NetNut, 98 Days After the FBI Seizure

Home › Guides › NetNut After the Seizure

✓ checked 8 October 2026 at 4:20 PM ET · sources: live checks of NetNut and Alarum domains, Alarum’s SEC filings, Google, Gen, KrebsOnSecurity, the Internet Archive and the Chrome UX Report (CC BY 4.0) · method · caveats · download the data

On 2 July 2026 the FBI seized domains belonging to NetNut, a residential proxy network owned by the Nasdaq- and TASE-listed Alarum Technologies. 98 days later, we checked what is still online, what Alarum has told investors, and what outside data shows about the network since.

Read this first. A domain seizure is a law-enforcement action, not a court finding. The filings we found describe a seizure, a traffic pause and private lawsuits; they don’t mention criminal charges against NetNut or Alarum. Descriptions of the network as a botnet are Google’s and other researchers’, and we attribute them. Alarum says it will cooperate with law enforcement and defend itself against the lawsuits.

days since the seizure 98domains still showing the seizure page 5 of 5Alarum filings since 2 July 7Windows PCs with NetNut software, early Sept (Gen) ~474,000

Headline numbers

1. Every NetNut and Alarum address we checked still shows the FBI seizure page. On 8 October netnut.io, www.netnut.io, netnut.com, status.netnut.io and Alarum’s own site, alarum.io, all returned the same page, titled “Seized by the Federal Bureau of Investigation”. Its text says the action was taken “against the NetNut residential proxy platform, its administrators, and its subscribers”.
2. Alarum has filed 7 reports with the SEC since the seizure, and none since 27 August (42 days before our check). The last one delays its first-half results. Alarum says it still didn’t know “the exact root cause” on 13 July and that cost measures would affect about a third of its workforce.
3. The installed software is still out there, but quiet. Gen says it saw NetNut-associated software on about 474,000 active Windows computers between 1 and 15 September, with no matching NetNut proxy traffic.
4. Two class-action filings and two discovery motions. Alarum reports a motion to certify an Israeli class action (the plaintiff puts damages at up to NIS 120 million), a US class action complaint filed in New Jersey on 5 August that it says it hasn’t been served with, and two shareholder discovery motions with hearings on 14 and 15 December 2026.
5. In its 2 July post, Google estimated the network at “at least 2 million devices” and said it saw 316 threat clusters use suspected NetNut exit nodes in one June week. Google says the action reduced the pool of devices “by millions”.
6. Web traffic to netnut.io dropped a bucket. In the Chrome UX Report, netnut.io was in the top 5 million bucket worldwide every month from January to July 2026 and fell to the top 10 million bucket in August. It had been in the top 1 million bucket in August 2025.

What’s online on 8 October

All 5 responses carry the same image. Its text reads:

“This domain has been seized by the Federal Bureau of Investigation in accordance with federal law as part of a law enforcement action, taken in coordination with the Department of Justice and the Internal Revenue Service Criminal Investigation, against the NetNut residential proxy platform, its administrators, and its subscribers.”

“The FBI also acknowledges that Google, Lumen’s Black Lotus Labs, and the Shadowserver Foundation, with assistance from their partners, have disrupted other domains and infrastructure used by the NetNut residential proxy platform and its subscribers in separate and independent operations pursuant to civil action and violations of terms of service, respectively.”

The Internet Archive made 37 captures of netnut.io between May and August 2026. Its copies still show NetNut’s normal homepage up to 5 July at 2:08 PM ET, and the first copy showing the seizure page is from 7 July at 11:17 AM ET. The archive’s crawler may have reached a cached copy for a few days, so this doesn’t date the seizure itself; Alarum and KrebsOnSecurity date it to 2 July.

What Alarum and others have said since

The network before and after

In its 2 July post, Google wrote: “Google Threat Intelligence Group (GTIG) estimates the size of the NetNut network to be at least 2 million devices, distributed across the world.” and “In a single week during June 2026, GTIG observed 316 distinct threat clusters using suspected NetNut exit nodes, including cybercriminal and espionage groups.” It says the action caused significant degradation, “reducing the available pool of devices for the proxy operator by millions”, and warns that “when faced with the degradation of their own botnet, proxy operators begin buying capacity from their competitors, effectively becoming a reseller”. KrebsOnSecurity reported that the FBI worked with industry partners to “seize hundreds of domains associated with NetNut”.

Gen’s 30 September report adds the most recent outside measurement: “we still observed software associated with NetNut on approximately 474,000 active Windows systems. At the same time, we did not observe corresponding NetNut proxy traffic from those installations.” Gen says this is consistent with Alarum’s announced pause.

Chrome UX Report buckets for netnut.io, worldwide:

For how NetNut fits into the wider history of proxy-network takedowns, see our residential proxy botnet timeline. For the apps that supply home connections to proxy networks, see The Home-Internet Supply Chain.

Method

Live checks. On 8 October 2026 at 4:20 PM ET we requested five addresses with a standard browser user agent, saved each response with its SHA-256 hash, and read the page title. The seizure page’s text is inside an image; we saved the image and transcribed it with OCR (Tesseract), then checked the transcription by eye.

Filings. We downloaded Alarum’s SEC submission index (CIK 1725332) and every Form 6-K and exhibit filed from 2 July to 8 October 2026. Every quotation is checked word for word against the saved filing.

Other sources. Google’s 2 July post, KrebsOnSecurity’s 2 July article and Gen’s 30 September report, saved on 8 October. Internet Archive capture list (CDX API) for netnut.io, May–October 2026, with six copies downloaded to read their titles. Chrome UX Report via BigQuery: materialized.device_summary, best rank bucket for https://netnut.io for each month from January to August 2026 (0.41 GB billed), plus August 2024 and 2025 from an earlier query.

Verification. A separate script re-reads every saved file, recomputes each number and checks every quotation against its source.

Caveats

• A seizure page tells you a domain is under law-enforcement control. It doesn’t tell you whether NetNut operates under other names or through resellers. Google says it has “high confidence that many popular residential proxy brands are in fact whitelabeling the NetNut botnet”, and that proxy operators can rebuild by buying capacity from competitors.
• Alarum’s filings are the company’s own account. The lawsuits are claims by the plaintiffs, not findings, and Alarum says it will defend itself.
• Gen’s figures come from Windows computers running Gen’s security products, not the whole internet. Google’s figures are its estimates.
• Chrome UX Report buckets are wide and only count Chrome users who share usage statistics. A proxy service’s customers can use it without visiting its website.
• We found no new Alarum filing after 27 August. Something may have been announced in other channels, such as the Tel Aviv Stock Exchange, which we didn’t check.

Download the data

• Timeline, live checks, archive captures and CrUX buckets (CSV): every dated event and quotation on this page with its source URL and the SHA-256 hash of our saved copy, plus each live check and Internet Archive capture.

Cite as: ProxyPicker, “NetNut, 98 Days After the FBI Seizure”, 8 October 2026, https://proxypicker.com/netnut-after-the-seizure/. Includes data from the Chrome UX Report by Google, licensed CC BY 4.0.

Related: Residential proxy botnet timeline · The Home-Internet Supply Chain Behind AI and Proxies · What Your Wi-Fi Is Worth · Proxy provider comparison.

Press & data requests: email [email protected] for interviews, the raw data behind this page, or corrections. See also our contact page.