{"id":3993,"date":"2026-07-02T20:04:39","date_gmt":"2026-07-02T20:04:39","guid":{"rendered":"https:\/\/blog.ibvl.in\/index.php\/2026\/07\/02\/fbi-seizes-netnut-proxy-platform-popa-botnet\/"},"modified":"2026-07-02T20:04:39","modified_gmt":"2026-07-02T20:04:39","slug":"fbi-seizes-netnut-proxy-platform-popa-botnet","status":"publish","type":"post","link":"https:\/\/blog.ibvl.in\/index.php\/2026\/07\/02\/fbi-seizes-netnut-proxy-platform-popa-botnet\/","title":{"rendered":"FBI Seizes NetNut Proxy Platform, Popa Botnet"},"content":{"rendered":"<div>\n<p>The <strong>Federal Bureau of Investigation<\/strong> (FBI) said today it worked with industry partners to seize hundreds of domains associated with <strong>NetNut<\/strong>, a sprawling residential proxy service operated by the publicly-traded Israeli company <strong>Alarum Technologies <\/strong>[NASDAQ: ALAR]. The action comes roughly two weeks after KrebsOnSecurity published findings from multiple security firms connecting NetNut to the <strong>Popa<\/strong> botnet, a collection of at least two million devices that have been compromised by malicious software with little or no consent from victims.<\/p>\n<div id=\"attachment_73926\" style=\"width: 757px\" class=\"wp-caption aligncenter\"><img loading=\"lazy\" aria-describedby=\"caption-attachment-73926\" decoding=\"async\" class=\" wp-image-73926\" src=\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2026\/07\/netnutseizure.png\" alt=\"\" width=\"747\" height=\"415\" srcset=\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2026\/07\/netnutseizure.png 1407w, https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2026\/07\/netnutseizure-768x427.png 768w, https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2026\/07\/netnutseizure-782x435.png 782w\" sizes=\"auto, (max-width: 747px) 100vw, 747px\"><\/p>\n<p id=\"caption-attachment-73926\" class=\"wp-caption-text\">The NetNut homepage today was replaced by this seizure banner from the FBI.<\/p>\n<\/div>\n<p>On June 19, three different security firms <a href=\"https:\/\/krebsonsecurity.com\/2026\/06\/popa-botnet-linked-to-publicly-traded-israeli-firm\/\" target=\"_blank\" rel=\"noopener\">issued similar findings<\/a>: That NetNut is a residential proxy network which populates a botnet called Popa, and distributes software for devices commonly found in homes, such as smart TVs and streaming boxes. NetNut\u2019s software turns those systems into always-on residential proxy nodes that are rented to others, who predominantly use them to relay abusive and intrusive Internet traffic, such as mass content scraping, advertising fraud, and account takeover activity.<\/p>\n<p>Earlier today, NetNut\u2019s homepage was replaced with a seizure notice from the FBI and the <strong>Internal Revenue Service Criminal Investigation<\/strong> division. The seizure notice thanked <strong>Google<\/strong>, <strong>Lumen<\/strong>, <strong>Shadowserver<\/strong> and other industry partners for their help in dismantling hundreds of domains tied to the Popa botnet, which experts say has long been synonymous with NetNut\u2019s residential proxy infrastructure.<\/p>\n<p>In a blog post published today, the <strong>Google<\/strong> <strong>Threat Intelligence Group<\/strong> (GTIG) said NetNut\u2019s proxy network is widely resold and white-labeled by a number of third-party proxy providers, and that its services are heavily sought out by cybercriminals seeking to obfuscate the source of their malicious traffic. The GTIG said that in a single week during June 2026, they observed 316 distinct clusters of threat actors using suspected NetNut exit nodes, including cybercriminal and espionage groups.<\/p>\n<p>\u201cThese bad actors can use NetNut to mask their origin IP address when accessing victim environments, accessing their own infrastructure, and conducting password spray attacks,\u201d Google\u2019s GTIG <a href=\"https:\/\/cloud.google.com\/blog\/topics\/threat-intelligence\/google-continued-disruption-residential-proxy-networks\" target=\"_blank\" rel=\"noopener\">wrote<\/a>. \u201cFurthermore, when a consumer device becomes an exit node, unauthorized network traffic passes through it. This means bad actors can access other private devices on the same home network, effectively exposing them to Internet threats.\u201d<\/p>\n<p>Google said it disabled Google accounts and services used by NetNut for malware command and control, and that it shared technical intelligence on NetNut\u2019s software development kits (SDKs) and backend infrastructure with platform providers, law enforcement and research firms. The company also disabled apps known to bundle NetNut\u2019s various SDKs.