Google Disrupts NetNut Residential Proxy Network Spanning 2 Million Home Devices
Google Disrupts NetNut Residential Proxy Network Spanning 2 Million Home Devices
https://thehackernews.com/2026/07/google-disrupts-netnut-residential.html
Publish Date: 2026-07-02 14:54:00
Source Domain: thehackernews.com
Google has significantly degraded NetNut, one of the biggest networks that turns home devices into rented relays for other people’s traffic.
Working with the FBI, Lumen, and others, Google’s Threat Intelligence Group (GTIG) said this week it had reduced the network’s pool of usable devices by millions.
Google identifies NetNut, also tracked as Popa, as a network spread across home devices worldwide, including smart TVs and streaming boxes, and GTIG estimates the network holds at least 2 million devices.
If one of those devices is in your home, strangers can route their own traffic through your internet connection, and your address gets the blame for whatever they do with it.
How It Works
A residential proxy network sells access to real home internet addresses. Attackers pay to route their traffic through your connection so it looks like ordinary home browsing, not the datacenter traffic that security tools tend to block.
To build that pool, operators need their code running on home devices. Some devices ship with it pre-installed on cheap off-brand hardware; others pick it up when someone installs a free app that hides it. Once it is running, the device becomes an “exit node,” a doorway that other people’s traffic flows through.
Google says an exit node brings outside traffic inside the home network, giving attackers a foothold to reach other devices on it. Some of these home gadgets have also been pulled into large attack botnets such as Mirai and Badbox 2.0.
In a single week in June, GTIG counted 316 distinct threat clusters using suspected NetNut exit nodes, including cybercriminal and espionage groups, to hide their real location and run password-guessing attacks.
The Company Behind It
Unlike most proxy botnets, NetNut traces back to a public company. In June, researchers at Qurium, Synthient, Nokia Deepfield, and Spur tied Popa to NetNut.
NetNut is a proxy provider owned by publicly…
