The FBI seized NetNut, and the internet has not caught up

On 2 July 2026 the FBI seized NetNut. We fetched netnut.io on 8 August and the seizure notice was still there, byte-identical on every path we tried — the pricing page, the terms, the product pages. Seals from the FBI, the Department of Justice and IRS Criminal Investigation.

The notice is worth reading closely, because of who it names:

This domain has been seized by the Federal Bureau of Investigation in accordance with federal law as part of a law enforcement action, taken in coordination with the Department of Justice and the Internal Revenue Service Criminal Investigation, against the NetNut residential proxy platform, its administrators, and its subscribers.

Not just the operators. The customers.

What the network actually was

NetNut was operated by Alarum Technologies, a publicly traded company. Reporting on the takedown ties the platform to a botnet of roughly two million consumer devices — mostly smart TVs and streaming boxes — enrolled with little or no meaningful consent. Investigators observed hundreds of distinct threat-actor clusters using its exit nodes in a single week.

That is the uncomfortable centre of this market. When a provider sells "residential" addresses, those addresses belong to somebody's home connection, and the question of how they agreed to that ranges from "an app that pays them" to "a checkbox in the terms of a free game" to, here, an answer a federal investigation found worth acting on.

The part that should change how you buy

NetNut's network was widely resold and white-labelled. A storefront with its own brand, its own pricing page and its own support desk may have been selling you the same exit nodes.

This is why we do not treat sourcing as a property of the vendor you are looking at. Every provider we track carries a "where the addresses come from" line, and where a provider does not publish it, the page says exactly that. They do not say is a finding. Seven of the providers we track are in that state today.

And the internet has not caught up

On 8 August — five weeks after the seizure — we asked Google the two most common alternatives queries in this category. Its AI Overview recommended NetNut in its own generated prose:

NetNut: Great for high-volume operations requiring fast single-hop connectivity and sticky sessions via direct ISP connections.

On the same day, on two different queries, the same AI Overview correctly cited the FBI's own advisory about residential proxy networks.

It holds both facts. It connects neither.

We are not pointing at that to score a point about AI. It is the clearest illustration we have of why a price or a recommendation without a date attached is worth very little in this market. A summary restates what it learned. It cannot tell you what changed five weeks ago, and this market changes constantly — providers reprice, restrict targets, get acquired, and occasionally get seized.

Every number on this site renders with the date we read it. That is not a flourish. It is the whole difference between our answer and the one currently at the top of the page.