Netnut

What Happened

On July 2, 2026, Google announced a coordinated disruption of the NetNut residential proxy network, also known as Popa. The action was taken together with the FBI, Lumen, and a number of other partners. It follows a similar operation against the IPIDEA proxy network in January 2026 and is part of Google's stated objective to dismantle what it calls malicious residential proxy networks.

Google's Threat Intelligence Group (GTIG) had been tracking NetNut for some time before the takedown. During a single week in June 2026, GTIG observed 316 distinct threat clusters using suspected NetNut exit nodes. Those clusters included both cybercriminal groups and state-sponsored espionage actors. That number alone gives you a sense of the scale of the problem: 316 separate bad-actor operations routing traffic through the same underlying pool of compromised devices within seven days.

If you're looking for reliable alternatives to NetNut, check out our article here: NetNut Alternatives.

What NetNut Actually Was

NetNut marketed itself as a legitimate residential proxy provider. On the surface it looked like any other proxy business: a website, a dashboard, pricing plans, a reseller program, and a white-label offering for other brands. The difference was where the exit nodes came from. Google estimated the NetNut network at a minimum of 2 million devices. Those devices were not volunteers who had signed up to share their bandwidth. They were ordinary consumer machines that had been infected and enrolled in the botnet without the owners' knowledge.

The mechanism works like this. A piece of software, typically bundled inside a legitimate-looking application, installs a background component on the victim's device. That component registers the device as an exit node with the proxy network's command-and-control infrastructure. From that point on, whenever a paying customer of NetNut makes a request, that request exits through the victim's home internet connection. The victim's IP address shows up in server logs as the apparent origin of the traffic. The victim has no idea any of this is happening, and their device is being rented out without their consent.

Public reporting from Synthient, Spur, Nokia Deepfield, and others documented an additional layer of harm: NetNut exit nodes were used to distribute variants of the Mirai DDoS botnet. Mirai is a well-known family of malware that specifically targets connected devices and uses them to flood targets with traffic. So the device was doing double duty: acting as a proxy exit node for paying customers, and potentially participating in distributed denial-of-service attacks at the same time.

There is also a network-level risk that often gets overlooked. When a home device becomes an exit node, unauthorized traffic passes through the home router. That gives bad actors a pathway to reach other devices on the same local network, whether that is a family member's laptop, a smart TV, or a home security camera. The compromise does not stay contained to the infected device.

The White-Label Problem

This is where the story gets more complicated for the legitimate proxy industry. NetNut operated a reseller and white-label program, which is a common business model in this space. Under that model, other brands buy wholesale access to NetNut's pool and sell it under their own names. Google stated in its disclosure that it has high confidence that many popular residential proxy brands were, in fact, white-labeling the NetNut botnet. Those brands may not have known the underlying pool was built from infected devices, or they may have chosen not to investigate too carefully. Either way, their customers were routing traffic through compromised consumer machines without knowing it.

This is a real structural problem in the residential proxy market. A buyer looking at a proxy product sees a brand name, a pricing page, and some marketing copy about pool size and geo coverage. They cannot easily verify whether the underlying IP pool was sourced ethically. NetNut's reseller network means the disruption had a ripple effect well beyond NetNut itself. Any brand drawing from that pool lost capacity when Google and the FBI acted.

What Google Actually Did

The actions Google took were more surgical than a simple domain block. Google disabled Google accounts and services that were being used for NetNut's malware command-and-control infrastructure. Without those C2 channels, the malware installed on victim devices loses its ability to receive instructions and register new connections. Google also shared technical intelligence about NetNut's SDKs and backend C2 infrastructure with its partners, including Lumen, which operates one of the major backbone networks that carries internet traffic. Lumen can act on that intelligence to block traffic at the infrastructure level. Google Play Protect, the security layer built into Android, was updated to flag apps known to incorporate NetNut SDKs.

