They sit beneath televisions in living rooms across the world — cheap Android streaming boxes promising unlimited access to premium content for a single upfront payment. What their owners almost certainly do not know is that many of these devices have been quietly enrolled in one of the most persistent residential proxy operations ever documented, one that researchers now connect to a company trading on a major U.S. stock exchange.
A Botnet Built for Business, Not Destruction
Unlike the headline-grabbing botnets that cripple hospitals or extort corporations, the network in question — known internally among researchers as Popa — operates with a more commercially disciplined purpose. Its architecture is not designed to launch denial-of-service attacks or encrypt file systems for ransom. Instead, it establishes a persistent, encrypted communications layer across infected devices, registering each one as a node capable of relaying third-party internet traffic on demand.
The practical effect is that any customer willing to pay for access can route their internet activity through the home IP address of an unsuspecting family in Ohio, Germany, or Singapore — making the traffic appear entirely legitimate to fraud detection systems, anti-scraping defenses, and account security filters. This is the foundational value proposition of the residential proxy industry, and it commands premium pricing precisely because those IP addresses are not associated with data centers.
Security researchers classify Popa as a plugin component tied to the broader Vo1d malware ecosystem, a large-scale campaign that has compromised unofficial Android TV hardware sold under thousands of brand names at major e-commerce platforms. In mid-2025, a coordinated industry disruption effort targeting a related botnet known as Badbox 2.0 dismantled dozens of command-and-control domains. Within days, new infrastructure appeared — but investigators noticed that one domain in the replacement cluster was not new at all.
The Infrastructure Trail
Researchers examining the control domains associated with Popa identified a web of properties that had moved in lockstep across hosting providers over time. Among them was a domain tied to a company called Ninjatech, whose founder lists his current role as vice president of research and development at NetNut, a residential proxy service operated by the Nasdaq-listed Israeli firm Alarum Technologies.
That same executive's professional profile credits him with building NetNut's architecture from scratch before the company's acquisition. His own self-submitted listing on a technology job board identified him as the sole owner of the Ninjatech domain.
When contacted for comment, the executive confirmed that Ninjatech developed an SDK called Popa approximately five years ago, describing it as a bandwidth-sharing tool that was supposed to operate only with user consent. He maintained that the code was sold to third parties and that he has had no control over subsequent modifications or deployments. He also stated he did not register the infrastructure domains that appeared after the Badbox 2.0 disruption and has no visibility into their operation.
"Once software is distributed that way, the original developer has no control over how others later modify, rebrand, or deploy it."
It is a defense the security industry has heard before — and one that grows harder to sustain when traffic analysis points in a specific direction.
Traffic Doesn't Lie
A separate technical analysis of the Popa SDK conducted by proxy-tracking researchers found that outbound traffic from devices running the software was clearly associated with NetNut's network infrastructure. The conclusion drawn was unambiguous: devices infected with Popa are actively forwarding traffic on behalf of NetNut's paying customers, making them functional components of the company's commercial proxy pool.
Alarum Technologies contested this characterization in a formal statement, arguing that the SDK facilitates voluntary bandwidth sharing rather than device compromise, and that calling it a botnet misrepresents both the technology and the company's operational standards. The company rejected the research findings as containing inaccurate assertions and flawed analytical methodology.
But the distinction between a consent-based bandwidth-sharing SDK and a botnet component becomes meaningless when the software is bundled into pirated streaming applications and preloaded onto devices sold without meaningful disclosure. The SDK may have been designed with legal deployment in mind. Its actual deployment is another matter entirely.
A Systemic Problem With an Entire Industry
This case is not an isolated incident. It reflects a structural tension at the heart of the residential proxy market, where competitive pressure incentivizes providers to maximize the size of their IP pools with little scrutiny over how those pools are assembled. The most commercially valuable residential proxies are the ones that look the most authentic — and nothing looks more authentic than a real home router or a streaming device sitting on a real consumer's broadband connection.
Investigators examining Popa's reach found evidence of its involvement in advertising fraud, credential stuffing attacks, and industrial-scale data scraping operations affecting organizations that had taken significant steps to protect themselves. The traffic was distributed across more than 1.4 million IP addresses in a single scraping campaign — a scale that overwhelms conventional rate-limiting defenses and suggests a highly organized commercial operation.
What You Should Do
The Popa investigation is unlikely to be the last of its kind. As long as residential proxy services command premium prices and face minimal regulatory scrutiny over how they source their IP inventory, the economic incentive to cut ethical corners — or to look away while partners do so — will remain. The devices sitting in millions of living rooms are not just streaming boxes. For someone, somewhere, they are infrastructure.
