FBI Seizes NetNut Proxy Platform, Popa Botnet
FBI seizes hundreds of domains linked to NetNut proxy service and Popa botnet.
The FBI, with industry partners, has seized hundreds of domains associated with NetNut, a residential proxy service operated by Alarum Technologies. This action follows reports linking NetNut to the Popa botnet, which compromised millions of devices. The NetNut service turned compromised devices into proxy nodes rented by cybercriminals for activities like scraping, fraud, and account takeovers, while also exposing home networks to threats.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Google?
Get an email when a new story names Google, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Popa botnet silently compromised millions of consumer devices and enrolled them as proxy nodes in the NetNut service, monetizing unwitting victims' bandwidth and home networks for criminal activity. The root problem is a widespread lack of device-level security awareness and visibility — most affected users had no idea their routers or IoT devices had been hijacked. This matters because compromised residential proxies are highly trusted by fraud detection systems, making them a premium tool for account takeovers, ad fraud, and scraping attacks. When home devices are weaponized at scale, the downstream harm extends far beyond the device owner to businesses and individuals targeted by the criminal customers renting those proxies.
What helps against this
How we list vendors
- Device management (MDM and UEM)
Every company laptop and phone is known, encrypted, locked down and up to date.
- Network segmentation and microsegmentation
One compromised machine can no longer reach everything else.
- DNS filtering and secure web gateway
Users cannot reach known-malicious sites, and malware cannot phone home.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — Popa botnet