Keep users in the loop.
Ship release notes that get read
Try Noticeable
On July 2, 2026, the homepage of netnut.com stopped selling proxy access and started displaying an FBI seizure banner. The FBI and IRS Criminal Investigation, working with Google, Lumen, Shadowserver, and other industry partners, seized hundreds of domains tied to NetNut, a residential proxy platform operated by the publicly traded Israeli company Alarum Technologies, and to Popa, the botnet of at least two million compromised consumer devices that supplied the platform's exit nodes.
The scale of abuse flowing through those devices is the real story. In a single week in June, the Google Threat Intelligence Group counted 316 distinct threat clusters using suspected NetNut exit nodes: a mix of cybercriminal and espionage groups running password spraying, mass scraping, ad fraud, and account takeover campaigns from the IP addresses of unsuspecting households.
Residential proxy networks exist for one purpose that matters to defenders: they are engineered to defeat per-IP reputation. The takedown is a good occasion to walk through how these networks operate, why the naive defenses collapse against them, and which signals still give them away.
A botnet with a stock ticker
NetNut was not run from a bulletproof host in an uncooperative jurisdiction. It was a product of Alarum Technologies, a company listed on Nasdaq. On June 19, three security firms independently published findings connecting NetNut's supply of residential IPs to Popa, a botnet assembled by distributing software for smart TVs, streaming boxes, and other home devices with little or no user consent. Two weeks later the domains were seized; by July 8 the parent company's own website carried the same banner and the stock had lost 67 percent of its value.
Google's role went beyond intelligence sharing. It disabled Google accounts the operation used for malware command and control, pushed Google Play Protect rules that warn users and disable apps carrying the NetNut SDKs, and distributed indicators for the SDKs and back-end infrastructure to platform vendors, researchers, and law enforcement. The action also disrupted infrastructure previously used to build Kimwolf, a DDoS botnet that tunneled through proxy connections to reach Android devices behind home firewalls.
The seizure matters because of where NetNut sat in the market. "NetNut has been incredibly common among resellers," Benjamin Brundage of Synthient told Krebs on Security, noting that the platform absorbed much of the demand displaced by the IPIDEA takedown earlier in 2026. Google was blunter still: many popular residential proxy brands were white-labeling the same botnet under their own logos.
How a smart TV becomes attack infrastructure
Nobody enrolls their television in a botnet on purpose. Popa grew through SDKs: software components embedded in apps that promise payment for "sharing unused bandwidth," bundled silently into free streaming apps, or preinstalled on unofficial Android TV boxes. Research cited in the Krebs investigation found residential proxy SDKs in 42 percent of the apps available for LG's webOS platform and in more than a quarter of those for Samsung's Tizen.
Once the SDK runs, the device registers with the platform's command and control servers and holds open a persistent outbound tunnel. From that moment, the household's IP address is inventory. When a customer of the proxy service requests an exit in a particular country, city, or network, the platform routes the customer's traffic down the tunnel, and the device replays it onto the internet from its own address.
The consequences reach past the abuse itself. As Google notes, once a consumer device becomes an exit node, unauthorized traffic passes through the home connection, and the operator's access can extend to other devices on the same network. The subscriber meanwhile inherits the reputation of everything the exit relayed: CAPTCHAs, blocked logins, and fraud flags on an ordinary family broadband line.
The laundering path, hop by hop
From the defender's side of the wire, here is what a residential proxy does to an attack. The attacker connects to the platform's gateway, often with per-request rotation and country or city targeting expressed directly in the proxy credentials. The gateway picks one of millions of enrolled devices and forwards the connection down its tunnel. The victim's servers then see a TCP connection from a genuine subscriber address inside a genuine ISP allocation, with nothing on the wire that says "proxy."
This is laundering in the precise sense: the traffic's origin is not hidden so much as replaced with a better one. A login attempt from a hosting provider on another continent is inherently suspicious. The same attempt from a cable subscriber in the victim's home market, on a network where thousands of legitimate customers live, is exactly what normal traffic looks like.
