN on its own leads to a review rather than a block, while a known proxy exit or an automated browser is a block, and each site decides what a review means for it, such as confirming an email address instead of solving a puzzle. Site owners who want fewer CAPTCHAs in front of real people can read about bot detection without CAPTCHAs.