<\/p>\n<p>NetNut parent Alarum Technologies did not respond to requests for comment on today\u2019s takedown. Prior to the publication of our story last month on the company\u2019s apparent connection to the Popa botnet, Alarum disputed the characterization of NetNut as a botnet, and said it reserved the right to sue anyone publishing reports that might besmirch the company\u2019s brand.<br \/>\n<span id=\"more-73923\"><\/span><\/p>\n<p><strong>Benjamin Brundage<\/strong> is founder of the proxy tracking service <strong>Synthient<\/strong>, one of the companies that <a href=\"https:\/\/synthient.com\/blog\/popa-from-sourcing-to-distribution\" target=\"_blank\" rel=\"noopener\">published evidence last month<\/a> linking the Popa botnet to NetNut and Alarum Technologies. Brundage said the domain seizures appear to have disrupted both the Popa botnet and the NetNut proxy network that rides on top of it.<\/p>\n<p>Brundage said NetNut\u2019s apparent demise is likely to be a great disadvantage for the cybercrime community, which was already reeling from <a href=\"https:\/\/cloud.google.com\/blog\/topics\/threat-intelligence\/disrupting-largest-residential-proxy-network\" target=\"_blank\" rel=\"noopener\">legal actions by Google<\/a> earlier this year that seized infrastructure for NetNut\u2019s biggest competitor \u2014 <a href=\"https:\/\/krebsonsecurity.com\/tag\/ipidea\/\" target=\"_blank\" rel=\"noopener\">IPIDEA<\/a>.<\/p>\n<p>\u201cI think this takedown is going to have a big impact, because NetNut gained significant popularity after the IPDEA takedown,\u201d he said. \u201cAlso NetNut has been incredibly common among resellers, and they were on par with IPIDEA in terms of their daily traffic, quality, size, price per gigabyte, all of it.\u201d<\/p>\n<div id=\"attachment_73938\" style=\"width: 759px\" class=\"wp-caption aligncenter\"><img aria-describedby=\"caption-attachment-73938\" decoding=\"async\" loading=\"lazy\" class=\" wp-image-73938\" src=\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2026\/07\/netnut-popa-blacklotus.png\" alt=\"\" width=\"749\" height=\"374\" srcset=\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2026\/07\/netnut-popa-blacklotus.png 1435w, https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2026\/07\/netnut-popa-blacklotus-768x384.png 768w, https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2026\/07\/netnut-popa-blacklotus-782x391.png 782w\" sizes=\"auto, (max-width: 749px) 100vw, 749px\"><\/p>\n<p id=\"caption-attachment-73938\" class=\"wp-caption-text\">NetNut\u2019s infrastructure, in a nutshell. Image: Black Lotus Labs, Lumen.<\/p>\n<\/div>\n<p>The NetNut and Popa botnet takedown may have another added benefit, Brundage said: Lessening the impact of large distributed denial-of-service botnets that have been built on the backs of poorly configured residential proxy services. In January, Synthient <a href=\"https:\/\/krebsonsecurity.com\/2026\/01\/the-kimwolf-botnet-is-stalking-your-local-network\/\" target=\"_blank\" rel=\"noopener\">revealed<\/a> how cybercriminals had built the world\u2019s largest DDoS botnet (Kimwolf) by tunneling through IPIDEA proxy connections into the local networks of TV boxes owners, and infecting other Android-based devices behind the victim\u2019s firewall.<\/p>\n<p>While many of the bigger proxy providers took steps to block this activity, resellers of the major proxy networks have been far slower to respond to the threat, Brundage said.<\/p>\n<p>\u201cIn terms of all these TV box devices getting compromised from the proxy network, it will have an impact on the DDoS botnets out there,\u201d he said.<\/p>\n<p>For its part, Google reckons today\u2019s actions have caused \u201csignificant degradation to NetNut\u2019s proxy network and its business operations, reducing the available pool of devices for the proxy operator by millions.\u201d But the company warns that proxy networks can rebuild themselves by effectively reselling other proxy services, as IPIDEA has done over the past few months.<\/p>\n<p>\u201cGoogle has high confidence that many popular residential proxy brands are in fact whitelabeling the NetNut botnet,\u201d the GTIG report concludes. \u201cWhile we expect this disruption to have a larger ripple effect across the residential proxy ecosystem, observations after the disruption of IPIDEA proved that individual networks can appear resilient. What we have observed is that when faced with the degradation of their own botnet, proxy operators begin buying capacity from their competitors, effectively becoming a reseller. We recognize that creating a lasting disruption in this fluid ecosystem means we must scale our efforts to target the infrastructure of several interconnected providers.