When Google's Threat Intelligence Group announced the disruption of NetNut, a residential proxy network operating across millions of compromised home devices, it highlighted a problem that extends far beyond a single bad actor. The takedown, conducted with the FBI, Lumen, and other partners, points to structural issues in how residential networks are abused and the operational burden this places on infrastructure providers worldwide.
How Residential Proxy Networks Actually Work
A residential proxy network operates by installing software on consumer devices—routers, computers, mobile phones—that turns each device into a relay point for third-party traffic. Unlike datacenter proxies, which operate from commercial IP ranges that are well-understood and relatively easy to block, residential proxies blend in with ordinary home internet users. This obfuscation is precisely why they are valuable to actors seeking to evade detection, scrape content at scale, launch credential-stuffing attacks, or commit fraud.
NetNut (also tracked under the name Popa) built one of the larger networks of this kind, according to the analysis published by threat intelligence researchers. The network spanned millions of devices, each potentially serving as an exit point for traffic that could obscure the true origin of requests. From the perspective of a target system—an e-commerce platform, a content site, a financial service—these requests appear to come from legitimate home networks, making detection and blocking significantly harder than blocking a datacenter IP address range.
The Operational Cost to Infrastructure Providers
For hosting providers, CDNs, and web infrastructure operators, residential proxy networks introduce a particular challenge. Traditional abuse mitigation relies on reputation databases, IP blocklisting, and geographic verification. When traffic originates from millions of real residential IP addresses, these techniques become far less effective. Support teams must spend time distinguishing between legitimate users whose devices have been compromised and malicious actors deliberately routing traffic through proxy networks.
ISPs also bear significant operational burden. Residential proxy networks generate unusual traffic patterns from home connections—sustained high-bandwidth usage, connections to multiple external services, traffic flows that deviate from normal residential behaviour. Detecting and mitigating these patterns requires deep packet inspection, customer notifications, and enforcement actions against subscribers whose devices are unknowingly participating in the network.
Why Takedowns Are Partial and Temporary
Google's disruption of NetNut, whilst significant, illustrates the limits of enforcement against distributed networks. By reducing the pool of available devices, authorities made the network less reliable and more expensive to operate. However, the underlying vulnerability—devices running software from which users cannot easily remove it, or devices whose owners don't realise they are compromised—remains.
The botnet model itself persists. New residential proxy networks emerge regularly, often operating under different names or rebranding existing infrastructure. Defending against them requires not just disrupting individual networks but addressing the initial compromise vector: how does software end up installed on millions of devices in the first place. Often it involves supply chain infections, malvertising, bundled software installers, or router firmware vulnerabilities.
Implications for Hosting and Security Teams
Infrastructure teams should treat residential proxy networks as a form of distributed denial of service risk, though not in the traditional volumetric sense. Instead, they present challenges for authentication, content protection, and abuse detection. Adding residential IP ranges to blacklists is crude and risks blocking legitimate users. More effective approaches include behavioural analysis, rate limiting based on request patterns rather than IP reputation alone, and challenges (CAPTCHA, device verification) triggered by suspicious activity profiles rather than source IP.
For those operating services that must prevent scraping or account takeovers, understanding which traffic sources are likely to be residential proxies versus legitimate home users remains an arms race. Threat intelligence feeds that track known proxy networks are useful but lag behind network changes. Working with ISPs to report compromised devices, whilst improving, remains slow and fragmented across jurisdictions.
The NetNut disruption demonstrates that large-scale infrastructure abuse can be addressed through coordinated effort, but it is not a permanent solution. The incentive structure—proxies are valuable for fraud, scraping, and evading detection—means resources will continue to flow toward building and maintaining these networks. Defence, therefore, is best thought of as ongoing operational hygiene rather than a one-time fix.