Google assessed that these coordinated actions caused significant degradation to NetNut's proxy network and its business operations, reducing the available pool of devices by millions. That is a meaningful capacity hit. At the same time, Google was careful to note that the disruption of IPIDEA in January showed that individual networks can appear resilient. When a proxy operator's own botnet is degraded, the documented pattern is that they start buying capacity from other proxy networks to compensate. The ecosystem has a way of absorbing these shocks over time, which is why Google frames these actions as a continuing campaign rather than a one-time fix.

Why This Matters for People Who Buy Proxies

If you are a developer or a growth engineer who uses residential proxies for web scraping, ad verification, price monitoring, or any similar task, the NetNut situation raises a practical question: how do you know your proxy provider is sourcing its pool legitimately?

The honest answer is that it is not always easy to tell. A few things you can check are worth knowing about. Legitimate providers will describe their acquisition model explicitly, typically some form of a peer-to-peer SDK where device owners are informed and compensated. Providers that are members of the Ethical Web Data Collection Initiative or similar bodies have at least signed up to a framework, though membership alone is not a guarantee. Providers that are vague or evasive about how they recruit IPs are a warning sign.

The price point is not a reliable signal by itself. NetNut was not unusually cheap. It was a major, well-funded operation. Price is a weak filter here.

What the NetNut case does confirm is that pool size numbers in proxy marketing copy are not always what they seem. A network advertising "millions of residential IPs" may be counting infected devices that have no idea they are part of the pool. That matters for your operations too, not just for ethics. Botnet-sourced IPs tend to have shorter useful lifespans, less stable connections, and worse performance consistency than IPs sourced from users who have deliberately opted in. The ethical option and the operationally better option often turn out to be the same thing.

The Broader Pattern

The NetNut action is the second major residential proxy disruption in 2026, following IPIDEA in January. Google's framing is deliberate: they are describing this as a continuing campaign, not isolated incidents. The FBI involvement adds a law enforcement dimension that pure technical countermeasures cannot replicate, since it opens the door to criminal charges against operators regardless of where they are headquartered.

For the proxy industry, the trend is clear. The days of operating a large botnet-backed residential proxy network without serious institutional attention are ending. The infrastructure dependencies, particularly on Google services for C2 and on major backbone providers like Lumen for traffic routing, give authorities more leverage than they had a few years ago. Each action also generates technical intelligence that feeds the next one.

For buyers, the practical takeaway is straightforward. Vet your provider. Ask directly how the IP pool is sourced. Look for public documentation of their recruitment model. If you're looking for reliable alternatives to NetNut, check out our article here: NetNut Alternatives. The disruption of NetNut took capacity away from everyone who was using that pool, including customers who had no idea they were relying on compromised devices. Choosing a provider that sources its network transparently is no longer just an ethical preference. It is a business continuity decision.

Source: https://cloud.google.com/blog/topics/threat-intelligence/google-continued-disruption-residential-proxy-networks

Proxy Type

Available Countries

Interface Language

Payment Methods

Integrations

Specifications

IP address rotation

Money-back period (hours)

Free trial

Targeting by city

Pricing

Top 9 alternatives for Netnut

Webshare

⭐ 4.89

💰 From $0.0224

🌍 195 countries

📡 Residential Proxies, ISP Proxies, Datacenter Proxies

Learn more

IPRoyal

⭐ 4.8

💰 From $1.53

🌍 190+ countries

📡 Mobile Proxies, Residential Proxies, ISP Proxies, Datacenter Proxies

Learn more

NodeMaven

⭐ 4.97

💰 From $2.75

🌍 190+ countries

📡 Mobile Proxies, Residential Proxies, ISP Proxies

Learn more

DataImpulse

⭐ 4.9

💰 From $0.45

🌍 195 countries

📡 Mobile Proxies, Residential Proxies, Datacenter Proxies

Learn more

Evomi

⭐ 4.89

💰 From $0.3

🌍 150+ countries

📡 Mobile Proxies, Residential Proxies, ISP Proxies, Datacenter Proxies

Learn more

Proxy-Cheap

⭐ 4.85

💰 From $0.15

🌍 130 countries

📡 Mobile Proxies, Residential Proxies, Individual IPv6 Proxies, ISP Proxies, Datacenter Proxies

