FBI and Google Disrupt NetNut Proxy Network and Popa Botnet

On July 2, 2026, Google announced it weakened the NetNut proxy network, also known as Popa, in collaboration with the FBI and Lumen. This action targeted a large network of residential proxies used for malicious online activities, including cybercrime. The FBI seized hundreds of domains linked to NetNut, which is operated by Alarum Technologies and connected to a botnet of at least two million compromised devices. Google reported significant degradation to NetNut's operations, reducing the pool of devices available for the proxy operator by millions. The coordinated effort involved disabling accounts and sharing technical intelligence with law enforcement to support broader enforcement actions. The NetNut network allows users to mask their online activities, which can facilitate cybercrime. This disruption aims to mitigate the abuse of residential proxy networks for illegal purposes.

Key Points: • Google and the FBI collaborated to disrupt the NetNut proxy network linked to cybercrime. • The Popa botnet comprises at least two million compromised devices used for malicious activities. • Hundreds of domains associated with NetNut were seized, significantly impacting its operations.