{"id":39427,"date":"2026-07-03T15:21:14","date_gmt":"2026-07-03T15:21:14","guid":{"rendered":"https:\/\/nodemaven.com\/?p=39427"},"modified":"2026-07-03T15:25:50","modified_gmt":"2026-07-03T15:25:50","slug":"netnut-shutdown","status":"publish","type":"post","link":"https:\/\/nodemaven.com\/ru\/blog\/netnut-shutdown\/","title":{"rendered":"NetNut Shutdown Explained: What Happened and the Best Alternative"},"content":{"rendered":"

NetNut has not announced that it has permanently closed. However, after the FBI seized certain domains<\/a> associated with NetNut<\/strong> on July 2, 2026, customers facing service interruptions<\/strong> may need an alternative. NodeMaven is a practical NetNut alternative option<\/a><\/strong> for teams that need clean residential and mobile IPs, stable sessions, and consistent proxy performance.<\/p>\n\n\n\n

The enforcement action followed investigations connecting NetNut traffic to Popa<\/strong>, a residential proxy network found on Android devices, smart TVs, and streaming boxes. Researchers allege<\/a> that many device owners did not knowingly agree to let third parties route traffic through their internet connections<\/strong>.<\/p>\n\n\n\n

NetNut\u2019s parent company, Alarum Technologies, confirmed the domain seizures<\/a> and said it would cooperate with law enforcement. It has not announced the liquidation or formal closure of NetNut Ltd.<\/p>\n\n\n\n

For customers, this creates immediate operational uncertainty. A company may remain registered while its gateways, IP supply, or customer workflows stop working. Teams affected by the disruption should preserve their account records, audit existing integrations, and test a residential proxies replacement option<\/a><\/strong> instead of assuming normal service will return quickly.<\/p>\n\n\n

\n
\n \"\" <\/div>\n \n
\n
Need a reliable NetNut alternative?<\/div>\n \n

Test NodeMaven with 750 MB for $3.50 and compare performance on your own workflows. For enterprise traffic or larger proxy packages, contact our team through 24\/7 live chat for custom pricing and migration support<\/p>\n<\/div>\n <\/div>\n \n \n \u041f\u043e\u043f\u0440\u043e\u0431\u043e\u0432\u0430\u0442\u044c <\/a>\n <\/div>\n<\/div>\n\n\n

What happened to NetNut?<\/strong><\/h2>\n\n\n\n

The NetNut shutdown story developed over several weeks. It began with technical research into unusually large scraping campaigns and ended with coordinated action by the FBI, Google, Lumen Technologies, and other industry partners.<\/p>\n\n\n\n

Date<\/strong><\/th>Event<\/strong><\/th>\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a<\/strong><\/th><\/tr><\/thead>
May 2026<\/strong><\/td>Qurium investigates scraping activity distributed across more than 1.4 million residential IP addresses.<\/strong><\/td>Qurium<\/a><\/td><\/tr>
17 \u0438\u044e\u043d\u044f 2026 \u0433\u043e\u0434\u0430<\/strong><\/td>Synthient conducts a controlled test connecting a NetNut commercial gateway to a device running the Popa SDK<\/strong>.<\/td>Synthient<\/a><\/td><\/tr>
June 18, 2026<\/strong><\/td>Qurium, Synthient, and KrebsOnSecurity publish investigations into the relationship between Popa and NetNut<\/strong>.<\/td>KrebsOnSecurity<\/a><\/td><\/tr>
June 23, 2026<\/strong><\/td>Qurium publishes results from controlled testing of Popa-enabled applications<\/strong>. Researchers recorded 10 million proxy requests and reported that most tested apps did not present meaningful consent notices.<\/strong><\/td>Qurium<\/a><\/td><\/tr>
July 2, 2026<\/strong><\/td>The FBI seizes domains associated with NetNut<\/strong>. Google says coordinated action reduced the network\u2019s available device pool by millions.<\/td>Alarum<\/a>, Reuters<\/a><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

Bloomberg reported<\/a> that the FBI was investigating whether an Alarum subsidiary had a role in connecting home devices to a proxy network without their owners\u2019 consent<\/strong>. The report cited documents and people familiar with the investigation.<\/p>\n\n\n\n

At the time of writing, public reporting does not show that NetNut or its executives have been convicted of a crime. The seizure confirms an enforcement action against associated infrastructure, not a final judgment about every allegation.<\/p>\n\n\n\n

Why was NetNut\u2019s proxy network targeted?<\/strong><\/h2>\n\n\n\n

The investigation centers on two connected questions: where some of NetNut\u2019s residential IPs came from<\/strong> \u0438 how customers used them<\/strong>.<\/p>\n\n\n\n

\u0420\u0435\u0437\u0438\u0434\u0435\u043d\u0442\u0441\u043a\u0438\u0435 \u043f\u0440\u043e\u043a\u0441\u0438<\/strong><\/a> route traffic through IP addresses assigned to household or consumer connections. They have legitimate uses, including public web data collection, localization testing, ad verification, and market research. Their value comes from looking like ordinary consumer traffic instead of traffic sent from a datacenter.<\/p>\n\n\n\n

The alleged connection between NetNut and Popa<\/strong><\/h3>\n\n\n\n

Popa is a family of proxy software that can register a device, maintain an encrypted connection, and relay traffic for a remote customer. Researchers found related components in Android applications, streaming software, VPN tools, and inexpensive TV boxes.<\/p>\n\n\n\n

Once enrolled, a device acts as an exit point. A request sent by a proxy customer reaches its destination through the device owner\u2019s home connection, so the target website sees the residential IP rather than the customer\u2019s original address.<\/p>\n\n\n\n

Qurium\u2019s investigation<\/a> identified about 5,000 software samples that implemented variants of the architecture. The samples communicated with approximately 46 controller domains and more than 300 backend servers. Qurium<\/a> also found historical infrastructure and business connections linking the Popa ecosystem with NetNut and Alarum<\/strong>.<\/p>\n\n\n\n

Qurium was careful about the limit of that evidence. It said no single historical observation established attribution on its own. The researchers instead described a pattern of technical and organizational links.<\/p>\n\n\n\n

A controlled test connected Popa traffic to NetNut<\/strong><\/h3>\n\n\n\n

Synthient<\/a> produced the clearest public evidence of a direct technical relationship.<\/p>\n\n\n\n

On June 17, its researchers sent a specially marked request into NetNut\u2019s commercial gateway at gw.netnut.net:9595. Synthient controlled both the system making the request and the honeypot receiving it. The request arrived from a host running the Popa SDK, complete with the marker \/NETNUT_EXT_TRAFFIC_FROM_PROXY.<\/p>\n\n\n\n

Based on that test, Synthient assessed with high confidence<\/a> that at least some Popa-enrolled devices served as exit nodes for NetNut customers<\/strong>. The company also found multiple Popa-related software samples communicating with sdk.netnut.io.<\/p>\n\n\n\n

The test supports a connection between the two networks. It does not, by itself, establish what NetNut\u2019s management knew about the installation or consent process on each device.<\/p>\n\n\n\n