Where do residential proxy IP addresses come from?

Residential proxy IPs come from real home internet connections. Sometimes that happens through consented bandwidth sharing, but researchers have also found apps, such as smart TV screensavers and games, quietly routing other people's traffic through a home connection without the owner realizing it.

What happened to NetNut?

On July 2, 2026, Google's Threat Intelligence Group, working with the FBI, Lumen and other partners, announced it had disrupted NetNut, also tracked as Popa. The FBI seized several domains and Google disabled accounts and infrastructure used to control the network's software.

Google described it as a proxy network built on at least two million home devices that threat groups used to hide their traffic. Alarum Technologies, NetNut's parent company, disputes the botnet label, calling the research inaccurate and saying its software supports consented bandwidth sharing.

Not entirely. The action seized some domains and degraded the network, but at least one NetNut marketing site remained online. Google called it degradation rather than a kill and warned such networks often rebuild by buying capacity from competitors.

Can my smart TV be used as a residential proxy?

Yes, it can happen. In June 2026, researchers analyzing thousands of smart TV apps found that many ordinary-looking clock, screensaver, fish-tank and solitaire apps were routing strangers' internet traffic through the TV owner's home connection.

Where Do Residential Proxies Come From? (2026)

After the FBI seized NetNut, here's how residential proxy networks really get their IPs, and how to tell an ethical provider from a botnet.

There's a good chance a device in someone's living room is being used as a proxy right now, and they have no idea.

In June 2026, security researchers pulled apart thousands of smart TV apps and found that many of them, ordinary-looking clocks, screensavers, fish-tank displays, and solitaire games, were quietly routing strangers' internet traffic through the TV owner's home connection. Weeks later, the FBI and Google disrupted one of the largest residential proxy networks in the world, built on roughly two million such devices.

If you buy or use residential proxies, or you're just wondering why your smart TV is suddenly in the news, the story underneath all this is worth understanding: where do these "residential" IP addresses actually come from? The answer is the difference between a legitimate tool and a botnet, and after the last few weeks, it's the question the whole industry is being forced to answer.

What just happened with NetNut

On July 2, 2026, Google's Threat Intelligence Group, working with the FBI, Lumen, and other partners, announced it had disrupted a residential proxy network known as NetNut (also tracked under the name Popa). The FBI seized a number of NetNut's domains, and Google disabled the accounts and infrastructure the network used to control its software.

The scale was the headline. Google estimated the network spanned at least two million home devices worldwide, many of them smart TVs and streaming boxes. In a single week in June, researchers observed hundreds of distinct threat groups, including cybercriminals and espionage actors, using the network to hide where their traffic really came from.

NetNut is unusual because it traces back to a publicly traded company, Alarum Technologies. It's worth being clear and fair here: Alarum has publicly disputed the characterization of its network as a botnet, calling the research inaccurate and stating that its software supports consented bandwidth sharing. The company said it would cooperate with law enforcement. Those denials are part of the story, and the situation is still developing.

Is NetNut actually gone?

Not entirely, and this is where it gets messy. The takedown seized some domains and degraded the network, but it wasn't a clean shutoff. As of this writing, one of NetNut's marketing sites was still online even though other domains had been seized, because domain seizures happen piece by piece across different registrars and jurisdictions. Google itself described the action as "degradation," not a kill, and warned that these networks often rebuild by buying capacity from competitors. In other words: disrupted, not deleted.