Learn more

NovProxy

⭐ 4.7

💰 From $0.5

🌍 190+ countries

📡 Residential Proxies, ISP Proxies

Learn more

Proxyscrape

⭐ 4.88

💰 From $0.023

🌍 195 countries

📡 Mobile Proxies, Residential Proxies, Datacenter Proxies

Learn more

Our Review

Author Caproxy Team

Published: 2026-02-16
Last updated: 2026-07-28

1831

NetNut has been around since 2019, and in proxy terms that is long enough to have earned a reputation. The company positions itself squarely at business customers who need large-scale, continuous data collection, and it shows in everything from the pricing structure to the sales process. If you are a freelancer with a $30 budget, this review will save you some time: NetNut is not for you. If you are running data pipelines at serious volume, read on.

What NetNut Actually Offers

NetNut runs four proxy product lines. The flagship is rotating residential proxies, with a pool of over 85 million IPs across 195 countries. That number is verified through direct ISP connections rather than peer-to-peer sourcing, which is the key architectural difference that separates NetNut from a lot of its competitors. With P2P-sourced residential networks, you are routing through another consumer's device in real time, which introduces latency spikes and availability gaps whenever that device goes offline. NetNut routes through ISP infrastructure directly, so the IPs behave like residential addresses without depending on individual devices staying connected. The practical consequence is more consistent uptime and lower variance in response times, though average latency can still be high depending on which IP you pull from the pool.

Beyond the residential product, NetNut offers mobile proxies covering 5 million IPs across 100 countries with 3G, 4G, 5G, and LTE support. There is also a static residential line with over 1 million IPs for tasks where you need the same address across multiple requests, and a datacenter product covering 150,000 IPs worldwide. The datacenter tier advertises 99.99% uptime, which is the right number for that product type since the infrastructure is entirely server-side.

On top of the raw proxy products, NetNut sells scraping tools. The Website Unblocker handles CAPTCHA solving and dynamic fingerprinting automatically, claiming 100% success rates. There is also a SERP Scraper API that returns structured search results for any location, language, or device configuration. These sit in a separate product category from the proxies, but they matter because they change the value proposition: instead of managing proxy rotation yourself, you can offload the whole anti-bot layer to NetNut's infrastructure.

Performance and Speed

This is where things get nuanced. The direct ISP architecture genuinely does produce low fraud scores. In testing, residential IPs from the NetNut pool consistently returned fraud scores in the 12 to 16 out of 100 range, which is low risk by any standard measurement. They are not flagged as proxies by common detection tools, and geo-accuracy is solid. When I pulled a California IP, the exit point came back correctly as a Cox or AT&T residential address, not a hosting provider.

Latency is a different story. The range across the pool is wide, from around 18 ms on the fast end to over 1,000 ms on the slow end. That variance matters a lot depending on your task. For bulk scraping of e-commerce product listings, a 900 ms response is annoying but manageable. For anything time-sensitive, like financial data feeds or auction monitoring, that tail latency will cause problems. The mechanism behind it is straightforward: with a pool of 85 million IPs spanning 195 countries, some exit nodes are simply further from your target than others, and there is not always a clean way to filter for low-latency IPs before you send a request. The workaround is to test a sample of IPs for your specific target, build a whitelist, and bias your requests toward that subset.

Download speeds in testing came in at 5.9 to 7.8 Mbps, which is adequate for most scraping work. Blacklist presence was 2 out of 61 checked, which is acceptable for a residential pool of this size. The success rate on real scraping tasks came in around 85 to 86%, which is reasonable but not exceptional. Some competitors in the same price range push closer to 95% on comparable targets.

Setup

The setup process itself is standard. You get a server address, a port, a username, and a password. You drop those into your scraping tool or browser extension, restart, and you are live. The dashboard covers usage tracking, endpoint configuration, and IP whitelisting. It is not overwhelming, but it is also not as polished as some newer platforms that have invested heavily in UI. The documentation is functional without being exceptional, which is a fair summary of the onboarding experience overall.

