Google and the FBI disrupted NetNut's residential proxy network in July 2026. Here's what proxy users should know about botnet vs. consent-based sourcing, and how to choose a compliant alternative.
On July 2, 2026, something unusual happened in the proxy industry: a publicly traded company's flagship product was seized by the FBI, its Google infrastructure accounts were disabled overnight, and millions of customers lost access to the residential proxy pool they had been paying for. The operation—coordinated by Google's Threat Intelligence Group (GTIG), the FBI, and network intelligence firm Lumen—targeted NetNut, one of the largest residential proxy networks in the world.
If you were a NetNut customer and found your workflows broken without warning, you are not alone. And before you sign up for the first alternative that appears in your search results, it is worth understanding exactly why this happened—and what to look for so it doesn't happen again.
NetNut (also tracked internally by researchers as "Popa") offered residential proxy services at scale: a pool of over 2 million IP addresses belonging to real home internet connections around the world. Residential proxies are valuable because they appear to target sites as ordinary consumers, not as data center traffic, making them harder to block.
What NetNut did not advertise was how those 2 million home IPs were sourced.
According to GTIG's investigation—corroborated by independent research from Qurium, Synthient, Nokia Deepfield, and Spur—the vast majority of those devices were not enrolled by their owners. They were infected. Smart TVs, Android streaming boxes, and other consumer electronics were compromised through trojanized applications and malware including the Badbox 2.0 strain, or through pre-installed code on cheap hardware that shipped with backdoors already embedded. Their owners had no idea their home internet connections were being rented out to anonymous third parties.
In a single week in June 2026 alone, GTIG identified 316 distinct threat clusters using NetNut nodes as cover for password-spray attacks and nation-state espionage operations. The people routing cyberattacks through your neighbor's Roku didn't pay NetNut directly—they paid resellers who paid resellers—but the traffic all flowed through the same compromised device pool.
On July 2, Google disabled the Google accounts and infrastructure services NetNut depended on for command and control. The FBI seized netnut.com along with sister domains proxyjet.io and divinetworks.com. NetNut's parent company, Alarum Technologies (NASDAQ: ALAR), disputed the characterization, calling the allegations "demonstrably inaccurate," but the infrastructure was already gone.
For legitimate proxy users—marketers, researchers, price intelligence teams, ad verification professionals—the disruption was immediate and had nothing to do with their own activity. They were collateral damage from the underlying sourcing model.
The NetNut situation puts a sharp edge on a distinction that the proxy industry often obscures with vague marketing language: the difference between a botnet-sourced residential proxy and a consent-based (ethically sourced) residential proxy.
Botnet proxies are what they sound like. The IP addresses in the pool belong to devices that were infected with malware, jailbroken without user knowledge, or shipped with backdoors. The device owner does not know their connection is being used. They have not agreed to anything. From their perspective, their home internet is occasionally slow; from the proxy network's perspective, their IP address is inventory. When law enforcement eventually takes action—as they did with NetNut and as they did with 911.re in 2022—customers lose access instantly and without recourse.
Consent-based residential proxies work differently. The IP addresses in the pool belong to real residential connections whose owners have explicitly opted in—typically through a desktop or mobile app that clearly explains the terms: your idle bandwidth is shared in exchange for a free premium tier, a payment, or some other tangible benefit. Reputable operators can point to the specific apps through which users enrolled, the consent flow those users saw, and the mechanism by which users can opt out at any time.
The distinction matters not just ethically but legally and operationally. Botnet proxies carry ongoing regulatory and law enforcement risk. Consent-based networks, when operated correctly, do not.
NetNut is not an isolated case. 911.re, one of the largest residential proxy networks that ever existed, shut down abruptly in 2022 after KrebsOnSecurity exposed that its IP pool was built largely from malware-infected Windows systems. LuxSocks, VIP72, and several other services collapsed under similar circumstances.
The pattern is consistent: a provider competes on pool size and price, achieves scale through infection rather than consent, attracts cybercriminal customers alongside legitimate ones, and eventually draws enough law enforcement attention to collapse—often overnight.
At the same time, the legal perimeter around proxy use and web scraping is tightening independent of the botnet question. In October 2025, Reddit filed a federal lawsuit in New York against Perplexity AI and three data partners—Oxylabs, AWMProxy, and SerpApi—alleging that the companies used large-volume proxy networks, fake user agents, and IP rotation to bypass access controls and scrape Reddit's content without authorization. The complaint introduced the phrase "data laundering" to describe how unlawfully obtained data gets laundered through intermediaries until it appears legitimate.
The Reddit v. Perplexity case is still in early stages, but its framing is significant: courts and plaintiffs are increasingly treating the proxy layer itself—not just the end use—as part of the liability chain. Proxy customers who use botnet-sourced infrastructure are exposed not just to operational disruption but to being named alongside their provider when enforcement catches up.
