In one of the most significant law enforcement operations targeting commercial cybercrime infrastructure in recent years, the Federal Bureau of Investigation (FBI), in coordination with the Internal Revenue Service Criminal Investigation (IRS-CI) division and a coalition of global technology leaders, has seized hundreds of domains powering NetNut, a massive commercial residential proxy network. NetNut is operated by Alarum Technologies [NASDAQ: ALAR], a publicly traded Israeli technology company.
The federal intervention follows weeks of intensive exposure by independent cybersecurity researchers and investigative journalists who linked NetNut’s infrastructure directly to the Popa botnet—a global network comprising at least two million compromised consumer devices. These infected systems, ranging from low-cost Android streaming media players to smart televisions, were co-opted without informed user consent to route intrusive, illicit, and malicious internet traffic.
The disruption represents a severe blow to the illicit residential proxy ecosystem. By seizing the command-and-control (C2) domains and back-end routing channels used by NetNut, law enforcement and industry partners—including Google, Lumen Technologies (Black Lotus Labs), and The Shadowserver Foundation—have cut off access to millions of exit nodes utilized by sophisticated cybercriminals, nation-state threat actors, and automated fraud operations.
Following the domain seizures, Alarum Technologies’ public branding and corporate web presence collapsed online, with domain assets displaying official law enforcement seizure banners. The company’s stock suffered catastrophic losses, dropping by roughly 67 percent in the immediate aftermath as regulatory and legal scrutiny intensified.
Detailed Chronology: From Security Research to Law Enforcement Action
The demise of NetNut’s operational footprint reflects a rapidly accelerating sequence of events that brought commercial proxy operations under public and legal scrutiny.
+-----------------------------------------------------------------------------------+
| TIMELINE OF EVENTS |
+-----------------------------------------------------------------------------------+
| Jan 2026 : Synthient exposes Kimwolf DDoS botnet exploiting proxy tunnels. |
| Jun 19, 2026: Security firms publish reports linking NetNut to Popa botnet. |
| Late Jun 2026: KrebsOnSecurity links public firm Alarum Tech to Popa infrastructure. |
| Early Jul 2026: FBI, IRS-CI, Google, and partners seize NetNut domain assets. |
| Jul 8, 2026 : Alarum's corporate site seized; ALAR stock drops ~67% to $2.62/share.|
+-----------------------------------------------------------------------------------+
Phase 1: Emerging Technical Evidence
The groundwork for the takedown was established across early 2026, when threat intelligence researchers began tracking an unprecedented surge in residential proxy traffic originating from uncertified consumer electronics. In June 2026, three separate cybersecurity firms—including proxy tracking specialist Synthient and threat intelligence firm Spur—published concurrent research detailing the mechanics of the Popa botnet.
Their investigations revealed that Popa was not merely an isolated malware strain, but the primary sourcing engine for NetNut’s commercial residential proxy pool. The botnet infected target devices primarily via pre-installed firmware backdoors in off-brand streaming devices or through software development kits (SDKs) embedded in popular third-party applications.
Phase 2: Investigative Exposure
Roughly two weeks prior to the FBI’s domain seizure, investigative outlet KrebsOnSecurity published an exposé detailing how Alarum Technologies monetized the Popa botnet. The report demonstrated that despite marketing its services as legitimate corporate data-gathering tools, NetNut relied fundamentally on millions of compromised residential IP addresses harvested without explicit end-user authorization.
Phase 3: Multi-Agency Takedown
On the morning of the domain seizure, visitors attempting to reach netnut[.]io were met with an official federal seizure banner executed by the FBI and IRS Criminal Investigation. Simultaneously, Google’s Threat Intelligence Group (GTIG) enacted coordinated countermeasures across its platform ecosystem, disabling Google accounts tied to NetNut’s C2 servers, removing infected applications from software repositories, and sharing technical indicators of compromise (IOCs) across law enforcement and private security sectors.
Phase 4: Corporate Fallout
By July 8, the scope of the seizure expanded directly to NetNut’s parent company. The official website for Alarum Technologies (alarum[.]io) was seized and replaced with the same federal banner. On public markets, investor confidence evaporated instantly; Alarum Technologies’ stock (NASDAQ: ALAR) plummeted to $2.62 per share—a 67 percent loss over a five-day trading window.
