On July 2, 2026, Google’s Threat Intelligence Group joined the FBI, the IRS Criminal Investigation division, and network intelligence firm Lumen to take down NetNut, one of the largest residential proxy networks on the open internet. The FBI seized hundreds of domains tied to the operation and swapped NetNut’s homepage for a seizure notice. Google disabled the accounts and services the network leaned on for command and control, then used Google Play Protect to shut off Android apps that had quietly bundled NetNut’s software inside otherwise ordinary apps.
The scale is what sets this apart from a routine malware takedown. Investigators say the network ran on at least 2 million devices, most of them smart TVs and streaming boxes sitting in ordinary living rooms, each one turned into an exit point for someone else’s traffic. And unlike most botnet operators, who hide behind aliases and bulletproof hosting, NetNut has a name, a stock ticker, and a headquarters address. It is operated by Alarum Technologies, a company that trades on the Nasdaq under the symbol ALAR. That detail alone makes this takedown one of the stranger entries in this year’s cybersecurity file, a federal law enforcement action aimed at infrastructure sold openly by a publicly traded firm.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What Actually Happened on July 2
Google’s own account of the action is blunt. “Today, in coordination with the FBI, Lumen, and others, Google took action against the NetNut residential proxy network, also known as Popa,” the company’s Threat Intelligence Group wrote in a blog post. The Register reported that Shadowserver, a nonprofit that tracks and helps dismantle malicious infrastructure, also worked the case alongside Google, Lumen, and the FBI.
The mechanics of the takedown split across two tracks. On the technical side, Google disabled the Google accounts and services that NetNut’s back end used to manage its network of devices, cutting off a channel the operators needed to keep the proxy pool running. On the legal side, the FBI executed seizure warrants against hundreds of domains, a move KrebsOnSecurity reported included a seizure banner posted by the FBI and IRS Criminal Investigation on NetNut’s own homepage. The Hacker News detailed a third piece: Google Play Protect flagged and disabled Android apps that had bundled NetNut’s software development kit, the mechanism that quietly turned ordinary phones, tablets, and set-top boxes into paid exit nodes for other people’s traffic.
Google framed the result in confident terms, saying the operation caused “significant degradation to NetNut’s proxy network and its business operations, reducing the available pool of devices for the proxy operator by millions.” That is a strong claim, and three weeks of follow-up measurement, covered later in this piece, suggests the real picture is messier than a clean kill.
Inside the Popa Botnet: How 2 Million Home Devices Got Enrolled
NetNut marketed itself for years as a legitimate residential proxy provider, the kind of service ad-verification firms, price-comparison tools, and web-scraping operations pay for so their traffic looks like it’s coming from a real home connection rather than a data center. That distinction matters to fraud-detection systems, which are far better at flagging traffic from data-center IP ranges than traffic that appears to originate from a residential ISP account.
The problem, according to Google and multiple outlets covering the takedown, is how a large slice of that device pool got enrolled in the first place. Reporting from The Register and a buyer’s-guide postmortem published by proxy-seller.com both describe a network built largely on smart TVs and streaming boxes running proxy SDKs bundled into Android apps, often without the device owner’s informed consent. Google’s response, disabling flagged apps through Play Protect, only makes sense if a meaningful share of the 2 million devices got there through exactly that path rather than a customer knowingly installing proxy software.
That is the core tension running through this story. A residential proxy network can be a legal data-collection tool for paying business customers and, at the same time, rely on a device pool that was never properly asked for consent. Google’s Threat Intelligence Group and the FBI treated NetNut as the latter: infrastructure that supported malware command-and-control traffic and concealed malicious activity behind residential IP addresses, not merely a scraping utility that occasionally got misused.
The formal takedown did not come out of nowhere. KrebsOnSecurity reported that on June 19, 2026, three separate research groups, Spur, Synthient, and Nokia Deepfield, independently published findings tying NetNut to the Popa botnet. Separately, researchers at Qurium said their own analysis linked Popa to NetNut’s infrastructure and traced the botnet’s operation back to 2020, meaning the network had likely been running in some form for roughly six years before Google, the FBI, and IRS-CI moved against it.
Who Is Alarum Technologies, and What Did It Say
NetNut is a product of Alarum Technologies, an Israeli company publicly traded on the Nasdaq under the ticker ALAR, according to KrebsOnSecurity’s reporting on the FBI seizure. That is an unusual position for a network federal agencies just linked to a botnet. Most residential proxy takedowns target operators who never registered a business, filed a prospectus, or answered to shareholders.
