What Happened to NetNut: Our Test Data From Before the Takedown

What Happened to NetNut: Our Test Data From Before the Takedown

I test residential proxy providers as part of running CatProxies, and I pulled and measured a sample of NetNut exit IPs a few weeks before the takedown that hit the news this week. I was not testing fraud scores. I wanted to know one thing: whether a provider people call premium actually holds a high share of true residential IPs. On July 2, 2026, the FBI seized hundreds of NetNut domains and Google tied the network to a botnet of roughly two million home devices. This page covers what happened, what the CatProxies test found before anyone knew a takedown was coming, and how a replacement compares.

What Happened to NetNut

On July 2, 2026, the FBI seized hundreds of NetNut domains while Google disabled the accounts and command-and-control infrastructure the network used. Google's Threat Intelligence Group links NetNut, also tracked as Popa, to a botnet of at least two million home devices such as smart TVs and streaming boxes, enrolled through malware and hidden SDKs. In a single June week, Google observed 316 distinct threat clusters routing through suspected NetNut exits. The investigation was first detailed by Krebs on Security, and the disruption is documented in Google's threat intelligence report. Alarum Technologies, the parent company, disputes the characterization and calls the reporting inaccurate. The seizure itself is not in dispute.

Two facts from the reporting matter directly to anyone comparing alternatives. First, Krebs reports the network averaged 1.5 to 2.5 million distinct IPs per day, against an advertised pool of 85M+, so the marketing number and the usable pool were never the same thing. Second, Google states with high confidence that many popular residential proxy brands white-label NetNut, and that degraded operators respond by buying capacity from competitors and reselling it. The brand on the checkout page and the network behind it are often not the same company.

What the CatProxies Test Found Before the Takedown

Weeks before the seizure, a CatProxies sample of NetNut exit IPs already did not look like a clean premium residential pool. The sample was small and deliberately narrow, not a broad benchmark of the kind Proxyway publishes. Each exit IP was cross-checked against Synthient, a telemetry source that reports how an IP is classified and which other proxy networks use the same exit.

Example exit IPs from the sample, with the number of other proxy networks each appeared in:

One important note on the overlap numbers: shared exits are a market-wide condition, not a NetNut-specific failure. In the same test, the premium residential pool CatProxies offers showed a median of 40 other sellers per shared exit, close to NetNut's 45. Lumen's Black Lotus Labs made the same observation to Krebs: many proxy services resell larger networks rather than build their own, so the same IPs appear across the ecosystem. Overlap is context, not a verdict. The metric that actually separates a premium pool from an ordinary one is the true residential rate, and that is where the two samples diverged.

Screenshot of the Synthient results from the CatProxies test workbook

Under identical methodology, 44% of the NetNut sample classified as residential against 68% for the CatProxies premium residential sample, with the premium sample also holding a 9% mobile share. Most reviews grade providers on speed and price and never check this number. For reference on the metrics that do get published, Proxyway benchmarks placed NetNut at a 93.52% success rate with response times up to 2.13 seconds, behind comparable providers even before the takedown.

The Detail Most Coverage Misses

NetNut was not a pure botnet dressed up as a proxy service. It was a real residential pool boosted with botnet-sourced IPs. The test data is what makes that distinction visible. A network built entirely on hijacked devices would have tested far worse: near-total flagged exits and almost no clean residential layer. The sample instead showed genuine residential IPs sitting alongside a majority of datacenter-classified and heavily recycled exits, with some flagged for spam or elevated fraud risk. The botnet was topping up an existing pool, not replacing one.

That explains why buyers considered NetNut premium: the clean part of the pool was real, so day-to-day results often looked fine. It is also a warning about the wider market. If a provider regarded as the best available without building your own botnet was blending botnet IPs into its pool, the same question fairly applies to every big name. A recognizable brand does not prove clean sourcing.

What Proxy Sellers Say in Private

Two conversations from the CatProxies research notes show how the market actually works behind the storefronts. Both sellers are anonymized.

A reseller, asked about ethical sourcing and SDKs, confirms it operates no pool of its own and resells larger providers including NetNut.

