Device: Nexus 5, Android Version 6.0.1

Every time the phone is connected to my home wi-fi after a couple of minutes the phone uses my whole bandwidth to upload something to varying Google (1e100.net) Servers. I checked the Network Monitoring app and it tell me that the bandwidth is used by Google Play Services.

The Uploading has been going on for three days nonstop and the only way to stop it temporarily is to disable and re enable the wi-fi connection.

What is causing this, and how do I stop it?

  • 1
    Is Google Photos Backup or something similar turned on? If it just got turned on and you have a lot of photos/videos not backed up, that could be a benign cause. Malignant ones, IDK. – Tamoghna Chowdhury May 16 '16 at 11:11
  • Can you use netstat to filter which processes are behind the uploads? – Grimoire May 16 '16 at 13:33
  • I used netstat but I have no idea what to look for. I used an app wich groups the (upload) traffic by service and it told me that the google play services were doing it. – KTB May 16 '16 at 20:42
  • Install Opera Max, it will tell you how much data each app uses and how much of it is by WiFi and how much background data. – NVZ May 17 '16 at 5:47
  • I disabled Photo Backup after a lot of debugging and it solved the issue. The Backup feature seems to be broken (it does not seem to be able to calculate the status and just uploads forever) – KTB May 18 '16 at 20:47

I think you are infected with a malware that spy on your phone and upload to a comand and control server almost everything from your phone like: pictures, sms, whatsapp conversatin, facebook converstion, viber conversation etc, and to not affect your mobile data plan it starts the comunication with the server whenever you are connected to a wifi network... Im not a pro on android but I've done it before and I already know what happens behind, how it works and how it affects your phone. Do a backup but dont backup apps and after it try a factory reset. Install the list of apps u had from Play store again (Its better to backup only pictures/videos and contacts and nothing more) I hope it helps u.

  • That was my first thought, that's why I added the wiretrace and found out all the traffic goes to google servers. Is there malware that uses the Google Servers as some kind of proxy? – KTB May 16 '16 at 11:31
  • Of course there are examples .. For example like this project .. github.com/byt3bl33d3r/gcat it uses gmail as c&c server – user6314799 May 16 '16 at 12:05
  • No way for a non-app malware to issue commands to Play Services if your phone isn"t rooted. I'd say it's more likely that Photos is bugged. – Grimoire Apr 7 '19 at 16:13

This could be your router or something with the servers that Google Play uses. You could try upgrading your router or restarting it. It could also be caused by a certain type of malware. It could also be something going on with your internet provider.

  • 1
    This is way too open ended for an answer. It is best if you provide tools or instructions to narrow down the possibilities and reach a solid conclusion. – Firelord May 8 '19 at 22:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.