Google disrupts NetNut residential proxy network built on 2 million devices

Google LLC has disrupted NetNut, one of the largest residential proxy networks in operation, degrading a service that had turned more than 2 million home devices worldwide into relays for other people’s internet traffic.

The action was carried out in coordination with the U.S. Federal Bureau of Investigation, Lumen Technologies Inc. and others. Google’s Threat Intelligence Group said the effort reduced the pool of devices available to the proxy operator by millions and caused significant degradation to the network and its business. The FBI seized several NetNut domains as part of the operation.

NetNut, also tracked as Popa, sells access to residential internet addresses that let buyers route traffic through real home connections. That makes malicious activity look like ordinary browsing rather than the data center traffic that security tools tend to block. Google estimates the network spans at least 2 million devices, many of them smart TVs and streaming boxes that were either shipped with the proxy code preinstalled or picked it up through free apps that concealed it.

Google took three main steps. It disabled Google accounts and services NetNut used for malware command and control. It also shared technical intelligence on the network’s software development kits and back-end infrastructure with platform providers, law enforcement and research firms. Finally it set Google Play Protect to warn users and disable applications carrying NetNut SDKs.

The scale of abuse is substantial. In a single week in June, the Threat Intelligence Group counted 316 distinct threat clusters using suspected NetNut exit nodes, including cybercriminal and espionage groups. Attackers used the network to mask their origin, reach victim environments and run password spray attacks. Google said devices turned into exit nodes also give outside traffic a path into home networks, exposing other devices on the same connection.

Unlike most proxy botnets, NetNut traces back to a public company. It is owned by Alarum Technologies Ltd., an Israeli firm listed on the Nasdaq. NetNut was founded in 2017. In June, researchers at Qurium Media Foundation, Synthient LLC, Nokia Deepfield and Spur Intelligence Inc. tied Popa to NetNut, and Synthient reported that none of the more than 20 apps it examined showed users a consent prompt.

Alarum rejects the botnet characterization. The company called the research “demonstrably inaccurate assertions and flawed deductions rather than verified facts” and said its software supports consented bandwidth sharing that does not compromise the devices it runs on.

Google framed the takedown as degradation rather than a kill. NetNut runs a reseller program that lets other companies sell its network under their own brands and Google said it has high confidence that many seemingly independent proxy services are white-labeling the same pool. The company disrupted the China-based IPIDEA network in January and sued the operators of the Badbox 2.0 botnet in July 2025. In both cases the networks proved resilient as operators bought capacity from rivals.

Image: NetNut