NetNut Shutdown Explained: What Happened and What Proxy Users Should Do Next

Residential proxy sourcing has become one of the biggest trust issues in the proxy industry.

After Google announced coordinated action against the NetNut residential proxy network, many businesses using residential proxies were left with practical questions:

• Is my provider still stable?
• Were my workflows affected?
• Where did the residential IPs actually come from?
• What should I check before choosing another provider?

Google said it took action against the NetNut residential proxy network, also known as Popa, in coordination with the FBI, Lumen, and other partners. The action included disabling Google accounts and services used in malware command-and-control operations and sharing technical intelligence with law enforcement and industry partners. (Reuters)

For proxy users, this is not just a service disruption.

It is a reminder that residential proxy infrastructure depends heavily on how the network is sourced.

What happened to NetNut?

On July 2, 2026, Google announced action against the NetNut residential proxy network, also known as Popa. According to Reuters, Google said the network was being exploited in cybercrime activity, including activity connected to the Popa botnet. (Reuters)

Google said it disabled accounts and services tied to NetNut-related malware operations and shared intelligence on the group’s infrastructure with law enforcement and industry partners. Reuters also reported that Alarum Technologies, NetNut’s parent company, acknowledged that the FBI had seized certain domains and said it would cooperate with the investigation. (Reuters)

It is important to separate two things:

NetNut has not necessarily announced a permanent company closure.

But Google’s action was significant enough that affected users may see service disruption, reduced availability, or new internal compliance questions. NodeMaven’s coverage also notes that NetNut had not announced a permanent closure, while customers facing interruptions may need an alternative.

Why was the network targeted?

Residential proxies use IP addresses associated with real consumer internet connections.

That makes them useful for legitimate business work, including:

• Public web data collection
• SEO monitoring
• Ad verification
• Ecommerce tracking
• Localized testing
• Market research
• AI data workflows

But the same category can become high-risk when the sourcing layer is unclear.

Google said residential proxy networks can involve devices that become proxy exit nodes through malware, hidden proxy code, or bundled software. That is the core issue for the industry. A residential IP is not just a technical resource. It is connected to a real household, device, network, or user.

If participation is not based on clear consent, the proxy network becomes a risk for the device owner, the platform receiving the traffic, and the business using the proxy provider.

Why this matters for proxy buyers

For businesses, the immediate concern is operational.

A disruption can affect:

• Proxy gateways
• IP availability
• Location coverage
• Success rates
• Session stability
• Production scraping jobs
• Automated monitoring workflows

But the larger issue is vendor risk.

If a provider’s residential IP sourcing is unclear, customers may inherit risks they were never aware of during onboarding.

Those risks can show up as:

• Sudden pool degradation
• Failed requests
• Compliance reviews
• Security questions
• Procurement concerns
• Urgent migration work
• Loss of confidence in proxy infrastructure

Google also said NetNut had a reseller program and that it had high confidence many residential proxy brands were whitelabeling NetNut infrastructure. That means affected users should not only review NetNut directly. They should also review any provider that may depend on resold or whitelabeled residential supply. (Reuters)

Is NetNut permanently closed?

At the time of writing, public reporting points to a major disruption, not a confirmed permanent company shutdown.

Reuters reported that the FBI seized certain domains and that Alarum said it would cooperate with law enforcement. Google said its action significantly disrupted the NetNut residential proxy network and reduced available devices by millions. (Reuters)

For customers, the practical question is more immediate:

Can the provider still support your workflows reliably, transparently, and in a way your team can defend internally?

A provider does not need to be formally closed for customers to face serious operational risk.

What current NetNut users should do now

If your workflows were affected, avoid making a rushed replacement decision based only on price or pool size.

Start with a controlled review.

1. Identify every workflow using NetNut

Check all tools, scripts, crawlers, browsers, and applications using NetNut credentials or endpoints.

Prioritize:

• Revenue-critical pipelines
• Customer-facing dashboards
• Scheduled scraping jobs
• SERP monitoring
• Ecommerce tracking
• AI data collection
• Ad verification
• QA automation

2. Preserve records

Save copies of:

• Invoices
• Usage reports
• Endpoint settings
• Targeting settings
• Session configurations
• Support conversations
• Vendor documentation

This helps your team understand the impact and rebuild cleanly.

3. Rotate credentials

If NetNut credentials were stored across scripts, browsers, shared tools, or password managers, rotate them after moving away from the old setup.

Remove old endpoints and allowlist entries once they are no longer needed.

4. Review sourcing risk

Before choosing another residential proxy provider, ask:

• Are residential users clearly opted in?
• Can the provider explain how IPs enter the network?
• Are sourcing partners vetted?
• Is the supply chain direct and accountable?
• Is abuse monitored?
• Can the provider support legal, security, or procurement review?

A large residential pool is useful, but it is not enough.

The sourcing model matters.

5. Test any replacement in stages

Do not move all production traffic at once.

