The FBI seized hundreds of domains tied to NetNut, a residential proxy service run by the publicly-traded Israeli company Alarum Technologies (NASDAQ: ALAR), on July 2, 2026. The action followed reporting connecting NetNut to the Popa botnet, a network of at least two million devices compromised with little or no consent from their owners. For anyone running a hosting account, the interesting part isn’t the takedown itself, it’s how those two million devices actually got recruited, and what that means for reading your own server’s traffic logs going forward.
How Two Million Devices Became a Proxy Network Without Anyone Noticing
The recruitment mechanism wasn’t malware in the traditional sense. Researchers found that proxy SDKs, bundled inside legitimate-looking smart TV apps, quietly turned viewers’ devices into traffic relays. Nearly half of the LG webOS apps and over a quarter of the Samsung Tizen apps researchers analyzed contained these SDKs. A user installs an app for its stated purpose, streaming, a game, a utility, and the app’s developer has separately sold the device’s spare bandwidth to a proxy network, usually with a vague or buried consent notice nobody reads. The device owner never sees anything change; their smart TV keeps working exactly as expected while quietly routing someone else’s traffic in the background.
Why This Matters Beyond the Takedown Itself
In a single week in June 2026, Google’s Threat Intelligence Group observed 316 distinct threat-actor clusters, including both cybercriminal and espionage groups, using suspected NetNut exit nodes. That’s the actual reason this matters for hosting security specifically: a residential proxy network like this doesn’t just anonymize casual traffic, it gives attackers IP addresses that look exactly like ordinary home internet connections, which is precisely the kind of traffic most bot-detection and rate-limiting rules are built to let through. A brute-force login attempt or a credential-stuffing run routed through a residential IP looks, to a basic firewall rule, indistinguishable from a real visitor on their home Wi-Fi.
What This Means for Reading Your Own Traffic
The practical lesson isn’t “block residential IPs,” which would also block real customers. It’s that IP reputation and geography alone are weaker signals than they used to be, since a growing share of “residential” traffic is actually a rented exit node rather than an actual household. Behavioral signals, request patterns, path targeting, how a session actually moves through a site, matter more than they did even a year or two ago, precisely because the traditional shortcut (residential IP equals probably-human) is now something attackers can rent access to at scale. Rate limiting based on behavior (how many login attempts, how fast, against how many different usernames) catches what IP-based rules alone increasingly miss.
What to Actually Check on Your Own Server
If you administer a VPS or dedicated server, the useful exercise here isn’t panicking about NetNut specifically, it’s using this as a prompt to actually look at what your access logs show. Pull login attempts against wp-admin, an SSH port, or any admin panel over the last month and check two things: how many distinct IPs are involved, and how tightly clustered the timing is. A real person mistyping a password looks nothing like dozens of attempts spread across many residential-looking IPs in a short window, that pattern is credential stuffing wearing a residential disguise, regardless of what network any individual IP happens to resolve to. Fail2ban or an equivalent tool that escalates blocks based on behavior, rather than a static allow/deny list keyed to IP ranges, is the more durable defense here, since it doesn’t depend on correctly guessing which ranges are “safe” in a world where safe-looking ranges can be rented.
Multi-factor authentication is the other piece worth confirming is actually turned on, not just available. A residential-proxy-routed credential-stuffing attempt that gets a password right still fails at the second factor, which is precisely why that single setting matters more than any amount of IP-based filtering against traffic designed to look ordinary.
The Takedown Doesn’t End the Problem
Seizing domains disrupts NetNut’s own infrastructure, but it doesn’t un-install the SDKs already sitting inside millions of devices, and it doesn’t stop other residential proxy operators running similar arrangements. The FBI’s action, with Google, Lumen, and Shadowserver credited as partners, is a real disruption of one specific network, not a fix for the underlying business model of monetizing device bandwidth through bundled SDKs. For anyone administering a server, the useful takeaway is less about this specific botnet and more about what it confirms: residential-looking traffic deserves the same scrutiny as any other traffic once its actual behavior looks automated, regardless of what IP range it’s coming from.