On July 2, 2026, the FBI and the IRS Criminal Investigation division seized hundreds of domains belonging to NetNut, a commercial residential proxy service run by Alarum Technologies, a publicly traded Israeli company listed on the NASDAQ. Visitors to netnut.com, proxyjet.io, divinetworks.com, and the rest of the seized properties were greeted with a federal seizure banner instead of a proxy-purchasing dashboard. Behind that banner was the real story: NetNut's infrastructure was built on top of Popa, a botnet of at least two million consumer devices enrolled with little or no meaningful consent from their owners. The compromised machines weren't servers, weren't corporate laptops, and weren't even routers in the traditional sense. They were smart TVs and cheap streaming boxes sitting in living rooms, quietly relaying other people's malicious traffic through home internet connections while their owners watched Netflix.
How a TV becomes a proxy node
The mechanism is almost mundane, which is exactly why it worked at scale for years. According to research published alongside the takedown, NetNut's operators embedded deceptive software development kits into low-cost, off-brand Android-based smart TVs and streaming boxes, and into unofficial apps such as the SmartTube client that many people install to get an ad-free YouTube experience on hardware that doesn't officially support it. Once installed, that SDK quietly enrolled the device as an always-on exit node in the Popa botnet. The owner sees a working streaming box. NetNut sees another residential IP address it can sell.
This is the part worth sitting with: nobody had to fall for a phishing email or click a malicious link in the traditional sense. The compromise arrived bundled inside software the user actually wanted, running on hardware nobody thinks of as a security-relevant asset. There's no antivirus prompt on a smart TV. There's no patch Tuesday. There's no IT department asset-tagging the device in the living room. It just sits on the home network, indistinguishable from any other appliance, and does exactly what its firmware tells it to do — which, unbeknownst to the owner, now includes carrying someone else's internet traffic.
Google's own telemetry gives a sense of how heavily that capability got used. In a single week in June 2026, Google identified 316 distinct threat actor clusters — a mix of cybercriminal and suspected espionage groups — routing traffic through NetNut exit nodes to conduct password-spraying, credential stuffing, advertising fraud, and large-scale data scraping. The seizure notice thanked Google, Lumen, and Shadowserver, among other industry partners, for help identifying and dismantling the infrastructure — a reminder that takedowns of this size are rarely a solo law enforcement effort; they depend on threat intelligence sharing between the agencies with subpoena power and the companies that actually see the traffic.
The business model that made this profitable
Residential proxy services are not, on their face, illegal or even disreputable. There's a genuine commercial market for them: ad verification companies need to check what a real ad actually looks like from a real residential IP in a specific city, market research firms scrape public pricing data without getting immediately blocklisted, and brand protection teams check for counterfeit listings the way an ordinary consumer would see them. Vendors in this space market themselves as compliance-friendly infrastructure for exactly those use cases, and plenty of paying customers use them for nothing more sinister than that.
The problem is that the same property that makes residential IPs useful for legitimate market research — they look like a real person's home internet connection — makes them just as useful for disguising credential stuffing, account takeover, and scraping traffic aimed at someone else's authentication systems. A residential proxy provider selling access by the gigabyte or by the IP has limited incentive, and often limited technical ability, to distinguish a market-research customer from a criminal renting the same exit nodes for a password-spray campaign against a bank's login page. NetNut's own scale illustrates the gap between "marketed use case" and "actual use case": you don't need 316 distinct threat clusters hammering your exit nodes with credential stuffing traffic in a single week if your customer base is mostly ad-verification shops.
This is also why residential proxy takedowns keep recurring as a category, not a one-off. The 911 S5 botnet, dismantled by the FBI in 2024, followed a nearly identical playbook — free VPN apps that quietly enrolled devices as paid proxy exit nodes, sold on to whoever would pay. NetNut's Popa botnet is a bigger, more device-diverse version of the same idea, this time centered on IoT hardware rather than desktop VPN clients. The business model survives takedowns because the underlying demand — cheap, hard-to-blocklist IP diversity — never goes away, and there's always another vendor willing to supply it with a legitimate-sounding pitch deck.