Start with:

• One workflow
• One country or city
• One session setup
• One benchmark window
• One success-rate comparison

Then scale after the replacement performs consistently.

What ethical residential proxy sourcing should mean

Ethical sourcing is not just a branding term.

For residential proxies, it should mean that participation is based on clear consent, transparent partnerships, and responsible network management.

A residential proxy network should not depend on:

• Hidden proxy code
• Malware-infected devices
• Unclear opt-ins
• Unverified reseller chains
• Supply sources that customers cannot evaluate

For business users, this matters because sourcing affects more than compliance.

It affects continuity, stability, reputation, and trust.

A proxy network built on questionable supply can lose availability quickly. A network built on consent and transparent participation is better positioned for long-term use.

What to look for in a replacement provider

After this news, proxy buyers should update how they evaluate residential proxy providers.

Do not only compare:

• Pool size
• Price per GB
• Number of countries
• Dashboard design
• Setup speed

Also compare:

• Sourcing transparency
• Consent model
• Partner vetting
• Reseller dependency
• Abuse prevention
• Support during incidents
• Legal and procurement readiness
• Long-term network stability

The cheapest provider can become expensive if failed requests, blocked workflows, or compliance reviews slow down your team.

A better metric is:

Cost per successful, compliant request.

Where ProxyScrape fits

For teams reviewing residential proxy alternatives, ProxyScrape is one option to consider if ethical sourcing and predictable scaling are part of the decision.

ProxyScrape’s Residential Proxies are built around ethically sourced residential IPs, with coverage for common business workflows such as public web data collection, SEO monitoring, ecommerce tracking, ad verification, and localized testing.

The residential product includes:

• 120M+ residential IPs
• 195+ locations
• Country, state, and city targeting
• Rotating and sticky sessions
• HTTP and SOCKS5 support
• Unlimited concurrent connections
• 1GB trial for $1

For teams with heavier usage, ProxyScrape also offers Unlimited Residential Proxies with no GB limits and no overage fees.

This is most relevant for teams running continuous data collection, large-scale monitoring, or workloads where bandwidth-based pricing becomes difficult to predict.

How to migrate from NetNut to a new provider

Most proxy migrations do not require a full rebuild.

The main work is replacing endpoints, recreating targeting settings, and testing session behavior before moving production traffic.

Step 1: Choose the right proxy model

Use pay-per-GB residential proxies for controlled or moderate usage.

Use unlimited residential proxies if your traffic is high-volume, continuous, or hard to predict by bandwidth.

Step 2: Create new credentials

Generate new credentials with the replacement provider and match the authentication method used in your current setup.

Step 3: Recreate targeting

Map your current settings to the new provider’s options:

• Country
• State
• City
• Rotation
• Sticky sessions
• Protocols

Step 4: Test in staging

Update your proxy hostname, port, username, and password in a controlled environment first.

Step 5: Compare performance

Measure:

• Success rate
• Response time
• Location accuracy
• Retry rate
• Error rate
• Session persistence
• Cost per successful request

Step 6: Move production traffic gradually

Start with a small share of traffic, then scale once performance is stable.

Step 7: Remove old access

After migration, remove old credentials, endpoints, and allowlist entries from your tools.

FAQ

Did NetNut shut down?

Public reporting points to a major disruption, not a confirmed permanent company closure. Google announced action against the NetNut residential proxy network, and Reuters reported FBI seizure of certain domains connected to the case. (Reuters)

Why was NetNut targeted?

Google said it acted against the NetNut residential proxy network, also known as Popa, as part of its effort to disrupt malicious residential proxy networks. The action involved malware command-and-control infrastructure and intelligence sharing with law enforcement and industry partners. (Reuters)

Are residential proxies legal?

Residential proxies can support legitimate business uses, including public web data collection, ad verification, localization testing, and market research. The key issue is how the IPs are sourced and how the network is used.

What should affected NetNut users do first?

Start by identifying every workflow using NetNut endpoints. Then preserve records, rotate credentials, review sourcing risk, and test a replacement provider on a small workload before moving production traffic.

What questions should I ask a residential proxy provider now?

Ask how residential users opt in, how sourcing partners are vetted, whether the supply chain is direct or resold, how abuse is monitored, and whether the provider can support legal or procurement review.

Is ProxyScrape a NetNut alternative?

Yes. ProxyScrape can be considered by teams looking for ethically sourced residential proxies, flexible residential plans, and unlimited residential options for high-volume usage.

Final takeaway

The NetNut disruption is a reminder that residential proxy sourcing cannot be ignored.

For businesses, the lesson is not only to have a backup proxy provider.

The lesson is to understand the network behind the provider.

If your workflows depend on residential IPs, you need more than a large pool and a low price. You need clear sourcing, consent-based participation, operational reliability, and a provider that can answer difficult questions about its infrastructure.

That should become the new baseline for residential proxy buying.