krebsonsecurity.com 7/2/2026, 8:08:36 PM · external

FBI and Google seize NetNut domains tied to Popa botnet

CyberSIXT Evidence Panel Source marked as original reporting

THE FBI, in collaboration with industry partners, has seized hundreds of domains associated with NetNut, a residential proxy service run by Alarum Technologies. This action follows revelations linking NetNut to the Popa botnet, comprising over two million compromised devices. NetNut's infrastructure has reportedly facilitated crimes like content scraping and advertising fraud through compromised home devices, such as smart TVs.

Google has played a significant role in this takedown, disabling accounts associated with malware control and sharing intel on NetNut's infrastructure. Experts believe this disruption will negatively affect the cybercrime community, as NetNut was widely used among resellers. The overall impact may lessen large DDoS botnets which exploit poorly secured residential proxies. Despite the takedown, analysts caution that such networks could re-establish by reselling other proxy services. Consumers are advised to be wary of devices that might be pre-installed with residential proxy software.

View full article

Article by CyberSIXT

Timeline Coverage

Swipe to explore timeline