Alarum did respond. The Hacker News reported that the company’s legal counsel, Omer Weiss, said Alarum “takes this matter seriously and will fully cooperate with law enforcement to ensure any misuse of its infrastructure is thoroughly investigated and those responsible are held to account.” That statement draws a careful line: it does not admit the company knowingly ran a botnet, and it frames the issue as misuse of infrastructure rather than a business model built on it.
The market noticed. Industry coverage tracking the stock in the days after the seizure reported that Alarum’s shares fell roughly 67% to about $2.62 by July 8, 2026, a steep drop for a company whose core product had just been labeled a botnet by Google and the FBI in the same week. That figure comes from trade-press coverage rather than a wire-service financial report, so treat the precise percentage as directionally accurate rather than exact, but the scale of the move leaves little doubt that investors treated the takedown as a material threat to Alarum’s business rather than a contained PR problem. What remains unchanged is the legal picture: no criminal charges have been filed against the company or any named executive as of this writing.
No Arrests, No Charges: Why This Takedown Looks Different
Public reporting on the NetNut action does not show a single arrest, indictment, or criminal charge filed against a named individual. That is a meaningful gap compared with past botnet cases, and it is worth sitting with rather than glossing over.
What happened on July 2 was an infrastructure disruption: domain seizures, disabled accounts, and blocked apps, carried out under civil and administrative authority rather than a grand jury indictment. That is a materially different legal action than, say, the arrest of a botnet administrator on wire fraud and money-laundering charges. It leaves open questions a criminal case would normally answer. Who inside Alarum approved the SDK bundling deals with app developers? Did the company know how many devices were enrolled without clear consent? Those questions sit with regulators and Alarum’s own board for now, not with a federal indictment.
Google’s Second Proxy Network Takedown of 2026
NetNut is not an isolated action. Google’s own blog post says the operation “builds on our disruption of the IPIDEA proxy network that took place in January 2026,” describing both as part of “a continuation of Google’s objective to dismantle malicious residential proxy networks.” That framing matters for anyone trying to size up where this is headed: two major residential proxy disruptions in seven months from the same company, working with the same core partners at the FBI and Lumen.
A pattern with two data points is still a pattern. Google’s threat intelligence arm has effectively declared open season on the residential proxy industry’s gray zone, the space between legitimate data-collection vendors and services that quietly monetize devices enrolled without clear consent. Every proxy provider with an SDK-bundling business model just watched a Nasdaq-listed competitor get named in a federal seizure notice.
| Category | Detail |
|---|---|
| Action date | July 2, 2026 |
| Network names | NetNut (commercial brand), tracked as the “Popa” botnet |
| Parent company | Alarum Technologies (Nasdaq: ALAR), Israel |
| Agencies and partners involved | Google Threat Intelligence Group, FBI, IRS Criminal Investigation, Lumen, Shadowserver |
| Reported device count | At least 2 million, mostly smart TVs and streaming boxes |
| Enrollment method | Proxy SDKs bundled into Android apps, per Google and The Hacker News |
| Domains seized | Hundreds, per the FBI/IRS-CI seizure notice reported by KrebsOnSecurity |
| Arrests or charges | None reported as of this writing |
| Prior related action | Google’s disruption of the IPIDEA proxy network, January 2026 |
Why Residential Proxy Networks Are a Cybercrime Favorite
To understand why Google and the FBI care about a proxy service at all, it helps to know what makes residential IP addresses valuable to begin with. Fraud-detection systems at banks, ad networks, and e-commerce platforms are tuned to distrust traffic from known data-center IP ranges, the kind cloud servers use. Traffic that looks like it’s coming from a home broadband connection in Ohio or Osaka gets far more benefit of the doubt.
That is exactly what a residential proxy network sells: the ability to route traffic through a real consumer IP address instead of a data center. Legitimate customers use that for ad verification, travel-fare comparison, and market research. Criminal customers use the same mechanism to make credential-stuffing attempts, account takeovers, and scraping runs look like ordinary consumer browsing. Google’s stated concern with NetNut was narrower than that broad category. The company said the network specifically supported malware command-and-control traffic, meaning infected machines elsewhere were phoning home through NetNut’s residential IP pool to avoid detection, on top of whatever above-board scraping business the network also ran.
