Is Your Smart TV a Proxy? How to Detect and Block the Popa Botnet

The NetNut Takedown and the Popa Threat

The FBI seized hundreds of domains associated with the NetNut residential proxy service. This was not a standard script-kiddie operation. NetNut, operated by publicly-traded Israeli firm Alarum Technologies, allegedly built a massive business routing commercial traffic through hijacked consumer hardware. The core engine driving this network was the Popa botnet, a silent parasite infecting over two million Android-based smart TVs and streaming sticks.

Your cheap TV box is likely a node. It is routing cybercriminal traffic right now.

Security researchers tracked Popa as a malicious plugin tied directly to the notorious Vo1d botnet ecosystem. It targets uncertified, off-brand Android streaming devices sold on major retail platforms. Once active, the malware establishes persistent encrypted tunnels back to command servers, turning your home internet connection into a clean, residential IP for bad actors to buy. They use your IP to bypass fraud detection systems, execute credential stuffing attacks, and scrape data.

How to Audit Your Android TV for Popa Infection

Detecting this threat requires looking past the glossy user interface of your streaming stick. Because Popa operates at the firmware level, standard Android security apps will not find it. You need to monitor your network traffic. The malware immediately begins communicating out to specific domains upon boot. Look for active queries to sdk.netnut.io or cyberprotector.online in your local DNS logs.

If you see those domains, your device is pwned. Throw it in the trash or flash clean firmware.

You can also use network discovery tools to scan the device. Infected boxes often run background processes like Tcpdump or Netcat to map your local network topology. If you run a port scan on your TV and find open ports like 5555 (Android Debug Bridge) or random high-numbered ports acting as listening proxies, the device has been compromised. The malware is actively waiting for instructions to relay traffic.

Actionable Hardening Steps to Protect Your Network

If you must keep these cheap devices on your network, you need to isolate them immediately. Put every smart TV, streaming stick, and IoT device on a dedicated, segregated VLAN. This prevents a compromised TV from scanning your local network or accessing your personal computers. Set up firewall rules that block all inter-VLAN traffic. Your TV needs access to the internet, not your local file server.

Never trust default settings on cheap hardware. Treat them as hostile.

Next, deploy a local DNS sinkhole like Pi-hole or AdGuard Home. Configure it to block known proxy domains and malicious infrastructure associated with the Popa and Vo1d ecosystems. You should also configure egress filtering on your router to block outbound traffic on non-standard ports. By restricting outbound communication to essential ports like 80, 443, and 123, you can break the encrypted tunnels the botnet relies on to relay proxy traffic.

# Check for open ADB port on your TV box from a local computer
nmap -p 5555 [YOUR_TV_IP_ADDRESS]

# Block outbound traffic to NetNut SDK at the router level
iptables -A FORWARD -d sdk.netnut.io -j DROP
iptables -A FORWARD -d cyberprotector.online -j DROP