The traffic had been recorded as coming from her home.
Cybercrime: Malice in Everyday Life — Part 7
You don't have to be someone special to be targeted.
Everyday life has unseen points of entry. Drawing on publicly available information, we trace how these threats unfold quietly and how their consequences eventually surface in everyday life.
The police came to her door that morning
A little after 8 a.m.
Gina, a freelancer, was just starting up her computer when the doorbell rang.
She opened the door. Two police officers were standing outside.
"We'd like to ask you a few questions."
Gina was taken aback by the unexpected visit.
The officers explained that the IP address assigned to her home internet connection had appeared in traffic logs related to an unauthorized-access incident involving a financial institution.
"Who was using this connection at that time?"
Gina had no idea what they were talking about.
She had never attempted to break into a financial institution. She used online banking only to check her own account.
"Could there have been some mistake?"
She said this, but the officers told her they were following up on the basis of the records they had obtained.
It was the first time Gina had learned that records existed showing criminally related traffic coming from her home.
The computer she used every day
Gina worked from home.
She had bought her Windows PC for work a few years earlier. Email, documents, video calls, online banking—nothing out of the ordinary.
A few months before, she had installed a free VPN app so she could communicate securely when working away from home.
She had found the service online. It said she could connect to servers in other countries.
She did not feel she needed to pay for a subscription. Since it was free, she thought she would give it a try.
Nothing seemed wrong after she installed it.
Her computer had not become slower. No unfamiliar files had appeared.
There were days when she did not use the app, but she had no particular reason to uninstall it.
Gina had installed free software many times before. She liked trying useful tools she came across, and she had antivirus software installed as well.
She did not consider herself careless about security.
The connection came from here
To help answer the police's questions, Gina arranged to have the computer and network environment she had been using at the time examined.
During the investigation, suspicious activity was found in an app she had installed.
Her PC had been communicating with external systems even when she was not using it.
And this was not ordinary app updating or routine background traffic.
A malicious program had entered her computer without her knowledge.
The program was using Gina's PC to relay communications for someone else.
Someone somewhere else was connecting to the internet through her computer.
To an external service, the traffic appeared to originate from the IP address assigned to Gina's home.
In other words, the person actually operating the connection was somewhere else, but the records showed Gina's home as the source.
The actual criminal
|
| Traffic routed remotely
v
[Gina's PC]
Malicious program
|
| Through Gina's internet connection
v
[Internet]
|
| Unauthorized access
v
[Financial institution]
|
v
Source IP address
recorded in logs
|
v
Gina's home
Gina had not been doing anything.
Even so, her PC had been used in someone else's crime.
And the organization on the receiving end had a record showing that the access came through Gina's connection.
An everyday connection turned into a relay without her knowledge
This kind of traffic relaying is known as a residential proxy.
Like an ordinary proxy, it is a way to route someone else's traffic. What distinguishes it is that the traffic passes through IP addresses assigned to households or small businesses. The technology itself is not necessarily criminal or dangerous. Some services allow people to participate in relaying traffic after they have understood and agreed to the terms.
The problem arises when a device is infected with malware and used as a relay without its owner's knowledge or consent, or when criminals abuse such a system to conceal their activity. This article focuses on that kind of unauthorized use.
By routing their traffic through an infected device and the household's internet connection, attackers can conceal where they are really connecting from.
The people whose connections are being used may have no idea that their devices or internet service are being used in criminal activity.
In May 2024, the U.S. Department of Justice announced the dismantling of a massive botnet known as 911 S5, which used this kind of infrastructure.
According to the Department of Justice's investigative materials, as of September 2022, more than 19 million unique IP addresses worldwide were associated with compromised devices in the 911 S5 network.
Around 220,000 IP addresses were available for use at any one time.
The owners of the infected PCs did not know their devices were being abused.
The malware had been distributed in forms concealed within unauthorized software and free VPN programs.
The approach also involved an element of social engineering: it played on people's expectations and judgment by promoting the software as free or convenient.
As a result, ordinary household computers became part of a network of relays offered to criminals.
According to the U.S. Department of Justice's investigative materials, criminals using this network were involved not only in bank fraud, loan fraud, and credit card fraud, but also in crimes involving bomb threats, stalking, and child exploitation.
For criminals, it was a convenient way to hide their identities.
And the relay points being used without their owners' knowledge belonged to ordinary households around the world.
An IP address is not a person's name
There is something important to understand here.
