As reported by Krebs on Security, the FBI has moved against NetNut — a commercially operated residential proxy service backed by publicly-traded Israeli firm Alarum Technologies — seizing hundreds of domains and connecting the platform to the Popa botnet, a network of at least two million compromised devices. This is a landmark enforcement moment, and the cybersecurity community should pay close attention to what it signals.

Threat Alert: As reported by Krebs on Security, the FBI has moved against NetNut — a commercially operated residential proxy service backed by publicly-traded Israeli firm Alarum Technologies — seizing hundreds of domains and connecting the platform to the Popa botnet, a network of at least two million compromised devices.

Why This Action Is Significant

For years, the residential proxy industry has existed in a legal and ethical gray zone. Services like NetNut market themselves to legitimate businesses as tools for web scraping, ad verification, and geo-targeted research. The uncomfortable truth — one that security researchers have documented repeatedly — is that a substantial portion of these "residential IPs" are sourced from devices whose owners have no meaningful understanding that their bandwidth and connections are being sold to third parties.

What makes this case particularly striking is that Alarum Technologies is a publicly listed company on NASDAQ. This isn't a fly-by-night operation running from a bulletproof hosting provider. The FBI's willingness to act against an entity with that level of corporate legitimacy suggests that regulators and law enforcement are no longer willing to accept the "we're just a platform" defense when the underlying infrastructure is built on compromised consumer devices.

Shield53 Perspective: The Popa botnet's scale — two million devices — is not incidental to NetNut's business model. At that volume, device recruitment cannot plausibly occur through fully informed, explicit user consent. This is a structural problem in how proxy networks are built, not an edge case.

Who Is Actually at Risk Here?

The risk surface from this action extends in multiple directions:

Who Is Actually at Risk Here?
Compromised device owners: Millions of individuals — likely consumers who installed apps bundled with proxy SDKs — have had their devices silently recruited into the botnet. Their IP addresses have been used for traffic that ranges from benign to potentially criminal.
Enterprise security teams: Residential proxy networks like NetNut are a preferred tool for threat actors conducting credential stuffing, account takeover, and CAPTCHA bypass campaigns. Traffic originating from "clean" residential IPs is notoriously difficult to block without harming legitimate users.
Organizations using proxy services: Any business that contracted NetNut for ostensibly legitimate purposes may find themselves entangled in legal and reputational fallout. Procurement teams need to apply the same due diligence to proxy vendors that they apply to any third-party data processor.
Other proxy industry players: This seizure is a clear warning shot. Proxy services that cannot demonstrate clean, fully-consented device enrollment should expect increased scrutiny from both law enforcement and regulators.

The Broader Implication: Consent Is Not a Checkbox

One of the most important takeaways from this action is the emphasis on consent — or rather, the lack of it. Proxy SDK operators have historically buried device enrollment disclosures in lengthy terms of service, relying on the fact that consumers don't read them. Law enforcement's framing here — that devices were compromised "with little or no consent" — suggests that buried legalese is no longer an acceptable shield.

This has direct implications for any software vendor that monetizes user traffic through proxy SDKs. The legal framework around what constitutes informed consent for network resource sharing is likely to tighten significantly in the wake of this action.

Shield53 Recommendations

For Enterprise Security Teams

  • Audit proxy service contracts immediately. If your organization uses any residential proxy service, review the vendor's device sourcing practices. Demand transparency about how IPs are recruited and retained.
  • Update threat intelligence feeds. NetNut-associated infrastructure should be blocked at your perimeter. Coordinate with your threat intel providers to ensure seized and related domains are flagged.
  • Reassess credential stuffing defenses. With NetNut's infrastructure disrupted, there may be a brief window before threat actors migrate to alternative proxy networks. Use this time to harden authentication flows, implement behavioral analytics, and tighten rate limiting.
  • Review your SIEM for historical NetNut traffic. If residential proxy IPs from the Popa botnet range have appeared in your logs as sources of authentication attempts or scraping activity, now is the time to investigate those incidents retroactively.

For CISOs and Risk Leaders

  • Classify proxy services as high-risk third parties. Vendor risk programs should include specific evaluation criteria for proxy and anonymization service providers, including questions about device sourcing and consent mechanisms.
  • Engage legal counsel on exposure. Organizations that purchased NetNut services should assess whether any regulatory reporting obligations exist, particularly under data protection frameworks like GDPR or CCPA.
  • Contribute to industry intelligence sharing. If your organization has telemetry related to Popa botnet activity, consider sharing indicators through ISACs or directly with law enforcement.

The FBI's action against NetNut is not just a takedown — it's a precedent. The era of treating consent-free device harvesting as an acceptable cost of doing business in the proxy industry appears to be ending. Defenders should use this moment to pressure-test their assumptions about residential proxy traffic and tighten the controls that govern how their organizations interact with this ecosystem.