What happened
The FBI, working alongside Google's Threat Intelligence Group, Lumen, and other industry partners, executed a sweeping action against NetNut — a residential proxy service operated by Alarum Technologies, a publicly traded Israeli firm listed on NASDAQ. Authorities seized hundreds of domains tied to the network, which security researchers also track under the name Popa botnet. Google reported that the joint effort reduced the pool of compromised devices by millions, out of a network that had grown to span roughly two million home endpoints. The takedown followed reporting by KrebsOnSecurity approximately two weeks earlier, which had connected NetNut to the botnet infrastructure using findings from multiple cybersecurity firms.
Why it matters for your business
Residential proxy networks of this scale are frequently exploited for credential stuffing, ad fraud, web scraping, and bypassing geographic access controls — all activities that erode revenue and inflate operational costs for legitimate businesses. Because traffic routes through real home IP addresses, standard IP-reputation filters often fail to flag it as malicious, making detection genuinely difficult. Organizations should audit whether anomalous traffic patterns in their logs correlate with residential IP ranges, and security teams should treat this takedown as a prompt to review bot-mitigation tooling and proxy-detection coverage. The fact that the underlying service was operated by a publicly listed company underscores that complicit infrastructure is not always confined to dark-web actors.
What to watch next
Alarum Technologies has not yet publicly addressed the seizures, and any regulatory or legal consequences for a NASDAQ-listed firm entangled in a federal botnet takedown remain to be seen. Analysts should monitor whether competing residential proxy services absorb displaced demand from NetNut's former customers, which could signal where enforcement pressure needs to move next. The coordination model between the FBI, Google, and Lumen may also serve as a template for future public-private infrastructure disruptions.