Supporting Context & Metrics: Inside the Popa Botnet and Proxy Infrastructure
Residential proxy networks operate by routing client web traffic through internet-connected devices located in residential homes. Because these devices use IP addresses assigned by consumer Internet Service Providers (ISPs), traffic originating from them appears indistinguishable from legitimate consumer browsing. This allows users to bypass geoblocking, anti-bot protections, and IP-based security filters.
Key Metrics of the NetNut/Popa Takedown
Metric
Details / Value
Estimated Compromised Devices
2,000,000+ active exit nodes worldwide
Observed Threat Clusters (1 Week)
316 distinct threat actor groups (Google GTIG data)
Parent Company Stock Impact
~67% decline (NASDAQ: ALAR dropped to $2.62)
Smart TV SDK Prevalence (LG webOS)
42% of analyzed apps contained proxy SDKs (Spur report)
Smart TV SDK Prevalence (Samsung Tizen)
>25% of analyzed apps contained proxy SDKs
Primary Target Hardware
Uncertified Android TV boxes, Smart TVs, IoT gateways
Malicious Exploitation and Threat Actor Activity
While proxy providers often claim their networks are used for benign corporate purposes—such as search engine optimization (SEO) monitoring and price comparison scraping—data released by Google Threat Intelligence Group paints a dramatically different picture.
In a single week during June 2026, GTIG monitored 316 distinct threat actor clusters routing malicious activity through suspected NetNut exit nodes. These actors included state-sponsored cyber-espionage units, ransomware brokers, credential-stuffing syndicates, and advertising fraud rings.
+-----------------------------------------------------------+
| MALICIOUS USES OF NETNUT NODES |
+-----------------------------------------------------------+
| [1] Password Spraying & Credential Stuffing |
| [2] Automated Ad Fraud & Click Inflation |
| [3] Mass Web Scraping & Data Exfiltration |
| [4] Lateral Movement into Local Residential Networks |
| [5] Distributed Denial-of-Service (DDoS) Weaponization |
+-----------------------------------------------------------+
Google highlighted several primary threat vectors facilitated by the network:
Identity Obfuscation: Cybercriminals concealed their physical and digital footprints by bouncing connections through infected home devices before accessing target organizations or managing command-and-control servers.
Automated Credential Attacks: Attackers deployed password spraying scripts across distributed residential IPs, bypassing traditional rate-limiting rules that block repeated login attempts from a single source.
Lateral Network Compromise: Because an exit node resides inside a home network, rogue traffic routed through the device can probe the internal local area network (LAN). This allows threat actors to target other unpatched devices—such as smart cameras, storage drives, and personal computers—behind the home firewall.
The Smart TV and IoT Infection Vector
A key component of Popa’s rapid growth was the proliferation of unbranded, low-cost Android TV set-top boxes available through online retailers. These devices frequently ship with unofficial Android distributions that lack Google Play Protect certification. Firmware on these devices often includes hidden proxy micro-daemons pre-installed at the factory level.
However, uncertified TV boxes represent only part of the attack surface. Research published by Spur revealed that mainstream consumer smart TVs are increasingly targeted through app-level monetization SDKs:
Percentage of Analyzed Smart TV Apps Containing Proxy SDKs:
-----------------------------------------------------------
LG webOS: [=========================] 42%
Samsung Tizen: [==============> ] 26%
-----------------------------------------------------------
In many instances, developers integrate these SDKs into free streaming apps to monetize their user base. Once installed, the application runs the proxy client quietly in the background whenever the television is powered on, transforming a living room TV into an always-on residential proxy exit node.
Escalation to DDoS: The Kimwolf Precedent
The structural risk of unvetted residential proxies was demonstrated earlier in January 2026, when Synthient uncovered the Kimwolf botnet. In that instance, attackers leveraged existing proxy tunnels provided by a rival network, IPIDEA, to pivot into local home networks. Once inside, the attackers infected secondary Android-based devices to build what became the world’s largest Distributed Denial-of-Service (DDoS) botnet.
Experts note that because NetNut operated on similar architectural vulnerabilities, its dismantling eliminates a critical attack surface used to launch large-scale DDoS attacks.
Official Statements and Corporate Fallout
The coordinated action against NetNut has drawn statements from law enforcement partners, cybersecurity intelligence teams, and legal representatives for Alarum Technologies.
Google Threat Intelligence Group (GTIG)
In an official technical advisory detailing their contributions to the takedown, Google emphasized the operational impact of disabling NetNut’s command infrastructure:
"These bad actors can use NetNut to mask their origin IP address when accessing victim environments, accessing their own infrastructure, and conducting password spray attacks. Furthermore, when a consumer device becomes an exit node, unauthorized network traffic passes through it. This means bad actors can access other private devices on the same home network, effectively exposing them to Internet threats."