\u201d<\/p>\n<p>As KrebsOnSecurity has warned repeatedly, most of the no-name TV streaming boxes for sale on the major e-commerce websites either come <a href=\"https:\/\/krebsonsecurity.com\/2025\/11\/is-your-android-tv-streaming-box-part-of-a-botnet\/\" target=\"_blank\" rel=\"noopener\">pre-installed with residential proxy software<\/a>, or require the installation of proxy SDKs in order to use the device for its stated purpose (streaming pirated movies, sporting events and TV shows). Google\u2019s advice here is sound: When it comes to TV boxes, stick to name brands from reputable manufacturers, and then be sparing and judicious with any apps you choose to install.<\/p>\n<p>The <a href=\"https:\/\/krebsonsecurity.com\/2025\/11\/is-your-android-tv-streaming-box-part-of-a-botnet\/\" target=\"_blank\" rel=\"noopener\">sketchy TV boxes<\/a> that are being commandeered by the Popa botnet and other threats all come with or require the user to install unofficial Android operating systems that do not operate within the confines of Google\u2019s Official Play Protect store. Google says consumers can confirm whether or not a device is built with the official Android TV OS and Play Protect certification by following <a href=\"https:\/\/support.google.com\/googleplay\/answer\/7165974\" target=\"_blank\" rel=\"noopener\">these instructions<\/a>.<\/p>\n<p>Even people without TV streaming boxes can find their smart TVs enrolled in residential proxy networks, just by installing one of thousands of apps available for download on <strong>Samsung<\/strong> and <strong>LG<\/strong> smart TVs. In <a href=\"https:\/\/spur.us\/blog\/smart-tv-apps-residential-proxy-sdks\" target=\"_blank\" rel=\"noopener\">a report<\/a> released last month, the proxy tracking company <strong>Spur<\/strong> found 42 percent of apps available for download via the webOS operating system on LG smart TVs include SDKs that turn one\u2019s television into an always-on residential proxy node. More than a quarter of the apps made for Samsung\u2019s\u00a0<strong>Tizen<\/strong> operating system had similar residential proxy components, Spur found.<\/p>\n<div id=\"attachment_73849\" style=\"width: 758px\" class=\"wp-caption aligncenter\"><img aria-describedby=\"caption-attachment-73849\" decoding=\"async\" loading=\"lazy\" class=\" wp-image-73849\" src=\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2026\/06\/spur-tvproxy.png\" alt=\"\" width=\"748\" height=\"305\" srcset=\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2026\/06\/spur-tvproxy.png 1272w, https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2026\/06\/spur-tvproxy-768x313.png 768w, https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2026\/06\/spur-tvproxy-782x318.png 782w\" sizes=\"auto, (max-width: 748px) 100vw, 748px\"><\/p>\n<p id=\"caption-attachment-73849\" class=\"wp-caption-text\">Image: Spur.us.<\/p>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>The Federal Bureau of Investigation (FBI) said today it worked with industry partners to seize hundreds of domains associated with NetNut, a sprawling residential proxy service operated by the publicly-traded Israeli company Alarum Technologies [NASDAQ: ALAR]. The action comes roughly two weeks after KrebsOnSecurity published findings from multiple security firms connecting NetNut to the Popa [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"site-container-style":"default","site-container-layout":"default","site-sidebar-layout":"default","disable-article-header":"default","disable-site-header":"default","disable-site-footer":"default","disable-content-area-spacing":"default","footnotes":""},"categories":[113,1291,411,90,565,46,1366,1367,358,1302,969,115,1304,1309,1315,1368,368,145],"tags":[91],"class_list":["post-3993","post","type-post","status-publish","format-standard","hentry","category-a-little-sunshine","category-alarum-technologies-ltd","category-benjamin-brundage","category-cybersecurity","category-fbi","category-google","category-google-threat-intelligence-group","category-internal-revenue-service-criminal-investigation","category-ipidea","category-lg","category-lumen","category-neer-do-well-news","category-netnut","category-popa-botnet","category-samsung","category-shadowserver","category-synthient","category-web-fraud-2-0","tag-cybersecurity"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v26.7 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>FBI Seizes NetNut Proxy Platform, Popa Botnet - Imperative Business Ventures Limited<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/blog.ibvl.in\/index.php\/2026\/07\/02\/fbi-seizes-netnut-proxy-platform-popa-botnet\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"FBI Seizes NetNut Proxy Platform, Popa Botnet - Imperative Business Ventures Limited\" \/>\n<meta property=\"og:description\" content=\"The Federal Bureau of