If you are evaluating alternatives after the NetNut disruption, here is a practical checklist for assessing whether a residential proxy provider's sourcing is legitimate:
1. Transparent opt-in disclosure The provider should be able to tell you how users are recruited into the peer network—specifically which apps or programs users join, what disclosure they see before enrolling, and what opt-out mechanism exists. Vague claims about "ethically sourced" proxies with no specifics are a red flag.
2. GDPR and CCPA compliance documentation Both regulations require that personal data—including IP addresses when they can identify an individual—be processed with an appropriate legal basis. For residential proxies, that typically means explicit consent. Ask for the provider's Data Processing Agreement (DPA) and confirm it covers the jurisdictions relevant to your use case. A provider that cannot produce a DPA is likely not compliant.
3. No criminal actor history Run the provider name and any parent company names through public sources: KrebsOnSecurity, Proxyway's historical research, and court records. Several current proxy brands are rebrands of networks with law enforcement history.
4. Selective filtering of use cases Ethical providers turn away customers. If a provider will route traffic for any use case, no questions asked, that tells you something about the customer base sharing your exit nodes.
5. Operational stability indicators Publicly traded parent companies are not inherently safer (Alarum was NASDAQ-listed), but verifiable corporate structure, published terms of service, and a real customer support organization are signals that there is something to lose if the service is used maliciously.
6. Pool size claims vs. verifiable capacity Be skeptical of very large pool claims from newer providers. Building a 10-million-IP consent-based network takes years and significant investment in user acquisition. Very large pools from unknown providers frequently indicate botnet sourcing.
NinjaProxy's residential proxy capacity is provided through a third-party upstream partner, ProxyRack—not a peer network that NinjaProxy recruits, consents, or audits directly. NinjaProxy does not operate its own residential IP pool, consent workflow, opt-in app, or contributor payment/withdrawal system.
ProxyRack publishes its own claims about how its residential pool is sourced, including disclosed opt-in enrollment and an opt-out path for contributors. Those are ProxyRack's representations about its own network. NinjaProxy has not independently audited ProxyRack's consent flows, KYC process, or opt-out mechanism, and does not have visibility into individual contributor enrollment records.
That distinction is worth being direct about, especially in an article about a sourcing scandal: buying residential IP capacity from an established commercial provider that publishes an opt-in policy is a different risk profile than a network secretly built on infected consumer devices, like the one described above. It is not a guarantee. No provider—including NinjaProxy, and including any reseller of upstream residential capacity—should be taken at their word as categorically free of law-enforcement or regulatory risk, or as confirmed GDPR/CCPA compliant, on the basis of a supplier's own marketing claims. If your use case has real compliance requirements, ask whichever provider you choose—NinjaProxy included—for the specific documentation behind their sourcing claims, and verify it, rather than accepting "ethically sourced" as a given.
NinjaProxy supports the full range of use cases that residential proxies are built for: web scraping, price monitoring, ad verification, brand protection, market research, and SERP tracking.
If you were a NetNut customer, the immediate priority is restoring your workflows. But the right move isn't to find the fastest like-for-like replacement without asking how the pool was built. If you're weighing replacements, see how NinjaProxy compares to NetNut on sourcing, pricing, and migration.
The disruption you experienced was a direct consequence of the sourcing model. Choosing a replacement that uses the same sourcing model—botnet-based, malware-infected devices enrolled without consent—means accepting the same operational and legal risk. The next disruption may not come from Google and the FBI. It may come from a site you're scraping that names your proxy provider in a lawsuit, or a regulator that decides the chain of custody for that data matters.
The NetNut takedown is a useful forcing function: a moment when the underlying infrastructure that many proxy users never thought about became impossible to ignore. It is also an opportunity to migrate to infrastructure that will not put you back in the same position in six months.
NinjaProxy offers a free trial with no credit card required. If you're evaluating providers after the NetNut disruption, start here to test the network against your specific use case—web scraping, price monitoring, ad verification, or otherwise.
For teams with compliance requirements, ask NinjaProxy what documentation is currently available for your use case and independently verify any supplier sourcing or compliance representations before relying on them.
Sources: - Google Disrupts NetNut Residential Proxy Network — The Hacker News - Google, FBI Disrupt NetNut — SecurityWeek - NetNut cracked as Google and FBI target 2 million-device botnet — The Register - FBI Seizes NetNut Proxy Platform — Krebs on Security - Reddit sues Perplexity AI for unauthorized web scraping — ContentGrip - Reddit vs Perplexity: The AI Crawler Data Scraping Lawsuit — Hosted.com