July 21, 2026
Ministry of Internal Affairs and Communications
National Police Agency Promoting Public-Private Collaboration to Counter Cyberattacks That Abuse Household IoT Devices

－ Publication of “Current Status of Residential Proxies That Abuse Household IoT Devices” and Establishment of the “Residential Proxy Countermeasures Alliance” －

　In recent years, cyberattacks have occurred in which household IoT devices are abused as launching pads to make the attacks appear to originate from ordinary households, thereby concealing the attackers’ location and identity. Such IoT devices used as launching pads are referred to as “residential proxies,” and it has been found that, in 2024, approximately 3 billion yen of the losses from fraudulent fund transfers related to Internet banking resulted from attacks carried out via such devices.
　The Ministry of Internal Affairs and Communications (MIC) and the National Police Agency (NPA), in cooperation with the National Institute of Information and Communications Technology (NICT) and other relevant organizations, have been studying measures to promote efforts to counter cyberattacks that abuse household IoT devices. MIC and NPA have compiled information on how residential proxies are being abused and measures to address such abuse, and are publishing the results.
　In addition, to promote measures across society, MIC and NPA will establish the “Residential Proxy Countermeasures Alliance,” in which a wide range of relevant entities will collaborate to discuss how to respond to residential proxy abuse.

Note: The published materials are available in Japanese only.

1　“Residential Proxies”*

　MIC and NPA, in cooperation with NICT and other relevant organizations, have been studying measures to promote efforts to counter cyberattacks that abuse household IoT devices. In the course of this study, they organized information on what residential proxies are, how they are being abused, and measures for users of IoT devices and other equipment. They have compiled this information as the “Current Status of Residential Proxies That Abuse Household IoT Devices” and are publishing it.

* IoT devices that use IP address ranges for residential users to relay third-party communications are referred to as “residential proxies.” This makes it difficult for victims of cyberattacks to distinguish communications originating from ordinary households from cyberattacks.

2　Establishment of the Residential Proxy Countermeasures Alliance

　There are considered to be various ways in which household IoT devices can become “residential proxies,” and in many cases, users are unaware that their devices are being abused. Therefore, it is necessary to raise users’ awareness of how IoT devices are being abused as residential proxies.

　In addition, as cyberspace increasingly becomes a public space, and given the current situation in which IoT devices are being turned into residential proxies through complex and sophisticated methods, a wide range of entities, including industry associations, telecommunications carriers, and security service providers, need to work together, recognizing their social responsibilities, to prevent such abuse across society.

　Against this backdrop, MIC and NPA will establish the “Residential Proxy Countermeasures Alliance” to discuss public awareness measures, approaches to coordinated responses among relevant parties, and the development of the necessary environment.