FBI Seizes NetNut Proxy Platform, Popa Botnet

The Federal Bureau of Investigation, in collaboration with industry partners, has seized hundreds of domains associated with NetNut, a large residential proxy service operated by the Israeli company Alarum Technologies. This action follows recent reports from security firms that linked NetNut to the Popa botnet, a network of at least two million compromised devices.

The FBI's seizure notice, which replaced NetNut's homepage, indicated the involvement of the Internal Revenue Service Criminal Investigation division. The notice also acknowledged contributions from Google, Lumen, Shadowserver, and other industry partners in dismantling the domains tied to the Popa botnet, which is closely associated with NetNut's proxy infrastructure.

Security researchers had previously identified NetNut as a residential proxy network that populates the Popa botnet. The service distributes software that transforms everyday home devices, such as smart TVs and streaming boxes, into always-on proxy nodes. These nodes are then rented out to individuals who predominantly use them for illicit online activities, including mass content scraping, advertising fraud, and account takeovers.

Google's Threat Intelligence Group (GTIG) noted that NetNut's proxy network is widely resold and white-labeled by various third-party providers. Cybercriminals frequently utilize NetNut's services to conceal the origin of their malicious traffic. GTIG observed a significant number of threat actor groups, including those involved in cybercrime and espionage, leveraging NetNut exit nodes within a single week in June 2026. These actors use NetNut to mask their IP addresses when accessing victim environments, their own infrastructure, or conducting password spray attacks.

Furthermore, when consumer devices become proxy exit nodes, unauthorized network traffic can pass through them. This exposes other private devices on the same home network to potential internet threats. Google stated that it disabled Google accounts and services used by NetNut for command and control of malware and shared technical intelligence about NetNut's software development kits and backend infrastructure with relevant parties. The company also disabled applications known to bundle NetNut's SDKs.

Omer Weiss, legal counsel for NetNut's parent company Alarum Technologies, confirmed awareness of the FBI seizure and stated the company is cooperating with investigators. Weiss emphasized the company's commitment to a thorough investigation of any misuse of its infrastructure.

Benjamin Brundage, founder of the proxy tracking service Synthient, one of the firms that published evidence linking the Popa botnet to NetNut, suggested that the domain seizures have significantly disrupted both the Popa botnet and NetNut's proxy network. Brundage believes this takedown will be a considerable blow to the cybercrime community, especially following earlier legal actions by Google against NetNut's main competitor, IPIDEA. He noted that NetNut had gained substantial popularity after the IPIDEA takedown and was comparable to IPIDEA in terms of traffic, quality, size, and pricing.

Brundage also suggested that the disruption of NetNut and the Popa botnet could help mitigate the impact of large distributed denial-of-service botnets that exploit poorly configured residential proxy services. He referenced a previous Synthient report detailing how cybercriminals built a large DDoS botnet by tunneling through IPIDEA proxy connections into the local networks of TV box owners. While major proxy providers have taken steps to block such activity, resellers have been slower to respond.

Google estimates that the recent actions have severely degraded NetNut's proxy network and business operations, reducing the available pool of devices by millions. However, Google cautions that proxy networks can reconstitute themselves by reselling services from other providers, as IPIDEA has reportedly done. Google indicated that many popular residential proxy brands may be white-labeling the NetNut botnet and anticipates that while this disruption will have a broad impact, individual networks can prove resilient. The company observed that when faced with botnet degradation, proxy operators often purchase capacity from competitors, effectively becoming resellers. Google believes that to achieve lasting disruption in this dynamic ecosystem, efforts must target the infrastructure of multiple interconnected providers.

The report also highlighted concerns about smart TVs and streaming devices, noting that many low-cost streaming boxes sold online come pre-installed with residential proxy software or require users to install proxy SDKs. Google advises consumers to purchase devices from reputable manufacturers and exercise caution with installed applications. Devices compromised by the Popa botnet and similar threats often use unofficial Android operating systems that lack Google Play Protect certification.

Consumers can verify if a device runs an official Android TV OS with Play Protect certification by following specific instructions. Additionally, smart TVs from manufacturers like Samsung and LG can become part of residential proxy networks through the installation of third-party applications. A recent report found that a significant percentage of apps available for LG's webOS and Samsung's Tizen operating systems contain SDKs that turn televisions into residential proxy nodes.