Cybersecurity

Cybercrime Borrows Your Home Internet

Google and the FBI disrupted NetNut, a residential proxy network of at least 2 million home devices used by 316 threat clusters in one week. Why IP reputation is dead and your devices are the new perimeter.

CybersecurityBy Servola Tech Desk2026-07-043 min read

AI-assisted, edited by humans. Editorial standards

Key takeaways

On July 2, 2026 Google, the FBI, Lumen, Shadowserver and IRS Criminal Investigation disrupted NetNut, also tracked as Popa, one of the largest residential proxy networks with at least 2 million devices; the FBI seized hundreds of domains including netnut.com.
According to Google's Threat Intelligence Group, devices were enrolled through software pre-installed on smart TVs and streaming boxes and through hidden SDKs inside apps, typically without the owner's meaningful consent.
In a single week in June 2026 Google observed 316 distinct threat clusters using suspected NetNut exit nodes, including espionage groups, for password spraying and for masking the origin of attacks.
Two lessons for owners: IP reputation and geo-blocking have quietly stopped working as security controls, and cheap connected devices can enroll your own network as someone else's exit infrastructure.

What was taken down

On July 2, 2026 Google's Threat Intelligence Group, working with the FBI, Lumen, the Shadowserver Foundation and IRS Criminal Investigation, moved against NetNut, a residential proxy network it also tracks as Popa and estimates at no fewer than 2 million devices worldwide. Google disabled the accounts and services the network used for command and control, shared technical detail on its hidden SDKs with platform providers and researchers, and updated Play Protect to warn users and disable apps carrying the code. The FBI seized hundreds of domains, including netnut.com, which now shows a federal seizure banner. Reporting by Krebs on Security ties the service to Alarum Technologies, a company listed on Nasdaq, whose counsel said it takes the matter seriously and will cooperate fully with law enforcement. It is the second such action this year, after the IPIDEA network in January, and Google says the disruption has already cut the available device pool by millions.

The end of the suspicious IP

A residential proxy network rents out ordinary home internet connections, so an attacker's traffic arrives wearing the address of a family's living room rather than a foreign data center. That is precisely why it sells. In one June week Google counted 316 distinct threat clusters, criminal and espionage alike, using suspected NetNut exit nodes to mask where they came from, to run password spray attacks and, in some cases, to pivot from the proxy software into other devices on the same home network. For a European business this breaks a quiet assumption baked into a decade of security tooling: that risky traffic looks risky. When the login attempt against your accounts comes from a residential address in your own country, geo-blocking and IP reputation lists do not fire. The controls that still work are the ones that never trusted addresses in the first place: multi-factor authentication everywhere, rate limits per account rather than per IP, and alerting on behavior instead of origin.

Your devices are the product

The other half of the story is where those 2 million exits came from: software pre-installed on no-name smart TVs and streaming boxes before purchase, and SDKs hidden inside apps that pay their developers for your unused bandwidth. The owner of the device rarely knows they have become infrastructure, yet it is their address that surfaces in a victim's logs. That makes device procurement a security control, not a consumer preference: certified devices from reputable manufacturers, apps from official stores only, and a hard no to anything offering money for internet sharing. It also reframes the takedown itself. Enforcement is shifting from arresting individual hackers to dismantling the gray infrastructure markets they rent, and this one, researchers note, ran inside a publicly listed company. When crime rides commodity infrastructure, the discipline that protects you is the unglamorous one: know what is on your network, and assume an address proves nothing.

Frequently asked questions

What is a residential proxy network?

A service that routes its customers' traffic through ordinary home internet connections, so it appears to come from private households. Legitimate uses exist, but Google observed hundreds of threat clusters using NetNut exits to disguise attacks.

Am I affected if I own a smart TV or streaming box?

Possibly, if it is an uncertified no-name device or carries apps from outside official stores. Google says enrollment came through pre-installed software and hidden SDKs. Buy certified hardware, keep Play Protect active, and avoid bandwidth-sharing apps.

What should a company change in its defenses?

Stop treating IP reputation and geography as strong signals. Enforce multi-factor authentication, rate-limit per account, monitor for behavioral anomalies, and review what consumer-grade devices sit on your office and home-office networks.

The attacker no longer looks like a stranger; he looks like a customer on a home line, and the defense that still works is the one that stopped trusting addresses and started verifying identities.

Cybersecurity Residential Proxies Botnet Google FBI IP Reputation

A Pulled Frontier Model Is Back Online

The US lifted export controls on Claude Fable 5 after 19 days. Anthropic bought access back with a retrained classifier and a CVSS-style jailbreak severity scale. What that means for operators.

4 min read

Cybersecurity

Your AI Agent Trusts a Poisoned Tool

Microsoft warns that a poisoned tool description can turn your AI agent into a data leak, with no rule broken and no bug exploited. What owners must lock down.

2 min read1 views

Cybersecurity

Your AI Browser Can Leak Your Passwords

Researchers showed a booby-trapped webpage can talk a browser AI agent out of its own safety rules and make it hand over passwords and access. What owners should do.

2 min read1 views

Servola

Servola helps owners run device estates and defenses that assume an address proves nothing.

Request a private introduction About Servola →

Servola is technology counsel for a small number of families and offices. When a decision cannot be delegated, we sit on your side of the table.

Servola Systems GmbH · Ludwigshafen, Germany · [email protected]

← All articles