Why IP-based defenses can't see this coming
For enterprise security teams, the uncomfortable takeaway is that the standard first line of defense against credential stuffing and account takeover — IP reputation and geolocation filtering — is structurally blind to this traffic. A login attempt from a known datacenter range, a Tor exit node, or a flagged VPN provider is trivial to flag or challenge. A login attempt from a residential IP in the same city as your customer, on a consumer ISP, with no prior abuse history, looks exactly like a real user on their home Wi-Fi, because in a literal sense it is one — the traffic is riding a real household's real internet connection, just with an uninvited passenger.
That's what made NetNut valuable to the 316 threat clusters Google observed: it converted "traffic that gets blocked immediately" into "traffic that sails past every IP-based control an enterprise has deployed." Password spraying at low velocity, spread across two million rotating residential exit nodes, defeats rate limiting keyed on source IP just as effectively as it defeats blocklists, because no single IP ever sends enough requests to trip a threshold. The volume is real; it's just distributed across more front doors than any blocklist can track.
The practical implication is that defenses built around "where is this request coming from" need to be paired with, or in some cases replaced by, defenses built around "how is this request behaving." That means behavioral analytics on login patterns, device and browser fingerprinting that looks past the IP address to session-level signals like TLS fingerprints, timing patterns, and headless-browser tells, and credential stuffing detection tuned to catch distributed low-and-slow attempts rather than obvious brute-force bursts from a single source. It also means treating "successful login from a new device or new geography" as a signal worth acting on even when the IP itself has a clean reputation — because a clean IP reputation is precisely what a residential proxy is designed to produce.
What security teams should actually change
The NetNut takedown removes one large chunk of proxy infrastructure, but the SDK-bundling technique it used will get reused by the next vendor, and the demand for hard-to-blocklist IP diversity isn't going anywhere. A few concrete changes are worth prioritizing this quarter:
- Enforce MFA everywhere, and specifically on paths that don't get the same scrutiny as the main web login. Residential-proxy-sourced credential stuffing succeeds against accounts protected only by a password, regardless of how clean the source IP looks. A stolen or sprayed password stops mattering the moment a second factor is required.
- Move rate limiting from IP-based to identity- and behavior-based thresholds. Cap failed login attempts per username and per device fingerprint, not just per source IP, since a distributed residential proxy botnet defeats IP-keyed limits by design.
- Deploy device and session fingerprinting for authentication endpoints, not just for checkout or fraud flows. TLS fingerprint, browser automation artifacts, and impossible-travel patterns on session tokens all survive a clean-looking residential IP.
- Feed threat intelligence on known proxy exit-node ranges into your detection stack, and refresh it regularly. Vendors like Google, Spur, and others publish indicators tied to residential proxy services; static blocklists decay fast against a two-million-device pool, so this needs to be a recurring update, not a one-time import.
- Audit your own IoT footprint for the same SDK-bundling pattern. Any smart TV, streaming box, or IoT device on a corporate guest network or an executive's home network is a candidate for the same kind of silent enrollment NetNut used against consumers.
The consumer-side blind spot enterprises can't patch
It's worth being honest that this problem doesn't fully live inside enterprise security teams' control, because the compromised devices belong to individual consumers, not to any organization's asset inventory. Everyday users can meaningfully reduce their exposure with a few habits that map directly to how Popa spread: stick to official app stores and name-brand smart TV and streaming box hardware rather than off-brand Android TV boxes sold purely on price, be skeptical of unofficial client apps — like sideloaded YouTube clients — that promise features the official app won't give you, and treat any offer to "earn money from your unused bandwidth or idle device" as a proxy-network recruitment pitch, because that's precisely the business model these networks run on when they're not silently bundling an SDK without disclosure. Segmenting IoT devices onto a separate VLAN or guest network, changing default admin credentials, and keeping firmware updated where updates are even offered all reduce the blast radius, but they require a level of home-network sophistication most consumers don't have and manufacturers rarely make easy.
That gap — a device category with no patch cadence, no enterprise monitoring, and no owner who thinks of it as a security-relevant asset — is precisely why NetNut could recruit two million nodes without most of those two million people ever noticing. The FBI's seizure disrupts the specific infrastructure Popa used to monetize that gap, but the gap itself, an entire class of consumer IoT hardware sitting unmonitored on home networks with an internet connection and no meaningful oversight, is still there, waiting for whichever proxy vendor moves into the space NetNut just vacated.