Key takeaways
- On November 4, Japan's National Police Agency (NPA) announced that Google, working with Japanese police, had taken down domains and servers behind residential proxies, home devices secretly used to relay criminals' traffic. Google's target was XCPE, a botnet of more than 1.3 million Android TV boxes whose maker had built a backdoor into the firmware.
- Japanese media called it neutralization (無害化). But the NPA says the takedown came from Google's legal action in the United States. The same was true of the NPA's takedown with Microsoft in October. Neither used the police's new power to neutralize attacking computers, in force since October 1.
- The police contribution was investigation. It began in September 2025, when Fukuoka police, tracing the source of an online banking fraud, found an IoT device with a malicious app built in.
- Residential proxies matter in Japan because they hide fraudsters behind ordinary home connections: at least 44% of online banking fraud cases in 2024 used them, according to the NPA.
- Cutting the servers does not clean the devices. XCPE's backdoor reinstalls itself from the firmware, so infected boxes in Japanese homes stay infected until they are replaced or reflashed.
What happened#
According to the NPA, the NPA, the Kanto Regional Police Bureau's Cyber Special Investigation Department and Fukuoka Prefectural Police had been working with Google on residential proxies since March 2026. Many of the devices involved run Google's Android. Google then took legal action and other steps in the United States, which led to the takedown of domains and servers used for residential proxies.
The trail started in Japan. In September 2025, Fukuoka police were investigating an online banking fraud and searched the place the unauthorized access had come from. There they found an IoT device with a malicious app built in. The Kanto bureau analysed the app, looked into how the device was made and sold, and passed what it found to Google.
Google's own account, published on November 3, describes the result. A Chinese device maker, Videostrong, had preinstalled a backdoor in the firmware of Android TV set-top boxes and other devices, with system-level privileges. It used obfuscation to get past Google's certification tests, then loaded malicious code after the first boot. More than 1.3 million boxes were enrolled in the botnet, which Google calls XCPE. The operator sold access to criminals, who loaded their own modules: residential proxy software that sells the device's internet connection as an exit point for other people's traffic, ad fraud tools and further backdoors.
Google says it took legal action to take down the domains and servers that controlled the botnet, and the command servers of more than a dozen malware families loaded through it, which it says cuts off at least 10 million more devices. It ended its relationship with Videostrong, banned it from making certified Android devices, and changed its certification process. It names Japan's NPA alongside Lumen, HUMAN Security, Plume, Synthient and TrendAI as partners.
Why residential proxies matter in Japan#
A residential proxy routes someone else's traffic through a device on an ordinary home connection. To a bank or a website, a fraudster logging in through one looks like a household in Japan, not a server abroad.
The NPA and the Ministry of Internal Affairs and Communications set out the scale in July:
- In 2024, at least 1,918 online banking fraud cases, about 44% of all cases and ¥2.89 billion in losses, involved residential proxies.
- NICT, the national research institute, has seen up to about 27,000 IP addresses a day acting as residential proxy exit nodes in Japan since January, suggesting tens of thousands of devices.
- Typical sources: streaming boxes sold with promises of free domestic and foreign TV, digital photo frames, routers and cameras, and apps that pay users to share unused bandwidth.
Kyodo News reported that, according to the NPA, at least 737 of 4,747 online banking fraud cases in 2025, about ¥1.39 billion, involved residential proxies.
The October takedown with Microsoft#
The NPA's first announcement of this kind came on October 15. Police at the Kanto bureau, Microsoft and the Japan Cybercrime Control Center (JC3) had been investigating phishing aimed at Japan since October 2025 and identified the infrastructure behind it. On October 6, Microsoft and others filed a lawsuit in a US court. The court issued an order on October 8, and the infrastructure was taken down under it.
The pattern is the same in both cases: Japanese police investigate and identify the infrastructure, and a US company uses civil legal action in its home courts to take it down.
Not the new "neutralization" power#
Since October 1, the active cyber defense law has given Japan's police a power to access and neutralize computers used in attacks, normally with the prior approval of an independent oversight commission. Kyodo's headline on November 4 said the police had "neutralized" (無害化) the servers, which invites readers to think the power has been used.
The NPA's own releases do not say that. Both describe the companies' legal action in the United States as what led to the takedowns. As of November 8, we have seen no announcement that the police neutralization power has been used.
What this means#
Neither takedown needed the new law. Domains and servers abroad were taken down the way US companies and authorities have done it for years: through legal action in US courts. Japan's role was the investigation that pointed at them.
The devices are still in Japanese homes. Google notes that XCPE's backdoor reinstalls itself from a protected part of the firmware after a reboot. Cutting the command servers stops the operator using the boxes for now, but the infected devices remain, and the operators move quickly to new infrastructure. Owners need clean firmware, or should stop using the device.
The emergency package builds on this. The government's emergency package of November 6 adds a nationwide police joint investigation and other steps; both takedowns came before it.
Our view#
This is good work, described with the wrong word. Tracing a fraud back to a box in a Japanese home, analysing its firmware and getting the platform owner to act is exactly the kind of investigation that can make a difference against residential proxies. But calling the result "neutralization" mixes it up with the new legal power, and makes it look as if active cyber defense has started. It has not, and the difference matters: the October law was sold to the public on neutralization, and the public should be able to tell when it is actually used.
The test we set for the law is still open. When the law took effect, we wrote that its real test is whether Japan can take down botnets, including cleaning the infected devices inside the country. The XCPE case shows both sides of that. Japan can now help take down the servers, through partners abroad. The devices in Japanese homes are still infected, and no one has yet tried to deal with them under Japanese law.
Reliance on US courts and US companies has limits. It works when a large US platform has both the evidence and the legal standing, as Microsoft and Google did. Many of the services and devices used against Japanese victims have no such owner. A Japanese route to the same result, with oversight, is still needed.
What this means for readers and practitioners#
- Don't buy "free TV" boxes or bandwidth-sharing apps. The NPA and Google both name them as the main way homes become proxies. Buy streaming devices from known makers; Google publishes a list of certified Android TV partners.
- If you own an unbranded Android TV box, assume it may be compromised. A factory reset is unlikely to remove a backdoor built into the firmware.
- Banks and online services should treat a Japanese home IP address as weak evidence that a login is genuine.
- Watch for the first real use of Article 6-2 of the Police Duties Execution Act, and how it is explained.
Japanese terms at a glance#
| Japanese | Reading | Meaning |
|---|---|---|
| レジデンシャルプロキシ | rejidensharu purokishi | Residential proxy |
| テイクダウン | teiku daun | Takedown |
| 無害化 | mugaika | Neutralization |
| 犯罪インフラ | hanzai infura | Criminal infrastructure |
| 不正送金 | fusei sōkin | Fraudulent money transfer |
| 関東管区警察局サイバー特別捜査部 | Kantō kanku keisatsukyoku saibā tokubetsu sōsabu | Kanto Regional Police Bureau Cyber Special Investigation Department |
| 民事訴訟 | minji soshō | Civil lawsuit |
| 警察官職務執行法 | keisatsukan shokumu shikkō hō | Police Duties Execution Act |