On this page
On July 2, the FBI, the IRS, and Google seized NetNut, one of the largest residential proxy networks in the world, along with its sister brand ProxyJet. We watched it happen from inside the networks. Within days, fresh observations of NetNut's network fell by more than 99%, and our Residential Proxy IP pool peaked on July 3 before giving ground every day since.
Database at a glance
| Metric | Jun 25 | Jul 7 | Δ |
|---|---|---|---|
| Residential proxy IPs (90d) | 141,880,855 | 142,467,330 | +586,475 (+0.4%) |
| Mobile proxy IPs (90d) | 2,957,614 | 3,262,853 | +305,239 (+10.3%) |
| Datacenter proxy IPs (90d) | 1,204,990 | 1,203,107 | -1,883 (flat) |
| Active providers contributing IPs (90d) | 110 | 117 | +7 |
| Commercial proxy providers cataloged | 386 | 410 | +24 |
The 117 active providers break down as 115 residential, 3 mobile, and 7 datacenter, with some contributing across categories.
The NetNut takedown, in our data
On July 2, a coordinated FBI, IRS, and Google operation seized netnut.com, its sister brand proxyjet.io, and divinetworks.com, the supplier that fed the network static residential ranges through direct ISP contracts. NetNut, operated by the Nasdaq-listed Alarum Technologies and tracked by researchers as the "Popa" botnet, had co-opted more than two million consumer devices worldwide. Google reported that at least 316 distinct threat clusters routed through NetNut exit nodes in a single week of June alone, running credential stuffing, password spraying, ad fraud, and scraping. Background: Google Threat Intelligence and Krebs on Security.
Here is what it looked like from our side. Through July 1 the residential pool was growing at its usual steady clip. It then peaked at 143.7 million on July 3, right at the seizure, and has fallen every day since to 142.5 million on July 7, roughly 1.2 million back off the peak. The provider-level signal is sharper: fresh daily observations of NetNut nodes dropped more than 99% within days of the takedown, and ProxyJet's went to zero. Both networks have effectively gone dark in our capture.
Residential exit nodes are heavily resold across networks, the same multi-provider overlap we report every issue, so a large share of the addresses NetNut served remain visible through other providers and stay in the window. The rest age out over the coming weeks, so expect residential to keep giving back some ground as that plays out. If you score residential-proxy risk, the practical read is that a meaningful slice of what NetNut supplied is now going offline or migrating to other networks, and our rolling windows make that shift visible as it happens rather than months later.
Inside the residential pool
The v4/v6 split we have tracked since Issue #1 held again, even through the NetNut decay: as of July 7, 47.9% of residential IPs were seen exactly once (28.1% of IPv4, 65.2% of IPv6) and 39.1% appeared under more than one provider (61.6% of IPv4, 19.6% of IPv6), all within half a point of last issue. That 39% overlap is precisely the cushion absorbing the takedown above. Median IPv4 lifetime eased to 4.5 days while the durable tail held (75th percentile still near 39 days), and IPv6 stayed a flat one day.
What changed behind the scenes
- More residential providers online. Several new residential feeds went active this window, part of the steady activation cadence; that breadth is exactly what keeps a single network's removal from gutting our global proxy coverage.
- Mobile and datacenter both gained a feed. A newly activated provider extended us to a third active mobile feed and a seventh datacenter feed, with the mobile pool up 10.3% on the addition.
