NetNut Disrupted by FBI and Google: What Happened and 7 Alternatives (2026)

By Elena Park · 2026-07-29 · 8 min read · News

If you are searching for a NetNut alternative, here is what has been reported, what is still unknown, how to protect your billing, and 7 providers worth evaluating, plus the checks to run before you switch.

What happened to NetNut

In early July 2026 the FBI and Google's Threat Intelligence Group announced a joint operation against a residential proxy network that researchers call the Popa botnet and that they link to NetNut. As reported by Infosecurity Magazine on 3 July 2026, researchers say the network co-opted more than two million consumer devices, including smart TVs and streaming boxes, and that at least 316 threat clusters used its exit nodes during one week of June.

The reported actions include the FBI seizing hundreds of domains, with a seizure banner appearing on netnut.com, Google disabling the accounts used to control the malware, and Google updating Play Protect to warn Android users and disable apps containing the affected software components. Google said its actions caused significant degradation to the network and the business.

What is confirmed and what is not

Reported by the sources we reviewed: the takedown operation, the scale researchers describe, and independent findings that some host apps did not clearly tell users or ask for consent before sharing their bandwidth.

Not clear from that reporting: whether the service has fully stopped, what has happened to customers, and the legal outcome. The primary netnut.io domain was reported to stay accessible for a time, and some commentators disputed which domain was targeted.

Alarum Technologies, the listed company linked to NetNut, has marketed its software as consensual bandwidth sharing and said it would cooperate with law enforcement on any misuse of its infrastructure. These are allegations and research findings, not court findings. We are treating NetNut as under investigation and have marked it that way on its review page.

If you use NetNut today

Check what you are being billed. If you decide to leave, cancel auto-renewal and keep copies of your invoices and account status. If you were charged for service you did not receive, contact your card issuer or payment provider and ask about your options, with your records ready. NetNut has not published a refund policy for this situation that we could find.

Do not wait for a resolution before planning a move. Run a replacement alongside NetNut, compare success rates on your real targets, and switch over once the new setup holds up. Because the proxy endpoint is usually a configuration value, the technical change is often small.

Switching brands does not guarantee a clean network

The same reporting says Google assessed, with high confidence, that many popular residential proxy brands resell or whitelabel the NetNut network. That means the name on the dashboard does not tell you where the IPs come from. We cannot tell you from outside which brands are affected, and we do not claim that any provider below is free of that risk. Use the checklist at the end of this post before you commit.

How to check whether a provider resold NetNut traffic

Many proxy brands do not name their suppliers, so you often cannot tell from the website. Ask support in writing which networks their residential pool comes from and whether any of it came from NetNut.

You can also look up a sample of the IPs you are given in an IP lookup tool and check which networks they belong to. This is a clue, not proof. If a provider cannot or will not answer, treat that as a risk and test with a small plan first.

7 alternatives to evaluate

Prices and pool sizes below are the figures listed on our review pages. Providers change them often, so confirm current pricing and sourcing documents before buying. ToptierProxy earns a commission on some of these links, which does not change the facts we list.

1. Decodo: about 115M+ residential IPs, from about $2/GB. A common first pick for general scraping and a straightforward move for teams leaving a per-GB residential provider.

2. Bright Data: about 400M+ IPs, with entry pay-as-you-go pricing around $8/GB and lower rates on committed plans. It publishes compliance and KYC information, which helps if you need procurement paperwork. Check its current certifications on its own site.

3. Oxylabs: about 175M+ IPs, around $8/GB at entry level, with a strong line of managed scraper APIs for teams that want less proxy plumbing.

4. NodeMaven: from about $3.75/GB, about 30M+ IPs, with residential and ISP proxy options. Worth testing if you need stable sessions.

5. IPRoyal: from about $1.75/GB, about 32M+ IPs, with traffic that does not expire. A budget-friendly option for lighter workloads.

6. Floppydata: rotating residential from about $1/GB. It does not publicly disclose its pool size, so ask directly how its IPs are sourced before relying on it.

7. Webshare: from about $1/GB, about 30M+ IPs, and a small free plan you can use to test the service. Free plan limits change, so check the current terms.

How to move your traffic

Keep the same code and change only the endpoint, port and credentials, or your IP allowlist if the provider uses one. Run the new provider on a slice of real traffic for a day or two. Compare success rate, response time and block rate against your current setup, then shift the rest. Keep the old configuration available until the new one has run cleanly for a while.

What to check before you commit to any replacement

Ask for a real sourcing explanation: how residential IPs are obtained, what device owners are told, and how consent is recorded. Ask directly whether any of the supply is resold or whitelabeled from another network, and from whom. Look for a real KYC process, since signup with no identity checks at all is a warning sign. Look for named leadership and a real company address. Prefer independent testing over a provider's own marketing, and start with a small paid test before you move production traffic.

Frequently Asked Questions