"Google has high confidence that many popular residential proxy brands are in fact whitelabeling the NetNut botnet. While we expect this disruption to have a larger ripple effect across the residential proxy ecosystem, observations after the disruption of IPIDEA proved that individual networks can appear resilient. What we have observed is that when faced with the degradation of their own botnet, proxy operators begin buying capacity from their competitors, effectively becoming a reseller."
Industry Analysis: Synthient
Benjamin Brundage, founder of proxy tracking firm Synthient—whose research was pivotal in exposing the link between Popa and NetNut—noted that the enforcement action will cause severe structural friction across the illicit proxy market:
"I think this takedown is going to have a big impact, because NetNut gained significant popularity after the IPIDEA takedown. Also NetNut has been incredibly common among resellers, and they were on par with IPIDEA in terms of their daily traffic, quality, size, price per gigabyte, all of it."
"In terms of all these TV box devices getting compromised from the proxy network, it will have an impact on the DDoS botnets out there."
Alarum Technologies Defense Counsel
Prior to the total seizure of Alarum’s corporate web domains, Omer Weiss, legal counsel for Alarum Technologies, issued a brief statement asserting that the company was responding to law enforcement inquiries:
"Alarum takes this matter seriously and will fully cooperate with law enforcement to ensure any misuse of its infrastructure is thoroughly investigated and those responsible are held to account."
Despite this statement, the subsequent seizure of alarum[.]io by the FBI indicates that federal authorities are looking beyond end-user "misuse" to investigate the core operational and corporate practices of the company itself.
Future Outlook: Reseller Adaptation and Consumer Mitigation Strategies
While the takedown of NetNut marks a critical victory for law enforcement, cybersecurity experts warn that the commercial proxy ecosystem possesses inherent structural resilience.
+-----------------------------------------------------------------------------------+
| THE RESIDENTIAL PROXY HYDRA EFFECT |
+-----------------------------------------------------------------------------------+
| [Law Enforcement Takedown] |
| | |
| v |
| [Primary Provider Infrastructure Seized] (e.g., IPIDEA, NetNut) |
| | |
| v |
| [Operator Adaptation] --> Buys Pool Capacity from Competitors (Whitelabeling) |
| | |
| v |
| [Ecosystem Shift] --> Traffic Migrates to Secondary Proxy Brands |
+-----------------------------------------------------------------------------------+
The Whitelabeling Challenge
When law enforcement dismantled IPIDEA earlier in the year, market demand did not vanish; instead, illicit buyers migrated en masse to NetNut. Now that NetNut has been disrupted, analysts expect proxy operators to engage in capacity-sharing and whitelabeling arrangements with smaller, secondary proxy networks. To achieve lasting deterrence, cross-sector coalitions will need to target interrelated supply chains simultaneously, including host infrastructure, payment processors, app store developers, and domain registrars.
Recommended Consumer Mitigation Strategies
To prevent smart devices from being co-opted into residential proxy networks like Popa, security analysts recommend several operational precautions:
+---------------------------------------+
| CONSUMER DEVICE PROTECTION CHECK |
+---------------------------------------+
|
+------------------------------+------------------------------+
| |
v v
[Hardware Sourcing] [Software Hygiene]
* Avoid unbranded Android boxes. * Verify Google Play Protect.
* Purchase Play Protect certified devices. * Minimize third-party app installs.
* Check OS build authenticity. * Audit Smart TV app permissions.
Stick to Certified Ecosystem Hardware: Avoid unbranded, low-cost streaming media boxes sold through unverified online market sellers. Limit purchases to reputable manufacturers whose devices run official Android TV, Google TV, Apple tvOS, or Roku operating systems.
Verify Play Protect Status: On Android-based media devices, consumers should verify that the device is certified under Google Play Protect. Uncertified devices operate outside Google’s security enforcement framework, making them vulnerable to pre-installed proxy daemons.
Audit App Installations on Smart TVs: Consumers using native smart TV platforms (such as LG webOS or Samsung Tizen) should limit application downloads to well-known service providers. Periodically review installed applications and remove obscure or single-use software that may bundle background proxy SDKs.
Network Segmentation: Maintain smart TVs, streaming media players, and IoT hardware on an isolated Guest Wi-Fi network. Segmenting these devices prevents infected endpoints from probing or compromising primary computers and personal storage devices on the home network.
