NetNut seized by the FBI: what is known, and how to move your proxy traffic

NetNut was seized on 2 July 2026: the FBI took over domains associated with the NetNut residential proxy network, and on 30 October 2026 netnut.io still answers with a page titled "Seized by the Federal Bureau of Investigation". Below are the dated facts, each with its source, and how to move scraper traffic in one connection string.

This page reports what has been published by the authorities, by Google, by the company that owns NetNut and by the press, plus one check we ran ourselves. It is not a legal assessment and it does not repeat claims that none of these sources makes. If your jobs stopped in July and you only need them running again, the move takes three steps and is described further down.

What happened to NetNut, in dates

Every row below has a primary source or a news outlet behind it. NetNut is operated by NetNut Ltd., a subsidiary of Alarum Technologies, which is listed on Nasdaq and files its announcements with the US Securities and Exchange Commission.

Date	What was published	Source
2 July 2026	The FBI, with the IRS Criminal Investigation division, seized domains associated with NetNut; the NetNut homepage was replaced by a seizure notice.	Krebs on Security
2 July 2026	Google said it had disrupted the NetNut residential proxy network, which it estimates at at least 2 million devices, by disabling Google accounts and services used for command and control and by having Play Protect warn users and disable apps that carry NetNut SDKs.	Google Threat Intelligence Group; Reuters
2 July 2026	Alarum Technologies said it had been made aware of the seizure of certain NetNut domains and would fully cooperate with law enforcement.	Alarum, Form 6-K, exhibit 99.1
3 July 2026	Alarum said further NetNut domains had been seized, that part of its services was disrupted, and that neither it nor NetNut had been formally contacted by the FBI or any other authority at the time of the release.	Alarum, Form 6-K, exhibit 99.2
6 July 2026	Alarum paused traffic through the affected network services for several days as a precaution, saying availability would be significantly reduced in that period.	Alarum, Form 6-K, exhibit 99.3
13 July 2026	Alarum said it still did not know the exact root cause of the disruption, had appointed an external team of cybersecurity and forensic experts, and was evaluating how to restore service; the review had reached no final conclusion.	Alarum, Form 6-K of 13 July
30 October 2026	Our check: netnut.io and netnut.com both answer with a page titled "Seized by the Federal Bureau of Investigation", and the name servers of netnut.io are ns1.fbi.seized.gov and ns2.fbi.seized.gov.	QuanticData, HTTP request and DNS lookup from Italy

What is verified, and what is not

Verified from primary sources. The seizure: the notice on the domains and the name servers that point to the FBI's seizure servers, both still in place when we checked on 30 October 2026. Google's actions: they are described in Google's own post. The company's position: it is in its filings with the SEC, quoted above in the company's own terms.

Reported by Google and by researchers. Google's Threat Intelligence Group writes that it observed 316 distinct threat clusters using suspected NetNut exit nodes in a single week of June 2026, and that the network is widely resold and white-labeled by other proxy providers. Krebs on Security reported that three security firms had linked NetNut to a botnet of consumer devices, called Popa, in June 2026. Alarum said on 3 July that it was investigating whether its network or services had been used for malicious, fraudulent or unlawful purposes, and on 13 July that its review had not reached a final conclusion.

Not in any of these sources. None of them reports charges against a named person. What they describe is action against infrastructure: domains, accounts and apps. If that changes, the dates above will be the place to read it first.

What it means if your scrapers ran on NetNut

For a team that bought residential traffic from NetNut, three things follow from the facts above, and none of them needs speculation.

• Anything addressed under netnut.io reaches the seizure servers. The domain's name servers are the FBI's, so a dashboard, an API call or a proxy host written under that domain no longer answers as a proxy. Retrying will not change it.
• Ask about your balance in writing. The company's July filings describe disrupted and then paused services. We cannot tell you what happens to a prepaid plan; the company can.
• Check your provider even if it was not NetNut by name. Google writes that the network was widely resold and white-labeled. If your jobs stopped on 2 July under another brand, ask that provider where its residential exits come from and how the people behind them agreed to it.

The last point is the one buyers tend to skip. A residential proxy is an address on somebody's home connection; the price per gigabyte says nothing about whether that somebody knows. It is worth one email before you move a single job.

How to move the traffic to QuanticData

The move is a change of connection string, not of code. QuanticData residential proxies start from $0.80/GB on the 1 TB Basic bundle, with $5 for 5 GB to start, country, state, city and ISP targeting in 228 countries and territories, rotating or sticky sessions, and HTTP, HTTPS and SOCKS5. The steps:

1. Create a free account. It comes with a 100 MB residential trial for 5 days (SMS verification, no card) and $2 of free API usage every month.
2. Generate a username in the dashboard. The country goes into the username; state, city and ISP are optional. The dashboard shows the host and port of your plan.
3. Replace host, port, username and password in your client, then test 100 of your own URLs and count the pages you can use per dollar. That is the number to compare.

curl -x "http://USER-country-us:PASS@PROXY_HOST:PORT" https://api.ipify.org

import requests

proxy = "http://USER-country-us:PASS@PROXY_HOST:PORT"
r = requests.get("https://api.ipify.org", proxies={"http": proxy, "https": proxy}, timeout=30)
print(r.status_code, r.text)

The settings most scrapers used to pass map to the username like this:

Setting	Username here	Note
Country	USER-country-us	On every request, included in the price
State and city	USER-country-us-region-california-city-los_angeles	On both lines, Basic and Premium
Rotating	USER-country-us	A new home IP on every request
Sticky session	USER-country-us-sid-k3f9a1b2-ttl-30m	The same IP for up to 1,440 minutes
Protocol and login	HTTP, HTTPS or SOCKS5	Username and password, or an IP allowlist

Scrapy, Playwright, Puppeteer, Selenium and antidetect browsers take the same string; rotation and sticky sessions are explained in how to set up rotating proxies. Bandwidth is paid by card, PayPal or more than 300 cryptocurrencies, with no subscription and no KYC. Prices by volume are on the pricing page, and the NetNut alternative page lists what you can buy today in place of each NetNut product.

Questions to ask before you move any traffic

A seizure is the moment to ask the questions that should have been asked at the start. Here they are, with our answers.

• Where do the residential exits come from? Ask for the sourcing in writing. Ours are real home IPs from ethically sourced pools, and the acceptable use policy says what the network allows and what it refuses.
• Can you test on your own targets before paying? Here, yes: the 100 MB trial and the $2 of monthly API usage need no card.
• Do you have to prepay months? Here, no: there is no subscription, and the $5 bundle of 5 GB is valid 30 days.
• Can you leave in one change? A standard connection string means the next move, to us or away from us, is the same three steps.