Historical intelligence backfill. This assessment covers reporting originally published on 2026-07-02 and was added to the RWP archive on 2026-09-07.
Google and the FBI cut NetNut/Popa — residential proxies are the crime WAN
2 July 2026 — after January's IPIDEA takedown, GTIG, FBI, and Lumen hit NetNut (Popa). Google disabled accounts used for malware C2. GTIG: millions of devices off the pool, including white-label resellers.
Bottom line up front
CONFIRMED 2 July 2026 GTIG — coordinated action with FBI, Lumen, and others against the NetNut residential proxy network (also called Popa). Follow-on to the 28 January 2026 IPIDEA disruption. Google disabled Google accounts/services used by NetNut for malware C2 (ToS). Intel on SDKs and backend C2 went to platforms, LE, and researchers. GTIG: significant degradation, millions of devices removed from the available pool; NetNut also white-labels via resellers, so downstream brands should feel it.
This is not a victim breach. It is infrastructure. Infostealers, credential stuffing, and “residential” C2 all rent these pools so the traffic looks like a household.
What happened
January: legal takedown of IPIDEA control domains plus SDK intel. July: account disablement plus intel share on NetNut. Same objective: shrink the rented-home-IP market.
Why it matters
Your MFA-fatigue and “impossible travel” detections assume one human, one ISP. A proxy SDK in a mobile app makes every login look local.
What is confirmed vs not
CONFIRMED GTIG actions and the millions-of-devices claim as GTIG's assessment.
UNKNOWN residual NetNut capacity after reseller shuffle.
What defenders should do
- Treat residential-proxy ASN/reputation as hostile for admin logins.
- Mobile/SDK inventory — consumer apps shipping proxy kits.
- Do not celebrate a takedown as the end of stuffing.
RWP assessment
Confidence: High that Google/FBI acted. Medium on lasting dent — these networks rebrand.
Historical intelligence backfill. This assessment covers reporting originally published on 2026-07-02 and was added to the RWP archive on 2026-09-07.