Why per-IP defenses collapse at two million exits
Consider a password spraying campaign running 100,000 login attempts per hour. Routed through 50 datacenter IPs, each address produces 2,000 attempts per hour, and any rate limiter, WAF rule, or velocity check catches it. Routed through a pool of two million residential exits with per-request rotation, each IP address surfaces roughly once every 20 hours. There is no threshold to trip, because no single address ever does anything unusual.
Blocklists fail on the other axis: time. Residential IPs are dynamic. Devices power off, DHCP leases roll, and carrier-grade NAT can put hundreds of households behind one address. The IP that relayed credential stuffing at 09:00 may belong to a different, entirely innocent subscriber by the afternoon. A static blocklist built from yesterday's attack therefore does two things badly at once: it misses today's exits, which arrive from fresh addresses, and it blocks today's legitimate users, who inherited yesterday's.
That is the trap in IP reputation as commonly practiced. A list of addresses observed doing bad things is a list of addresses that used to do bad things. Against a pool that churns as fast as consumer devices reboot, it decays in hours.
The signals that survive rotation
Rotation destroys per-IP counting, but it does not make proxy traffic indistinguishable from human traffic. Several classes of signal survive:
- Network context. Every exit still lives inside a real ASN with a type: ISP, mobile carrier, hosting, business, education. Residential proxy traffic is residential by definition, so the useful question flips: is this behavior plausible for this connection type? Ten thousand product-page fetches per minute from cable modem space is not a shopper; it is a scraper renting exits.
- Churn and history. Legitimate customers come back from the same networks. Proxy-driven attacks show a striking first-seen ratio: session after session from addresses your service has never encountered, each used once and abandoned. A spike in never-before-seen residential IPs on a login endpoint is one of the cleanest early warnings of a spraying campaign.
- Session incoherence. The IP rotates; the attacker's state does not. The same session token, device identifier, or behavioral fingerprint hopping across addresses, cities, and countries within minutes is physically impossible for a human and routine for a backconnect proxy.
- Fingerprint mismatch. The exit is a smart TV in one country while the TLS and HTTP fingerprints belong to an automation framework on a Linux server in another. The tunnel also adds latency, so round-trip times that contradict the claimed geography are measurable.
- Infrastructure intelligence. The networks themselves can be mapped. Recruitment SDKs, gateway servers, and command and control infrastructure change far more slowly than exit IPs. That is how researchers tied NetNut to Popa, and it is how proxy detection stays ahead of rotation: identify the network, then recognize its members, instead of blocklisting yesterday's exits.
A gray market that outlives any single seizure
NetNut sold access openly, with a sales team and terms of service, while its supply side ran on devices whose owners never meaningfully agreed to anything. This is the consent-washing pattern that defines the residential proxy gray market: a paragraph about "bandwidth sharing" buried in a free app's terms is treated as authorization to resell a household's internet connection, in NetNut's case to 316 threat clusters in a single week. Security Ledger's analysis of the action makes the same point: the line between a "legitimate" proxy vendor and a botnet is often nothing more than a checkbox nobody read.
The market also adapts. After the IPIDEA takedown, surviving operators bought and resold each other's capacity, and NetNut absorbed much of the displaced demand. This seizure removed a coordinator, not the installed base: the SDKs remain on millions of devices until platforms and users strip them out, and history suggests other brokers will compete to re-aggregate that supply under new brand names.
What fraud and trust-and-safety teams should change
- Treat per-IP rate limiting as a datacenter-era control. Keep it, but assume serious credential attacks arrive under it, and detect password spraying at the account level by watching the distribution of failed logins across accounts rather than per source address.
- Score requests on connection type and network context instead of consulting a binary blocklist. Residential does not mean safe, hosting does not mean hostile, and the interesting signal is behavior that contradicts the network type.
- Track the first-seen ratio of client IPs on sensitive endpoints and alert on sudden shifts.
- Correlate identity across IP changes using session tokens and device fingerprints, and flag mobility that no human could achieve.
- Use continuously refreshed proxy intelligence, and expect the pool feeding your attackers to change hands in the months after a takedown.
Detecting laundered traffic is precisely the problem Ipregistry works on: every lookup returns proxy, VPN, Tor, and abuser signals alongside connection type, company, and ASN context, refreshed continuously so a rotating exit node cannot outrun the data. You can test it against your own traffic with 100,000 free lookups to get started.