For authentication, NetNut supports both username/password and IP whitelisting. Username/password authentication is what most teams use because it works regardless of where the request originates. IP whitelisting is more secure in principle but creates operational headaches if your team is distributed or if your outbound IP changes regularly. The choice comes down to your infrastructure setup rather than any hard rule about which is better.

API access is available for programmatic proxy management. Here is a working Python example using the requests library with retry logic, which is a general-purpose HTTP library for Python, and urllib3 for the retry adapter:

import requests
from requests.adapters import HTTPAdapter
from urllib3.util.retry import Retry

NETNUT_HOST = "residential.netnut.io"
NETNUT_PORT = 5959
NETNUT_USER = "your_username"
NETNUT_PASS = "your_password"

proxy_url = f"http://{NETNUT_USER}:{NETNUT_PASS}@{NETNUT_HOST}:{NETNUT_PORT}"

proxies = {
 "http": proxy_url,
 "https": proxy_url,
}

# Retry on connection errors and 5xx responses.
# max_retries=3 with backoff_factor=1.0 gives waits of 1s, 2s, 4s between attempts.
# This handles transient pool exhaustion without hammering the endpoint.
retry_strategy = Retry(
 total=3,
 backoff_factor=1.0,
 status_forcelist=[500, 502, 503, 504],
 allowed_methods=["GET", "POST"],
)

adapter = HTTPAdapter(max_retries=retry_strategy)
session = requests.Session()
session.mount("http://", adapter)
session.mount("https://", adapter)

headers = {
 "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) "
 "AppleWebKit/537.36 (KHTML, like Gecko) "
 "Chrome/124.0.0.0 Safari/537.36",
 "Accept-Language": "en-US,en;q=0.9",
}

try:
 response = session.get(
 "https://httpbin.org/ip",
 proxies=proxies,
 headers=headers,
 timeout=15, # 15 seconds is a safe ceiling for residential IPs
 )
 response.raise_for_status()
 print("Exit IP:", response.json())
except requests.exceptions.ProxyError as e:
 print(f"Proxy connection failed: {e}")
except requests.exceptions.Timeout:
 print("Request timed out. Consider increasing timeout for slow IPs.")
except requests.exceptions.HTTPError as e:
 print(f"HTTP error from target: {e}")

The 15-second timeout in the example is intentional. Given the latency variance across the residential pool, a tight 5-second timeout will produce a disproportionate number of false failures on legitimate but slow IPs. You will want to tune this value based on your target, but 15 seconds is a reasonable starting point for residential proxies in general.

Who Should Use NetNut

NetNut fits best when you have three things going on at once: serious volume (hundreds of gigabytes per month), targets with meaningful bot protection, and a preference for stable, always-on connectivity over the cheapest possible price. The direct ISP architecture makes the IPs genuinely hard to detect, and 85 million addresses gives you enough rotation room to avoid pattern detection on aggressive scraping targets.

It is a poor fit for small projects. The monthly minimum, the sales-led onboarding, and the absence of pay-as-you-go all point in the same direction. If you need 10 GB for a one-off project, there are providers that will sell you exactly that without requiring a sales call. NetNut is not one of them.

The mobile proxy product at 5 million IPs across 100 countries is worth considering for social platform work or any target that pays particular attention to device type. Mobile IPs carry a different trust profile from residential ones, and 99.9% advertised success rates on that product are consistent with what the architecture supports.

Support

Support channels include email, WhatsApp, and Telegram, which is unusual and genuinely useful for operational teams that need fast responses outside business hours. Enterprise accounts get dedicated account managers. At lower tiers, response times are reasonable but not instant. The technical depth of support responses is generally good, which reflects the company's focus on business clients who ask harder questions.

Final Verdict

NetNut is a solid enterprise proxy provider with a real architectural advantage in how it sources residential IPs. The pool is large, the fraud scores are low, and the direct ISP connectivity produces fewer unexplained failures than P2P alternatives. The latency variance is the main technical caveat, and the pricing structure rules it out for anyone who is not operating at scale. For B2B data teams running continuous pipelines, it is a credible choice. For everyone else, the entry barrier is simply too high to justify it over more flexible alternatives.