There is provided an unauthorized terminal inferring device (100) device that is connected to a plurality of communications terminal devices (IDi) by a multi-hop network. The device (100) includes a communications terminal information control portion (120) that controls identification information and key information for the communications terminal devices (IDi), a transmission portion (160) that transmits challenge information to the devices (IDi), a receiving portion (170) that receives from the devices (IDi) response information that corresponds to the challenge information, a response information verification portion (130) that verifies whether or not an authenticator that is contained in the response information is correct, and an unauthorized terminal device inferring processing portion (140) that, in a case where the verification result indicates that the response information is not legitimate, requests that each of the devices (IDi) retransmit received and generated information, then infers which communications terminal device performed the unauthorized behavior.