FBI Seizes NetNut Proxy: The Dirty Secret of Residential Proxies

The Sanitized Front of Cybercrime

The federal hammer just dropped on one of the internet's worst-kept secrets. The FBI, working alongside Google and Lumen Technologies, seized hundreds of domains tied to NetNut, a massive residential proxy provider. For years, this operation, run by publicly traded Israeli firm Alarum Technologies, marketed itself as a legitimate corporate tool for web scraping and market research. The reality, exposed by researchers and detailed in the federal action, is far uglier. NetNut was feeding directly off the Popa botnet, a parasite network of over two million compromised consumer devices. You can read the details in the official report where KrebsOnSecurity published findings connecting the proxy network to this massive illicit infrastructure.

This is not an isolated incident or a case of a few bad actors abusing a neutral platform. It is the core business model of the modern proxy industry. When you buy a residential proxy, you are not renting bandwidth from willing participants who signed up for a side hustle. You are renting access to a hijacked smart TV, a compromised streaming box, or a backdoored router sitting in someone's living room. The industry calls it proxyware. Security professionals call it malware.

The line between a legitimate SaaS business and a criminal enterprise has completely dissolved.

Inside the Popa Botnet Infection Engine

How did two million devices end up in this botnet without their owners ever knowing? The infection vector is remarkably simple. It relies on the absolute lack of security in the consumer IoT supply chain. Malicious SDKs, often carrying names like Moneytiser or Loopop, are bundled directly into cheap Android TV boxes, third-party streaming apps, or unofficial media players. Once a user plugs the device in and connects it to their home network, the software executes. It does not need a complex Zero-day" target="_blank" rel="noopener noreferrer" class="hover:text-violet-400 transition-colors">zero-day exploit or a sophisticated buffer overflow attack. It simply exploits the default permissions of the host operating system.

The compromised device immediately establishes a persistent, encrypted outbound tunnel to a command-and-control server. It registers its residential IP address, its geography, and its connection speed. From that second onward, the device is an exit node. When a NetNut customer wants to route traffic through a residential IP in Chicago to perform password-spraying attacks or bypass geo-blocks, NetNut's infrastructure routes that traffic directly through the victim's living room television. The victim's bandwidth is consumed, their IP reputation is ruined, and their local network is exposed. A detailed analysis of the Popa botnet reveals that these devices are enrolled with little or no meaningful consent from the end user.

Your television is no longer just a display. It is an active participant in global cybercrime.

The Corporate Shield of Legitimate SaaS

Alarum Technologies, the parent company of NetNut, is listed on the NASDAQ under the ticker ALAR. They have issued statements claiming they are cooperating with law enforcement and investigating any potential misuse of their infrastructure. This is the standard corporate defense play. It allows them to maintain a veneer of legitimacy while their stock price takes a hit. But researchers had already established direct links between NetNut's core infrastructure and the Popa botnet weeks before the seizure.

The corporate world loves residential proxies because they bypass the basic security controls used by modern web applications. If an attack comes from an AWS data center, a basic web application firewall blocks it instantly. If the attack comes from a residential Comcast connection in Ohio, it looks like a normal user. Legitimate companies buy this traffic to scrape competitors, verify ads, or train AI models, completely ignoring the ethical and legal reality of how those IPs were harvested. They are funding the development of botnets under the guise of data acquisition.

Ignorance is no longer a defense when the supply chain is built on compromised consumer hardware.

How to Defend Your Digital Sovereignty

The NetNut takedown is a temporary victory. The backend infrastructure may be degraded, but the millions of infected devices are still sitting in living rooms, waiting for the next botnet operator to claim them. You cannot rely on corporate proxy providers to clean up their act, and you cannot rely on the government to seize every domain. You must secure your own perimeter. The first rule of home network Opsec" target="_blank" rel="noopener noreferrer" class="hover:text-violet-400 transition-colors">opsec is simple: segregate your devices.

Never allow a smart TV, a streaming box, or any IoT device to sit on the same subnet as your primary computers, phones, or network-attached storage. Use your router to set up a dedicated VLAN" target="_blank" rel="noopener noreferrer" class="hover:text-violet-400 transition-colors">VLAN for these untrusted devices. If your router does not support VLANs, buy one that does, or flash it with open-source firmware like DD-WRT. Block all inbound traffic to these devices and monitor their outbound connections. A television has no legitimate reason to maintain persistent encrypted connections to unknown external IPs.

If you do not control your network topology, someone else will.

# Basic Snort rule to detect outbound traffic to known NetNut proxy domains
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"POTENTIAL PROXYWARE OUTBOUND CONNECTION"; content:"sdk.netnut.io"; nocase; sid:1000001; rev:1;)