How NetNut Compares to the 911 S5 Botnet Bust
NetNut is large, but it is not the largest residential proxy takedown in recent memory. That distinction still belongs to 911 S5, a botnet the Justice Department dismantled in May 2024. FBI Director Christopher Wray called it “likely the world’s largest botnet ever,” built on more than 19 million unique IP addresses across upwards of 190 countries, according to the FBI’s public guidance on the case.
The 911 S5 case also ended very differently. DOJ investigators arrested YunHe Wang, a 35-year-old Chinese national who had obtained citizenship by investment in St. Kitts and Nevis, and charged him with conspiracy to commit computer fraud, wire fraud, and money laundering. Prosecutors linked the network to roughly 560,000 fraudulent unemployment insurance claims and said government fraud losses tied to the operation topped $5.9 billion. The Treasury’s Office of Foreign Assets Control followed with sanctions against Wang and two associates, Jingping Liu and Yanni Zheng, plus three entities, according to a Treasury press release.
Set side by side, the two cases show how differently the same basic crime can be prosecuted depending on who is running it.
| Metric | 911 S5 (2024) | NetNut / Popa (2026) |
|---|---|---|
| Announced | May 29, 2024 | July 2, 2026 |
| Lead agencies | Justice Department, FBI | Google Threat Intelligence Group, FBI, IRS-CI, Lumen, Shadowserver |
| Reported scale | 19 million-plus unique IP addresses, 190-plus countries | At least 2 million devices |
| Operator | YunHe Wang, arrested and criminally charged | Alarum Technologies (Nasdaq: ALAR), no arrests or charges reported |
| Financial impact cited | More than $5.9 billion in government fraud losses | Not quantified in public reporting |
| Outcome so far | Administrator arrested, Treasury sanctions imposed | Domains seized, accounts disabled; partial displacement to rival proxy providers reported weeks later |
Is NetNut Really Gone? The Bright Data Migration Problem
Google’s claim of “significant degradation” is backed by real seizures and disabled accounts, but a network of 2 million devices does not evaporate the moment a domain gets replaced with a law enforcement banner. A measurement report published by layer3intel roughly two weeks after the action found that 28% of NetNut’s previously observed IP addresses were still reachable, now routed through Bright Data, a rival residential proxy provider whose own published rate card in July 2026 listed residential proxy pricing at $1 to $8 per GB, with volume discounts pushing the effective rate toward roughly $1/GB for high-volume customers, a wide band that straddles the $4.20-per-GB entry price Proxyway’s independent pricing research had recorded for Bright Data’s residential tier back in May 2025, a methodology Proxyway has since scaled considerably, running 3.6 million benchmark requests across 13 providers as of its June 2026 pricing survey.
That single data point does a lot of work. It suggests the takedown disrupted NetNut’s business and domains without cleaning every enrolled device, and that a meaningful share of the underlying device pool simply got re-monetized by a different proxy operator rather than disconnected from the proxy economy altogether. A separate industry post-mortem, published by proxy-seller.com under the heading “Life after NetNut,” reads like a migration guide for business customers who suddenly lost access and needed a new vendor within days. Among the options such guides pointed displaced customers toward, Thordata rolled out an upgraded residential proxy tier in July 2026 that bundled in 10% extra traffic and advertised pricing as low as $0.65/GB, according to a 24-7PressRelease announcement, a pitch clearly timed to catch business squeezed by NetNut’s disruption. That undercuts what Proxyway’s May 2025 pricing survey had found for DataImpulse, another residential provider often named in the same buyer’s guides, which listed entry-level access at $50 scaling up to $450 for a full terabyte, a reminder of how quickly published proxy benchmarks have moved in the space of a little over a year. That is not the language of an industry that views residential proxies as inherently illegitimate. It is the language of a market segment absorbing a supply shock.
Market Impact: What This Means for the Proxy Industry
Residential proxy services occupy an odd corner of the internet economy. They are legal to operate, widely used by legitimate businesses, and simultaneously attractive to fraud operators precisely because the legitimate use case provides cover. The NetNut takedown puts pressure on that whole category in three directions at once.
