NetNut

On July 2, 2026, the FBI and IRS Criminal Investigation, working with Google, Lumen's Black Lotus Labs, and the Shadowserver Foundation, seized hundreds of domains tied to NetNut, a residential proxy service operated by Nasdaq-listed Alarum Technologies (ALAR). Researchers connect NetNut's residential proxy pool to a botnet tracked as "Popa," alleged to include at least two million consumer devices — smart TVs and streaming boxes — enrolled with little or no meaningful user consent. Google reported observing hundreds of distinct threat clusters, including cybercriminal and espionage groups, using NetNut exit nodes to disguise their activity. Alarum has disputed the allegations and stated, as of its July 3 disclosure, that neither it nor NetNut had been formally contacted by the FBI or any regulatory authority at that time.