Reselling larger networks is normal in this industry and not a problem by itself. The problem the takedown exposed is that buyers usually cannot tell what sits underneath the brand they pay. A buyer who deliberately avoided NetNut may still have been routed through its network by a reseller, which is exactly the white-label pattern Google described in its report.

A second seller describes NetNut as the most premium option available short of building a botnet yourself.

The second conversation took place before the takedown. The seller's framing, that NetNut is as premium as a public residential provider gets unless you build a botnet yourself, reads very differently now that Google has tied the network to one.

NetNut vs CatProxies: Side-by-Side Comparison

The table compares NetNut's advertised offer, in its current post-takedown state, against the two CatProxies residential proxy pools. The Standard pool is the value tier. The Premium Residential pool is the direct replacement for buyers who used NetNut as their premium option, and it is the pool sampled in the test above. Premium Residential is currently available on request through the dashboard or support.

Buyers who relied on NetNut's static ISP product for persistent sessions should look at static ISP proxies instead of a rotating pool. The differences between the two models are covered in the ISP vs residential proxies comparison.

Common Misconceptions About NetNut Alternatives

"A big, well-known proxy brand is automatically safe." NetNut is the counterexample. A provider widely regarded as premium was tied by Google to a two-million-device botnet. Size and reputation are not proof of clean sourcing.

"Fraud score is the metric that decides if a pool is premium." It is not. Botnet-sourced and recycled IPs can return acceptable fraud scores on the day of testing. The metric that separates a premium residential pool from an ordinary one is the true residential rate, and it is the first number to check in any replacement.

"The cheapest alternative is the best replacement." Price per gigabyte says nothing about sourcing. A cheap pool with the same recycling problem replaces one risk with another. Compare on residential rate first, then on price.

Which Alternative Should You Choose?

Match the session type first. Rotating residential work moves to a rotating residential network. Stable ISP-style sessions move to a static ISP product. Then verify before committing: pull a sample of live IPs from any provider you consider and check the classification yourself. The takedown proved the label on the pool and the contents of the pool can be very different things.

Staying with NetNut means accepting three risks at once: paying premium prices for a pool degraded by millions of devices, losing access or balances if the service folds, and routing traffic through a network tied by Google to a botnet. None of those risks exist with a cleanly sourced replacement.

Frequently Asked Questions

Is NetNut still working after the takedown?

As of July 2026, the FBI has seized hundreds of NetNut domains and Google reports reducing its device pool by millions, so access is unreliable and continued service is uncertain. Anyone holding a NetNut balance should treat it as at risk and plan a migration now rather than wait for an official shutdown announcement.

Why did the FBI and Google take down NetNut?

Google's Threat Intelligence Group linked NetNut, tracked as Popa, to a botnet of at least two million home devices enrolled through malware and hidden SDKs, and observed 316 threat clusters routing through its exits in a single week of June 2026. The FBI seized the domains on July 2, 2026 as part of the coordinated action. Alarum Technologies disputes the botnet characterization.

Were NetNut IPs actually residential?

Partly. In the CatProxies sample tested before the takedown, 55 percent of NetNut exit IPs were classified as datacenter rather than residential, and 91 percent appeared in other proxy networks, with a median of 45 other sellers per shared IP. The pool contained a genuine residential layer blended with datacenter and heavily recycled exits.

What is the best NetNut alternative?

It depends on how you used NetNut. Buyers who used it as a premium rotating residential provider can move to the CatProxies Premium Residential pool, which measured a 68% residential rate against NetNut's 44% in the same pre-takedown test and offers 100M+ peers with city, state, ZIP, ASN, and continent targeting. For persistent ISP-style sessions, a static ISP product is the closer match. Whichever provider you choose, verify the residential rate on a sample before scaling.

How much does a NetNut alternative cost?

Residential proxies are typically billed per gigabyte. CatProxies residential plans start at $2.50 per GB, while enterprise providers commonly charge $4.00 to $8.00 per GB. Price should not be the first filter, because a cheap pool with recycled exits carries the same risk the NetNut takedown exposed. Compare residential rate and sourcing first, then price.