First, competitors benefit. Bright Data’s appearance in the layer3intel migration data is not a coincidence, and it is not the only new option flooding into the gap NetNut left behind: CatProxies launched its own 10 million-IP residential proxy network in January 2026, with pricing that started at $2.50/GB and, per a PR Newswire announcement, could drop to $1/GB at volume, positioning itself squarely for customers shopping for a replacement, against a broader market backdrop where Proxyway’s own tracking put the median residential proxy price at $3.75 per gigabyte for standard 5 GB plans as of June 2026, the benchmark displaced NetNut customers are now shopping against. When a major proxy provider goes dark, its paying business customers, the ad-verification firms and price-monitoring tools with legitimate contracts, need a replacement immediately, and rivals are positioned to absorb that demand. Second, consent standards are about to get more scrutiny. Google’s decision to route part of its response through Play Protect, disabling apps that bundled NetNut’s SDK, signals that platform-level enforcement against undisclosed proxy SDKs is now an active tool, not a hypothetical one. Any app developer who bundled similar software for ad revenue has reason to worry. Third, Alarum’s position as a public company changes the calculus for the entire sector. Institutional investors who might otherwise ignore a niche infrastructure vendor are now watching a Nasdaq-listed proxy company navigate a federal domain seizure in real time, and that scrutiny will likely extend to other publicly traded or venture-backed proxy providers going forward.
The Legal Gray Zone Around Residential Proxies
No US federal statute bans residential proxy services outright. What gets prosecuted, or in NetNut’s case, disrupted through civil and administrative means rather than criminal charges, is the method of enrollment and the specific downstream use. Buying computing time on a data center is legal. Renting out home IP addresses that device owners knowingly opted into, with clear disclosure and consent, sits in a defensible legal space many providers occupy today.
Where it turns into a federal case is the gap between what a terms-of-service document says and what device owners actually understood when they installed an app. Bundling a proxy SDK inside a free Android app, without a clear and conspicuous disclosure that the device will be used to relay someone else’s traffic, is the pattern Google and the FBI targeted here. That is also the exact pattern regulators in the US and EU have been circling for the past two years across the broader adtech SDK ecosystem, and NetNut’s case gives them a fresh, concrete example to point to.
What Security Teams Should Watch For Now
For enterprise defenders, the practical takeaway isn’t about NetNut specifically, since Google says that network is now degraded. It’s about the broader pattern: attackers who relied on NetNut’s residential IP pool for command-and-control cover need a replacement, and history suggests they will find one quickly, whether that’s Bright Data, a smaller regional provider, or a fresh SDK-bundling scheme nobody has flagged yet. Security teams that built detection rules around NetNut’s known IP ranges should expect those signatures to age out fast.
A simple, low-cost step is reviewing outbound connection logs for patterns consistent with residential-proxy relay traffic rather than chasing a specific vendor’s IP ranges, which shift constantly. The snippet below is illustrative, not a finished detection rule, but shows the kind of query worth building into a log pipeline.
# Example: surface repeat outbound connections to residential ASNs
# that don't match your organization's expected consumer-ISP allowlist.
# Intended as a starting query for a SIEM or log pipeline, not a finished rule.
grep -Ei "connect|outbound" /var/log/network/flow.log \
| awk '{print $1, $4, $6}' \
| sort | uniq -c | sort -rn \
| head -30Pair that kind of review with an internal audit of any Android or set-top-box apps your organization distributes or recommends to employees. If a free app monetizes through a bundled SDK, ask what that SDK actually does on the device. That question would have caught NetNut’s enrollment mechanism years before Google and the FBI got involved.
Competitive Landscape: Where NetNut Sat in the Proxy Market
NetNut built its reputation as one of the older, more established names in residential proxies, competing for enterprise scraping and ad-verification contracts against providers like Bright Data, Oxylabs, IPRoyal, Rayobyte, and a long tail of smaller regional services. Proxyway’s June 2026 benchmarking found residential proxies now account for 35% of Rayobyte’s revenue, a sign of how central that single product line has become even to providers with broader service catalogs. IPRoyal, for comparison, was advertising residential proxies starting at $7.00/GB for a single gigabyte but falling to $1.75/GB for bulk residential traffic as of March 2026, per Apify, with that same March 2026 pool adding HTTP/3 support, underscoring just how competitive and fast-moving pricing in this corner of the market had become even before NetNut’s collapse, with rates across the sector clustering around the $3.75-per-GB median Proxyway measured for standard 5 GB residential plans in June 2026. That business sat alongside, and reporting suggests was partly built on, the device pool Google and the FBI now describe as the Popa botnet.