Investigation (FBI) said today it worked with industry partners to seize hundreds of domains associated with NetNut, a sprawling residential proxy service operated by the publicly-traded Israeli company Alarum Technologies [NASDAQ: ALAR]. The action comes roughly two weeks after KrebsOnSecurity published findings from multiple security firms connecting NetNut to the Popa [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/blog.ibvl.in\/index.php\/2026\/07\/02\/fbi-seizes-netnut-proxy-platform-popa-botnet\/\" \/>\n<meta property=\"og:site_name\" content=\"Imperative Business Ventures Limited\" \/>\n<meta property=\"article:published_time\" content=\"2026-07-02T20:04:39+00:00\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/07\/02\/fbi-seizes-netnut-proxy-platform-popa-botnet\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/07\/02\/fbi-seizes-netnut-proxy-platform-popa-botnet\/\"},\"author\":{\"name\":\"admin\",\"@id\":\"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02\"},\"headline\":\"FBI Seizes NetNut Proxy Platform, Popa Botnet\",\"datePublished\":\"2026-07-02T20:04:39+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/07\/02\/fbi-seizes-netnut-proxy-platform-popa-botnet\/\"},\"wordCount\":1175,\"image\":{\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/07\/02\/fbi-seizes-netnut-proxy-platform-popa-botnet\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2026\/07\/netnutseizure.png\",\"keywords\":[\"Cybersecurity\"],\"articleSection\":[\"A Little Sunshine\",\"Alarum Technologies Ltd\",\"Benjamin Brundage\",\"Cybersecurity\",\"FBI\",\"Google\",\"Google Threat Intelligence Group\",\"Internal Revenue Service Criminal Investigation\",\"IPidea\",\"LG\",\"Lumen\",\"Ne'er-Do-Well News\",\"NetNut\",\"Popa botnet\",\"Samsung\",\"Shadowserver\",\"Synthient\",\"Web Fraud 2.0\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/07\/02\/fbi-seizes-netnut-proxy-platform-popa-botnet\/\",\"url\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/07\/02\/fbi-seizes-netnut-proxy-platform-popa-botnet\/\",\"name\":\"FBI Seizes NetNut Proxy Platform, Popa Botnet - Imperative Business Ventures Limited\",\"isPartOf\":{\"@id\":\"https:\/\/blog.ibvl.in\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/07\/02\/fbi-seizes-netnut-proxy-platform-popa-botnet\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/07\/02\/fbi-seizes-netnut-proxy-platform-popa-botnet\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2026\/07\/netnutseizure.png\",\"datePublished\":\"2026-07-02T20:04:39+00:00\",\"author\":{\"@id\":\"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02\"},\"breadcrumb\":{\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/07\/02\/fbi-seizes-netnut-proxy-platform-popa-botnet\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/blog.ibvl.in\/index.php\/2026\/07\/02\/fbi-seizes-netnut-proxy-platform-popa-botnet\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/07\/02\/fbi-seizes-netnut-proxy-platform-popa-botnet\/#primaryimage\",\"url\":\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2026\/07\/netnutseizure.png\",\"contentUrl\":\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2026\/07\/netnutseizure.png\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/07\/02\/fbi-seizes-netnut-proxy-platform-popa-botnet\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/blog.ibvl.in\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"FBI Seizes NetNut Proxy Platform, Popa Botnet\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/blog.ibvl.in\/#website\",\"url\":\"https:\/\/blog.ibvl.in\/\",\"name\":\"Imperative Business Ventures Limited\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/blog.ibvl.in\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02\",\"name\":\"admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/blog.ibvl.in\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/4d20b2cd313e4417a599678e950e6fb7d4dfa178a72f2b769335a08aaa615aa9?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/4d20b2cd313e4417a599678e950e6fb7d4dfa178a72f2b769335a08aaa615aa9?s=96&d=mm&r=g\",\"caption\":\"admin\"},\"sameAs\":[\"https:\/\/blog.ibvl.in\"],\"url\":\"https:\/\/blog.ibvl.in\/index.php\/author\/admin_hcbs9yw6\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"FBI Seizes NetNut Proxy Platform, Popa Botnet - Imperative Business Ventures Limited","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/blog.ibvl.in\/index.php\/2026\/07\/02\/fbi-seizes-netnut-proxy-platform-popa-botnet\/","og_locale":"en_US","og_type":"article","og_title":"FBI Seizes NetNut Proxy Platform, Popa Botnet - Imperative Business Ventures Limited","og_description":"The Federal Bureau of Investigation (FBI) said today it worked with industry partners to seize hundreds of domains