Googleโs Unusual Traffic Message
Googleโs page that starts โOur systems have detected unusual trafficโ appears when Google believes the network you are on is sending automated searches. It points at your computer network, not your Google account, and it is not a virus warning. Googleโs own help page names the usual causes, most of which involve other people or programs sharing your connection, and the fix depends on which of them applies.
Short answer
- Google means automated searches: robots, scripts, scrapers and rank-checking software. The message targets the network address, not your account.
- Shared connections are the common cause: office and school networks, VPN exits, carrier and provider addresses, tunnel services, and malware on any device behind the same address.
- Solve the reCAPTCHA if one appears. Google says the message goes away once you do, and stops recurring when the automated traffic stops.
- If you need search data at scale, Googleโs spam policies forbid scraping results for rank checking. Use its APIs and Search Console instead.
What Google says the message means
Googleโs help page on unusual traffic says the page appears when a network seems to be sending automated traffic to Google Search. It counts searches sent by robots, computer programs, automated services and search scrapers, and software that checks how a website ranks.
The same page lists where that traffic tends to come from:
- malware on a computer using the network
- other people on a shared network, such as a school or business
- other users of the same VPN; Google adds that some VPN and tunnel services are blocked entirely because it cannot separate abusive from normal traffic
- IPv6 tunnel services
- other customers of the same internet provider
Googleโs spam policies treat this activity as machine-generated traffic, including scraping results for rank-checking purposes without permission, and say it violates both those policies and the Google Terms of Service.
Why it keeps appearing on your connection
| Situation | Why Google sees automated traffic | What to do |
|---|---|---|
| Office, school or campus network | Someone elseโs scripts share the address | Tell the network administrator; use another connection meanwhile |
| VPN turned on | Many users share the exit; some services are blocked outright | Turn the VPN off for Google, or change provider |
| Phone on mobile data | Many subscribers share carrier addresses | Reconnect to get a different address; carriers do not promise one |
| Browser extension or adware | A program sends queries in the background | Remove unknown extensions and scan the device |
| Your own rank tracker or script | The software is the automated traffic | Stop it and move to an official API |
| Tunnel broker service | Tunnel addresses are shared and often abused | Use your providerโs native connectivity |
Address sharing is the thread through most of Googleโs list. Many networks put a large number of people behind a small number of public addresses. Mobile carriers do this at scale with carrier-grade NAT, for which RFC 6598 reserves the 100.64.0.0/10 range on the inside of the network. From Googleโs side, every subscriber behind the same public address looks like one source.
Fixes for everyday users
- Solve the reCAPTCHA. Google says the message disappears once you solve it. If no reCAPTCHA appears, check that JavaScript is on and that the browser supports reCAPTCHA.
- Check the address you are on. Note it on What is my IP. If it belongs to a VPN or a hosting company, that explains a lot.
- Turn off the VPN for searching, or contact the VPN provider, as Google suggests.
- Scan for malware and remove unknown extensions. A device on your home network can send queries without you seeing them.
- Ask the network owner. On shared networks only the administrator can find the source. Googleโs guidance for administrators is to find and block the automated traffic, after which users can search normally again.
- Contact your internet provider if it continues on a home connection with nothing unusual running.
Google does not publish how long the block lasts. Its page says only that once the automated searches stop, normal searching should return. Repeatedly reloading the search counts as more traffic, so give it time.
Because the decision is tied to the network address rather than the browser, switching browsers on the same connection rarely helps.
For SERP collection, use the APIs first
If the traffic is yours, because you are collecting rankings or results, the message is Google enforcing the policy above. More addresses or more proxies do not change that policy. The durable options are official:
- For your own siteโs queries, clicks and average positions, the Search Console API returns performance data straight from Google.
- For results from a configured search engine, check the current access rules first. Our Google search data guide covers the Custom Search JSON API closure to new customers and the January 1, 2027 migration date for existing ones.
- For broader market data, licensed data providers sell search observations collected under their own terms.
Location checks are a different job. Teams that verify how their own ads or listings appear in another country often look at a handful of results by hand from a local connection. Keep that manual and low volume, and use one stable connection per check. Our page on SEO monitoring explains where local carrier lines fit that kind of review.
How carrier addresses fit in
Carrier addresses behave like other shared addresses. The IETFโs RFC 6269 notes that penalizing a shared address for abuse also affects everyone behind it, which is exactly the situation Google describes for providers and VPNs. An address that serves many phones can be flagged because of one of them.
A line that only one customer uses avoids other peopleโs automated traffic on the same address while you hold it. On Coronium mobile proxies, each line is one physical device with its own SIM, rented to one customer. That changes who shares your address, not what Googleโs policy allows. Automated queries from any address are still automated queries.
Sources and review scope
Sources reviewed October 30, 2026. Vendor documentation was read on October 30, 2026. Where a vendor does not document a behavior, the article says so. We cannot see a websiteโs private rules, scores or account decisions, and no step here is certain to fix it.
Frequently asked questions
Other block pages and CAPTCHA errors
Each guide names the system behind the message, then lists the fixes in the order worth trying.
Related workflows
Where carrier lines fit Google workflows, and where they do not.
Local checks of your own rankings and listings.
Current API access and migration limits.
Tell an IP cause from a browser or pattern cause.
IPsum feed listings for a public IPv4 address.
The full set of error and checker guides.
Where to get a dedicated line
A Coronium mobile proxy is one physical device with its own SIM, rented to one customer. It connects over HTTP or SOCKS5, the IP changes by dashboard button, API link or timer, and data is not metered on dedicated lines. Brazil lines are the exception: 20 GB of data a month and a new IP on request only, with no timer. Stock and prices differ by country and carrier.