On 2 July 2026 the FBI replaced NetNut's homepage with a seizure banner. Since then a large slice of the residential-proxy market — NetNut's own customers and the many brands that quietly resold its pool — has been shopping for a replacement. This page explains what happened, how to check whether your current vendor was NetNut in disguise, and which alternatives fit which kind of buyer.
Buy residential from $0.67/GB Compare the alternativesNetNut was one of the two or three largest residential networks in the world, operated by Alarum Technologies, a company listed on NASDAQ. In June 2026 several security firms published research connecting its pool to the Popa botnet: millions of no-name Android TV boxes and smart-TV apps carrying proxy SDKs whose owners had no idea their bandwidth was for sale. Two weeks later the domains were gone.
| Date | Event |
|---|---|
| 19 June 2026 | Three security firms, Synthient among them, publish evidence tying NetNut's residential pool to the Popa botnet — at least two million smart TVs and streaming boxes running proxy SDKs with little or no owner consent. |
| 2 July 2026 | The FBI and IRS Criminal Investigation seize netnut.com and hundreds of related domains. Google's Threat Intelligence Group disables the Google accounts NetNut used for command-and-control and pulls apps that bundled its SDKs. Lumen and Shadowserver assist. |
| 3–4 July 2026 | Alarum Technologies (NASDAQ: ALAR), NetNut's parent, confirms the seizures and announces a temporary operational pause of certain network services. |
| 8 July 2026 | netnut.io, the main commercial domain, is moved to FBI name servers and starts serving the seizure banner. alarum.io follows. ALAR loses roughly two thirds of its value in a week. |
| September 2026 | netnut.io still returns “Seized by the Federal Bureau of Investigation”. No charges or named defendants have been made public; a seizure is not a conviction. Alarum says it is cooperating. |
The practical consequence for buyers is simpler than the legal one: the dashboard, the API endpoints and the gateway hostnames all lived on the seized domains. Whatever Alarum does next, the product you configured in your tools no longer resolves.
Google's Threat Intelligence Group wrote that it has high confidence many popular residential proxy brands are in fact white-labelling the NetNut botnet. That matches what we saw from the reseller side: NetNut was the default wholesale source for a whole tier of storefronts after IPIDEA (the network behind the old IP2World, 922 and PIA S5) was taken down earlier in 2026. So a lot of people who never bought from NetNut still lost NetNut.
Four checks, in order of how much they prove:
Strip the marketing and NetNut sold five things. Map yours before you shop, because the alternatives differ mostly in which of these they do well.
| You had on NetNut | What to look for | On PyProxy |
|---|---|---|
| Rotating residential, per GB | Independent pool, per-GB billing, no monthly expiry | Residential from $0.67/GB, traffic never expires |
| Country / state / city targeting | Targeting in the username, not a support ticket | Country targeting on every plan; locations list |
| Sticky sessions | Session IDs you control, minutes to days | Rotating or sticky, set per line in the panel |
| Static residential (ISP) | ISP-registered IPs, priced separately | Static ISP proxies |
| SOCKS5 and HTTP(S) | Both on the same credentials | HTTP(S) plus SOCKS5, same balance |
| API for resellers | Provision sub-users and traffic programmatically | Reseller API from 300 GB |
Nobody sells “the same thing”: NetNut's pool was unusually large because it was built the way it was. What you can buy is a smaller but legitimately sourced pool with the same interface. These are the realistic candidates, and who each is for.
| Provider | Fits | Entry | What you give up |
|---|---|---|---|
| Bright Data | Enterprise with legal review, need for a DPA and SLA | Commitment tiers, KYC before spending | Onboarding time; list prices several times higher per GB |
| Oxylabs | Companies that want an account manager and invoices | Business qualification, often a call | Solo buyers frequently do not get through signup |
| IPRoyal | Mid-size buyers who want a known brand at mid prices | Small minimum, card and crypto | Per-GB price in the low single digits at small volume |
| Decodo (ex-Smartproxy) | Scraping teams who want tooling around the proxies | Subscription plans | Monthly plans; unused traffic expires |
| PyProxy (this site) | Solo operators and small teams, unpredictable volume | A few dollars, no minimum, no KYC for small amounts | No SLA or account manager; support by ticket and Telegram |
The honest split: if your employer's procurement team is involved, go to Bright Data or Oxylabs and stop reading. If you are one person, a small agency or a reseller who lost a wholesale source, the enterprise tier is paying for paperwork you will never use, and the interesting question is which cheap independent pool holds up on your targets.
host:port:user:pass. Or skip passwords entirely with IP whitelisting.Three of the largest residential networks in the world — 911 S5, IPIDEA, and now NetNut — have been dismantled by law enforcement in under three years, and each time a generation of resellers who thought they had “their own pool” discovered they did not. You cannot fully audit a vendor's supply chain. You can refuse to prepay months of traffic, keep credentials for a second provider on file, and buy from somewhere that lets you test for the price of a coffee.
Related: Bright Data review · Oxylabs review · IPRoyal review · PIA S5 status · FAQ
Its domains have been under FBI control since July 2026 and netnut.io still serves a seizure notice. Alarum Technologies says it is cooperating, no charges have been announced, and nothing has been restored. Plan as if it is gone; if it returns, you have lost nothing by having a second provider.
Security researchers linked NetNut's residential pool to the Popa botnet: at least two million smart TVs and streaming boxes running proxy SDKs without meaningful consent. Google's threat team also documented hundreds of criminal clusters routing through NetNut exits in a single week. The FBI and IRS Criminal Investigation seized the domains on 2 July 2026.
Google reported that many well-known residential brands were white-labelling NetNut's network. If your success rate collapsed or your pool shrank between 2 and 8 July 2026 and support went quiet, you were very likely on NetNut without knowing it.
For most NetNut customers the product was rotating residential billed per gigabyte with country targeting and sticky sessions. Any provider selling exactly that on an independent pool is a direct replacement; the table on this page compares the realistic options and who each one fits.
Unlike the anonymous storefronts that vanished earlier in 2026, NetNut's parent is a listed company with a legal department. Write to them and, if you paid by card, ask your bank about a chargeback for services not delivered. Do not pay anyone who offers to 'recover' the balance for a fee.
PyProxy does not buy traffic from NetNut or Alarum, and the lines we sell are answering today, months after the seizure, which the NetNut pool cannot do. Nobody can audit every hop of a supply chain, so do not take our word for it: buy one gigabyte, run your real workload, and check the exits yourself. That is why the smallest package exists.