NetNut is facing a major crisis after researchers linked its proxy network to “Popa,” a botnet of more than two million compromised devices, including smart TVs and streaming boxes. In early July 2026, Google and the FBI began disrupting the infrastructure, while domains were reportedly seized.

Google said hundreds of threat groups routed traffic through suspected NetNut exit nodes. Reports suggest devices were enrolled through hidden SDKs in streaming, IPTV, and utility apps, often without clear consent.

The fallout includes millions of lost IPs, reduced reliability, account disruptions, reputational damage, and risks for resellers using NetNut’s infrastructure

How CyberYozh Ensures Proxy Quality and Security

CyberYozh protects proxy quality through ethical IP sourcing, continuous screening, and rapid abuse response. Its IP Checker detects fraud risks, blacklists, and suspicious network types before proxies are used. Residential and mobile IPs come from informed, consenting participants, while a dedicated abuse team investigates reports and removes questionable addresses quickly.

Since a lot of us watch this topic closely, here are some more news regarding Alarum Technologies. That's the company that owns NetNut, they put out another update on July 13 and it's kind of wild how little they're saying while saying a lot of words.

Here's a quick recap if you missed the earlier posts. Back on July 2 Alarum responded to press reports about its residential proxy network and paused some services as a precaution. Then on July 3 they disclosed that the FBI had actually seized domains tied to NetNut, and more kept getting seized as things went on. There was a July 4 update too. Now as of July 13, more than a week later, Alarum is saying they still don't know the root cause of the disruption. They've brought in an external cybersecurity and forensics team working under legal counsel, which tells you this isn't just an IT problem, this is a lawyered up problem.

This is where things start to get interesting. The operational efficiency plan they mention is reportedly going to affect close to a third of their workforce. Another interesting thing from an industry point is the framing. Alarum keeps saying they're investigating whether their own network was used for malicious or unlawful purposes by third parties, which puts them in the position of victim/cooperator rather than target, at least in their own telling. But domain seizures like this usually mean the government believes there's something to seize evidence from, and residential proxy networks have always had this legality question hanging over them about how the IPs are actually sourced. This might be the moment that forces the industry to answer that question directly.

What you guys think, is this a one-off enforcement action against a specific bad actor who abused NetNut's network, or is this the first step in a broader look at how residential proxy sourcing works across the web? If you've used NetNut recently, did you notice service disruptions before any of this became public?

Sources if you want to read the filings instead of just my summary:

https://www.globenewswire.com/news-release/2026/07/13/3326137/0/en/Alarum-Technologies-Provides-Further-Update-Regarding-Recent-Developments.html

https://www.globenewswire.com/news-release/2026/07/03/3321824/0/en/Alarum-Technologies-Provides-Update-Regarding-Recent-Law-Enforcement-Action.html

https://www.sec.gov/Archives/edgar/data/1725332/000121390026075179/ea029704201ex99-1.htm

Anyways, I'm still watching this case closely

Hi, I’m trying to get started to use multiple accounts to advertise and have had a hard time finding a proxy provider that offers around 20 dedicated static residential proxies. I already have a anti-detect browser set up, so if you got any recommendations please let me know.