Just because an IP address appears in a record does not mean the person who subscribes to that connection committed the crime.
An IP address is an important clue for identifying the source of network traffic. But by itself, it cannot identify the person who was actually operating the computer.
For example, when family members share the same Wi-Fi connection, an IP address alone cannot tell you who used which device.
And when, as in this case, a third party abuses a device or internet connection as a relay, the location recorded in the traffic logs may be different from the location of the person actually operating it.
The U.S. Department of Justice's investigative materials on 911 S5 also point out this problem.
If investigators focus only on the location associated with an IP address used in a crime, suspicion may fall on an unrelated household or computer owner, while the actual perpetrator goes undetected.
Someone like Gina can therefore be both a victim whose device was used in a crime and a person who may come under suspicion during an investigation.
Gina tried to explain that she had done nothing wrong.
But she could not account for every connection her PC had made, when the misuse had begun, or who had been using it.
That was only natural. It had all happened without her knowledge.
Records she did not recognize
The investigation later confirmed the presence of a malicious program, allowing Gina to explain that her PC may have been abused by a third party.
Even so, examining a computer does not necessarily reveal every detail of its past network activity.
When had the infection occurred?
How much traffic had been relayed during that time?
What crimes had been carried out through Gina's PC?
Not everything can necessarily be uncovered.
She stopped using the PC and sought professional help to deal with the malicious program.
Even so, records held by financial institutions and other organizations still showed the IP address assigned to Gina's home.
She had not committed a crime.
But records existed showing that traffic related to a crime had come from her home.
She never meant to be involved in a crime
We think of our computers and smartphones as devices we use for ourselves.
We shop online. Watch videos. Work. Check our bank balances.
Very few of us know everything our devices are doing behind the scenes.
What kind of traffic does an app we installed generate?
Under what terms is a free service being provided?
Is our device relaying someone else's communications?
We cannot monitor all of this every moment of the day.
But a device working normally is not necessarily a device working as we intend.
"I don't have any information worth stealing."
Even so, the attacker may not be interested in your information at all.
Your computer. Your internet connection. Your IP address.
What if those things have value to someone you have never met?
Whenever Gina opened her computer, she found herself paying a little more attention to its network activity than before.
But the familiar desktop still appeared on the screen.
Nothing had changed.
And that was what felt most unsettling of all.
References
U.S. Department of Justice, "911 S5 Botnet Dismantled and Its Administrator Arrested in Coordinated International Operation" (May 29, 2024).
https://www.justice.gov/archives/opa/pr/911-s5-botnet-dismantled-and-its-administrator-arrested-coordinated-international-operationU.S. District Court for the Eastern District of Texas, "Affidavit in Support of Application for Seizure Warrant," In the Matter of the Seizure of Property Associated with 911 S5, Case No. 4:24-mj-00365-KPJ, filed May 21, 2024.
https://www.justice.gov/opa/media/1353521/dl?inline=FBI Internet Crime Complaint Center (IC3), "Guidance on the 911 S5 Residential Proxy Service" (May 29, 2024).
https://www.ic3.gov/PSA/2024/PSA240529Federal Bureau of Investigation (FBI), "Evading Residential Proxy Networks: Protecting Your Devices from Becoming a Tool for Criminals" (March 12, 2026).
https://www.ic3.gov/PSA/2026/PSA260312National Institute of Information and Communications Technology (NICT), Japan, "Publication of a Factsheet on the Current State of Residential Proxies Exploiting Consumer IoT Devices" (July 21, 2026). Jointly published with Japan's Ministry of Internal Affairs and Communications and National Police Agency.
https://www1.nict.go.jp/press/2026/07/21-1.htmlInformation-technology Promotion Agency (IPA), Japan, "Methods and Countermeasures for Email-Based Attacks Targeting Organizations" (August 3, 2026). See the explanation of social engineering.
https://www.ipa.go.jp/security/support/abuse_email.html
Gina, the police visit, the connection to an unauthorized-access incident involving a financial institution, and the specific circumstances of the infection are fictional reconstructions based on publicly available investigative materials and guidance from public institutions. The 911 S5 botnet and its dismantling were real, but this story does not recreate the experience of a specific victim or an actual investigation. NICT and IPA are Japanese public-sector organizations; the Ministry of Internal Affairs and Communications and National Police Agency are Japanese government bodies. The other government and law-enforcement organizations cited above are based in the United States.
Top comments (0)