NetNut Seized by the FBI: What Proxy Buyers Should Do Now

NetNut seized by the FBI: what happened?

Here’s a mistake that’s easy to make: buying residential proxies from a brand you trust without asking where its IPs come from. NetNut’s seizure shows why that question now matters.

On 2 July 2026, the FBI said it had worked with industry partners to seize hundreds of domains associated with NetNut, KrebsOnSecurity reported. The NetNut homepage was replaced with an FBI seizure banner that also named the IRS Criminal Investigation division. In a 8 July update, Krebs reported that alarum.io, the site of parent company Alarum Technologies, also showed a seizure notice.

Google’s Threat Intelligence Group disabled Google accounts and services NetNut used for malware command and control, and Google Play Protect began warning Android users about apps with NetNut’s code, Infosecurity Magazine reported. Lumen and the Shadowserver Foundation also took part.

Who confirmed it, and what did they say?

Three outlets and two companies are on the record, and they agree on the core facts.

observed 316 distinct threat clusters using suspected NetNut exit nodesGoogle Threat Intelligence Group, quoted by The Register

The Register reported on 3 July that NetNut had at least 2 million enrolled devices, mainly small TV-streaming hardware, and that Google expects wider effects on the residential proxy market. Infosecurity Magazine reported that NetNut’s code was embedded in cheap, off-brand Android TVs, streaming boxes and unofficial apps such as SmartTube, which quietly rented out home connections as proxy exit nodes.

Alarum takes this matter seriously and will fully cooperate with law enforcement.Alarum Technologies, quoted by KrebsOnSecurity

Krebs reported that Alarum’s stock traded at $2.62 on 8 July, down about 67% in a week. The Register noted on 3 July that netnut.com showed the seizure page while netnut.io was still online, and Infosecurity Magazine reported that experts said both domains belonged to the same operation.

Could your provider be affected if you never bought NetNut?

Possibly, because NetNut sold its network to other brands as well as to its own customers.

Infosecurity Magazine reported that Google assessed with high confidence that many popular residential proxy brands white-label (resell under their own name) NetNut’s network. The Register reported that NetNut ran a reseller program, and that after IPIDEA’s disruption, proxy operators began buying capacity from competitors. None of the three sources names the brands involved.

What should proxy buyers do now?

The practical risk for a buyer is losing coverage in the exact countries and cities your work depends on.

1. Ask where the IPs come fromEmail your provider and ask whether any of its residential pool is resold from another network, and how device owners give consent.
2. List your locationsWrite down every country, city or region you target. A pool can look large overall and still be thin in one market.
3. Re-test each regionRun a small test per location, for example the US, an EU country, an Asian market and a MENA country, and compare success and speed.
4. Check city accuracyFor city targeting, confirm that the exit IPs actually geolocate to the city you ordered, not just the country.
5. Keep a backup providerHold a small balance with a second provider, ideally one whose traffic doesn’t expire, so a sudden outage doesn’t stop the work.

Our proxy speed claims article includes a short script for that per-region test, and the residential proxy prices report shows which providers sell small, non-expiring top-ups for a backup. To check a single address quickly, you can test your proxies with GoToProxy.

What isn’t known yet?

Several points that matter to buyers aren’t answered by the three sources.

• Which proxy brands resold NetNut capacity. Google said many did but named none in the coverage.
• Whether NetNut’s service will return, and when. The sources describe the seizure, not a restart.
• What happens to existing NetNut customers’ balances. KrebsOnSecurity said its article doesn’t describe this.
• How each region was affected. None of the reports breaks the device count down by country.

We’ll keep this page to what the named sources report. For providers to compare in the meantime, see our best residential proxies ranking or browse all proxy rankings.

FAQ