The immediate competitive effect is straightforward: paying customers who need residential IP coverage for legitimate scraping or verification work had to move somewhere, fast, and the layer3intel data shows at least some of that traffic landed with Bright Data within weeks. The longer-term effect is less certain, though early signals point toward residential IP products becoming an even larger share of the business for providers across the board: Proxyway found residential proxies climbed to 30-40% of Byteful’s business over the course of 2025, up from a smaller share in prior years. If regulators or platform operators start treating SDK-bundling enrollment as a red flag across the whole industry, and not just for NetNut, every major residential proxy provider will face pressure to document exactly how its device pool got built and whether owners meaningfully consented.
Predictions: What Happens Next
- More disruptions are coming. Google explicitly framed NetNut as a continuation of the IPIDEA action from January 2026, not a one-off. Expect at least one more residential proxy network to face a similar Google-FBI-Lumen style disruption before the end of 2026.
- Alarum faces regulatory and investor scrutiny beyond this news cycle. A Nasdaq-listed company named alongside a botnet designation typically draws follow-up questions from exchanges, auditors, or shareholders, even without criminal charges attached.
- Rival providers will market “consent-verified” device pools as a differentiator. Expect Bright Data, Oxylabs, and others to lean harder into transparency claims about how their residential IPs get sourced, using NetNut’s seizure notice as the cautionary example.
- Full remediation will take months, not days. The 28% of NetNut IPs still reachable through Bright Data weeks after the takedown suggests a meaningful chunk of the original 2 million devices will keep circulating in the proxy economy under a different brand rather than disappearing.
- Expect renewed pressure on Android SDK disclosure rules. Google’s use of Play Protect to disable apps bundling NetNut’s SDK sets a precedent platform holders can point to the next time a similar bundling scheme surfaces.
What This Means for Everyday Consumers
Most people whose smart TV or streaming box got quietly folded into the Popa botnet never signed up for anything resembling a proxy service. They downloaded a free app, most likely one that offered some other feature in exchange for ad support, and a bundled SDK did the rest in the background. The practical fallout for those households is limited but real: a share of their home bandwidth and their device’s processing power was, for some period, being resold to route someone else’s traffic, without a clear opt-in.
There is no confirmed public list of affected device models or app names in current reporting, so blanket advice is limited to the basics: keep smart TV and streaming box firmware current, review which apps have background network permissions where your device allows it, and treat unusually persistent background data usage on a “smart” device as worth investigating rather than ignoring.
Frequently Asked Questions
What is NetNut?
NetNut is a residential proxy service that let paying customers route their internet traffic through real consumer IP addresses instead of data-center servers. It is owned by Alarum Technologies, a company traded on the Nasdaq under the ticker ALAR.
What is the Popa botnet?
Popa is the name Google and security researchers used to track the underlying network of at least 2 million enrolled devices, mostly smart TVs and streaming boxes, that powered NetNut’s proxy service. Google and the FBI treated Popa and NetNut as effectively the same infrastructure.
How many devices were affected by the NetNut takedown?
Reporting from The Register, KrebsOnSecurity, and other outlets puts the figure at least 2 million devices, most of them smart TVs and streaming boxes rather than PCs or phones.
Did the FBI arrest anyone in connection with NetNut?
No. Public reporting as of this writing does not show any arrests, indictments, or criminal charges filed against Alarum Technologies or any named individual. The action so far has been limited to domain seizures and disabled accounts.
Is Alarum Technologies still in business after the takedown?
Yes. Alarum has not been shut down, delisted, or criminally charged. Its legal counsel issued a statement saying the company would cooperate with law enforcement, and it remains a publicly traded company on the Nasdaq.
Is NetNut completely shut down now?
Not entirely. A measurement report from layer3intel found that roughly 28% of NetNut’s previously tracked IP addresses were still reachable weeks after the takedown, now routed through rival proxy provider Bright Data, suggesting a partial disruption rather than a full shutdown.
How does this compare to the 911 S5 botnet takedown?
911 S5 was roughly ten times larger by device count, with more than 19 million unique IP addresses, and ended in a criminal arrest, federal charges, and Treasury sanctions against its administrator, YunHe Wang. NetNut’s takedown, by contrast, has so far involved no arrests or charges, and its operator is a publicly traded company rather than an anonymous individual.
Why do cybercriminals use residential proxy networks in the first place?
Fraud-detection systems trust traffic from home internet connections far more than traffic from data centers. Routing malicious or automated traffic through a real residential IP address, the core service a residential proxy network sells, makes that traffic much harder to flag as suspicious.
