In this Article
On July 2, 2026, Google, the FBI, and the IRS Criminal Investigation division disrupted NetNut, one of the largest residential proxy networks on the market. Google disabled the command-and-control accounts the operation relied on, and the FBI seized hundreds of domains tied to the network. If you bought residential proxies from NetNut, your service is affected and you need a plan. This guide explains what happened, what it means for you, and how to choose a replacement you can actually trust.
Quick answer: NetNut’s residential proxy network was traced to a botnet built on roughly two million hijacked consumer devices and was taken offline by law enforcement on July 2, 2026. Existing NetNut customers should migrate to a provider that sources its IPs through disclosed, opt-in agreements. DataImpulse offers a 90M plus pool of ethically sourced residential, mobile, and datacenter IPs, pay-as-you-go from 1 dollar per GB, with traffic that does not expire.
What actually happened
Security researchers had tracked the underlying botnet under the name Popa. Commercially, access to those hijacked devices was sold as NetNut residential proxies. According to reporting from Krebs on Security, BleepingComputer, The Hacker News, and SecurityWeek, the network ran on more than two million compromised devices, including smart TVs, streaming boxes, and Android phones, whose owners had no idea their internet connections were being rented out.
On July 2, 2026, Google’s Threat Intelligence Group disabled the Google accounts and services the network used for command and control. Separately, the FBI, working with the IRS Criminal Investigation division, seized hundreds of domains connected to the operation. The most common documented use of the network was password spraying, the practice of cycling stolen or guessed credentials against a target. It was also rented out for content scraping, ad fraud, and account takeover.
NetNut traces back to Alarum Technologies, a publicly traded company. As of early July 2026, there is no public announcement that the parent company has been dissolved or ordered to cease all operations. What is confirmed is that the proxy network itself was disrupted and its infrastructure seized by law enforcement.
What this means if you were a NetNut customer
Two things are true at once. First, your proxy service is unreliable or unavailable, because the infrastructure behind it has been seized. Second, and more important for the long term, the IPs you were paying for came from devices whose owners never agreed to share them. That is a reputational and compliance risk you inherited without knowing it.
If you relied on NetNut for web scraping, ad verification, price monitoring, or any other data collection, the practical steps are simple. Stop routing production traffic through the service, export any account or billing records you may need, and move your workloads to a provider that can show you where its IPs come from.
How to choose a replacement you can trust
The NetNut case is a reminder that the source of a residential IP matters as much as its speed or price. When you evaluate a new provider, ask three questions.
- Where do the IPs come from? A trustworthy provider sources residential IPs through a disclosed SDK where users opt in and are compensated. If a provider cannot explain this clearly, treat it as a red flag.
- Is there a compliance paper trail? Look for GDPR alignment, a data processing agreement, and recognized certifications. These are the documents your own auditors will ask for.
- Does the pricing model lock you in? Subscriptions with expiring traffic push you to overbuy. Pay-as-you-go with non-expiring traffic lets you migrate at your own pace.
Why teams are moving to DataImpulse
DataImpulse operates its own pool of more than 90 million ethically sourced residential, mobile, and datacenter IPs across 195 locations. The IPs come from real people who opt in through a disclosed SDK and are paid for the bandwidth they share, which is the opposite of a hidden botnet. Pricing is pay-as-you-go from 1 dollar per GB, country targeting is included, and the traffic you buy does not expire, so you can switch without racing a subscription clock.
For scraping and verification workloads, that combination means you get a defensible supply chain and predictable costs at the same time. You can read more about how ethical sourcing works on our ethical proxies page, and compare options on our residential proxies and mobile proxies pages.
Frequently asked questions
Is NetNut shut down for good?
The residential proxy network was disrupted and its domains were seized by law enforcement on July 2, 2026. As of early July 2026 there is no public statement that the parent company has been formally dissolved, but the proxy infrastructure has been taken offline, so the service is not something to rely on.
Was my data or my traffic compromised?
If you were a customer, your traffic was routed through devices that were part of a botnet. Review what you ran through the service and rotate any credentials that passed through it, then move to a provider with disclosed, opt-in sourcing.
What is the safest NetNut alternative?
Choose a provider that can show where its IPs come from. DataImpulse sources its 90M plus residential, mobile, and datacenter IPs through an opt-in SDK, is GDPR aligned, and offers pay-as-you-go pricing from 1 dollar per GB with non-expiring traffic.
Do I need to change my code to migrate?
No. Residential proxies use standard host, port, username, and password authentication. You update the proxy endpoint and credentials in your tool or script, and your existing setup keeps working.
How much does DataImpulse cost compared to NetNut?
DataImpulse starts at 1 dollar per GB on a pay-as-you-go basis with no subscription and traffic that does not expire. Competitor pricing changes often, so always verify current rates on each provider’s official site.
Move to proxies you can stand behind
The NetNut takedown is a costly reminder that cheap residential IPs from an unknown source are a liability. DataImpulse gives you ethically sourced IPs, transparent pricing, and traffic that never expires, so you can rebuild your data pipeline on a foundation you can defend. Start at 1 dollar per GB.
State/City/Zip/ASN Targeting 