associated with NetNut, a sprawling residential proxy service operated by the publicly-traded Israeli company Alarum Technologies [NASDAQ: ALAR]. The action comes roughly two weeks after KrebsOnSecurity published findings from multiple security firms connecting NetNut to the Popa [&hellip;]","og_url":"https:\/\/blog.ibvl.in\/index.php\/2026\/07\/02\/fbi-seizes-netnut-proxy-platform-popa-botnet\/","og_site_name":"Imperative Business Ventures Limited","article_published_time":"2026-07-02T20:04:39+00:00","author":"admin","twitter_card":"summary_large_image","twitter_misc":{"Written by":"admin","Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/07\/02\/fbi-seizes-netnut-proxy-platform-popa-botnet\/#article","isPartOf":{"@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/07\/02\/fbi-seizes-netnut-proxy-platform-popa-botnet\/"},"author":{"name":"admin","@id":"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02"},"headline":"FBI Seizes NetNut Proxy Platform, Popa Botnet","datePublished":"2026-07-02T20:04:39+00:00","mainEntityOfPage":{"@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/07\/02\/fbi-seizes-netnut-proxy-platform-popa-botnet\/"},"wordCount":1175,"image":{"@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/07\/02\/fbi-seizes-netnut-proxy-platform-popa-botnet\/#primaryimage"},"thumbnailUrl":"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2026\/07\/netnutseizure.png","keywords":["Cybersecurity"],"articleSection":["A Little Sunshine","Alarum Technologies Ltd","Benjamin Brundage","Cybersecurity","FBI","Google","Google Threat Intelligence Group","Internal Revenue Service Criminal Investigation","IPidea","LG","Lumen","Ne'er-Do-Well News","NetNut","Popa botnet","Samsung","Shadowserver","Synthient","Web Fraud 2.0"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/07\/02\/fbi-seizes-netnut-proxy-platform-popa-botnet\/","url":"https:\/\/blog.ibvl.in\/index.php\/2026\/07\/02\/fbi-seizes-netnut-proxy-platform-popa-botnet\/","name":"FBI Seizes NetNut Proxy Platform, Popa Botnet - Imperative Business Ventures Limited","isPartOf":{"@id":"https:\/\/blog.ibvl.in\/#website"},"primaryImageOfPage":{"@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/07\/02\/fbi-seizes-netnut-proxy-platform-popa-botnet\/#primaryimage"},"image":{"@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/07\/02\/fbi-seizes-netnut-proxy-platform-popa-botnet\/#primaryimage"},"thumbnailUrl":"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2026\/07\/netnutseizure.png","datePublished":"2026-07-02T20:04:39+00:00","author":{"@id":"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02"},"breadcrumb":{"@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/07\/02\/fbi-seizes-netnut-proxy-platform-popa-botnet\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/blog.ibvl.in\/index.php\/2026\/07\/02\/fbi-seizes-netnut-proxy-platform-popa-botnet\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/07\/02\/fbi-seizes-netnut-proxy-platform-popa-botnet\/#primaryimage","url":"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2026\/07\/netnutseizure.png","contentUrl":"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2026\/07\/netnutseizure.png"},{"@type":"BreadcrumbList","@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/07\/02\/fbi-seizes-netnut-proxy-platform-popa-botnet\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/blog.ibvl.in\/"},{"@type":"ListItem","position":2,"name":"FBI Seizes NetNut Proxy Platform, Popa Botnet"}]},{"@type":"WebSite","@id":"https:\/\/blog.ibvl.in\/#website","url":"https:\/\/blog.ibvl.in\/","name":"Imperative Business Ventures Limited","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/blog.ibvl.in\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02","name":"admin","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/blog.ibvl.in\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/4d20b2cd313e4417a599678e950e6fb7d4dfa178a72f2b769335a08aaa615aa9?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/4d20b2cd313e4417a599678e950e6fb7d4dfa178a72f2b769335a08aaa615aa9?s=96&d=mm&r=g","caption":"admin"},"sameAs":["https:\/\/blog.ibvl.in"],"url":"https:\/\/blog.ibvl.in\/index.php\/author\/admin_hcbs9yw6\/"}]}},"_links":{"self":[{"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/posts\/3993","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/comments?post=3993"}],"version-history":[{"count":0,"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/posts\/3993\/revisions"}],"wp:attachment":[{"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/media?parent=3993"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/categories?post=3993"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/tags?post=3993"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}