What happened to NetNut in July 2026
On 2 July 2026 the FBI and IRS Criminal Investigation, working with Google, Lumen and Shadowserver, seized hundreds of domains associated with NetNut, the residential proxy service run by NetNut Ltd., a subsidiary of the NASDAQ-listed Israeli company Alarum Technologies. Investigators and outside researchers linked the network's exit nodes to a botnet running on compromised consumer devices, largely smart TVs and streaming boxes. Google's threat intelligence team disabled accounts and services it said the operation used for command and control.
Alarum confirmed the seizures in regulatory filings, said it would cooperate fully with law enforcement so that any misuse of its infrastructure was investigated, and temporarily paused traffic through the affected services as a precautionary measure while it investigated. It warned that a prolonged outage could materially affect its results and its ability to serve some customers. We are not aware of charges having been brought against the company, and it has not admitted wrongdoing. This is a record of what was publicly reported in July 2026; check Alarum's own investor announcements for the current position rather than relying on this page.
The practical consequence for a buyer is continuity risk rather than a verdict on anyone's conduct. If your pipeline depended on a single upstream, the episode is a reminder that where a residential pool comes from is a supply-chain question, and one you should be able to get answered in writing by whoever you use next.
What NetNut did well
NetNut's flagship was not its rotating residential pool but its static residential, or ISP, proxies. Rather than assembling those addresses from consumer devices, NetNut obtained them through ISP partnerships via DiviNetworks, which is why they behaved like residential addresses while performing closer to datacenter infrastructure: low latency, long-lived, stable enough to hold an account session for days. Reviewers consistently measured it as one of the faster ISP networks available, and that reputation was earned.
The surrounding product was broad, too. Alongside rotating residential and static ISP, NetNut sold datacenter ranges, a mobile pool, scraper APIs for general unblocking, SERP and B2B data, and ready-made datasets. For resellers and larger teams it offered sub-user management, a proxy management API, dedicated pools and named account managers. That is an enterprise product surface, and it is fair to say Nefo does not match it. Nefo sells residential bandwidth, static residential ISP IPs, 4G/5G mobile ports on real carrier modems, datacenter proxies, static IP proxies, servers and marketplace APIs; there is still no dataset product.
If any of those adjacent products is load-bearing in your stack, price is the wrong axis to compare on. Replacing a scraper API with rotating residential bandwidth is a rewrite, not a swap, and a large static ISP fleet should be tested on a small order first.
NetNut subscriptions vs Nefo prepaid balance
The sharpest structural difference is commercial. Every NetNut product was sold as a subscription with a monthly traffic allowance. There was no pay-as-you-go option, unused traffic did not roll over into the next month, and top-ups were not available: if you exhausted an allowance mid-month you refreshed the whole plan. Entry tiers carried real monthly minimums, and pricing was quote-led rather than published, so evaluating the service usually began with a sales conversation.
Nefo inverts that. You buy a prepaid bandwidth balance at published per-GB rates, starting at 5GB, and flexible plans are non-expiring: the balance sits in the account until traffic consumes it. Generating credentials costs nothing, so you can create as many as your architecture needs and only pay for what passes through them.
The difference matters most for workloads that are not flat. Seasonal price monitoring, an ad verification sweep before a campaign, a research project with a hard end date — under a monthly allowance you either over-buy for the peak and forfeit the remainder, or under-buy and refresh mid-run. Under a prepaid balance, spend tracks work actually done rather than a forecast.
- NetNut: monthly subscription, fixed allowance, no rollover, no top-up, quote-led pricing
- Nefo: prepaid balance, published per-GB rates, from 5GB, flexible plans non-expiring
- Credential generation is free on Nefo; only traffic through a credential draws down bandwidth
- Unused Nefo balance carries across months rather than resetting
NetNut vs Nefo: targeting, sessions and protocols
Both networks speak the same protocols: HTTP, HTTPS and SOCKS5, with username and password authentication (Nefo also supports an IP allowlist), so the transport layer of your code does not change.
Targeting is where the behaviour diverges. Nefo covers 227 countries, targets state or region and city in most countries, and lets you pin a specific ASN or ISP paired with a country. That pairing is worth noting: reviewers documented that NetNut's residential product exposed country, state, city and ASN filters but would not accept a country and an ASN in the same selection, which made carrier-specific work in a named market awkward.
Session control differs in kind rather than degree. On Nefo you choose rotation explicitly — a new IP per request, or a sticky session held for anything from one minute to roughly 24 hours, configured per credential. NetNut did not expose a custom session duration; sticky sessions persisted until the underlying IP went offline, which is fine for long-lived ISP addresses and less predictable elsewhere. If your checkout or login flow assumes a known session lifetime, an explicit duration is easier to reason about. Mobile is a separate model again: Nefo rents 4G/5G ports on real carrier modems by duration, from hours to 30 days, with one live rotating IP per port and US state and carrier targeting, rather than metering a shared mobile pool by the gigabyte.
- HTTP, HTTPS and SOCKS5, username/password or IP allowlist authenticated
- 227 countries; state or region and city targeting in most of them
- ASN or ISP targeting paired with a country in a single credential
- Rotating per request, or sticky held from 1 minute up to about 24 hours
- 4G/5G mobile ports on real carrier modems, rented per duration, priced separately from bandwidth
- Usage visible in the dashboard and exportable as CSV
How to migrate from NetNut to Nefo
Most of the work is inventory, not integration. Proxy credentials tend to be scattered across scrapers, cron jobs, browser profiles, headless workers and half-forgotten scripts, and the endpoint format differs between providers even though the protocol does not. Find every place a NetNut host and port is hard-coded before you start, because the ones you miss will fail silently at three in the morning.
After that, the two changes that actually bite are geo-targeting syntax and session logic. Targeting parameters are provider-specific and do not transfer, so any place your code builds a username string with location fields needs rewriting. Session handling is worth revisiting rather than porting: code written against sessions that lasted until an IP dropped often has retry logic compensating for an unpredictable lifetime, and that logic can usually be simplified once you set the duration yourself.
Treat verification as a paid smoke test rather than a trial. A 5GB balance is enough to run your hardest target — the one that decides whether a provider works for you — against real credentials before any larger commitment, and whatever you do not spend stays in the account.
- List every hard-coded proxy host, port and credential across code, cron and browser profiles
- Rewrite geo-targeting parameters; the syntax does not carry across providers
- Set explicit sticky durations rather than porting retry logic built around unpredictable sessions
- Rotate the account passwords of anything you drove through the old provider — routine hygiene when changing infrastructure
- Identify products with no Nefo equivalent (scraper APIs, datasets) and source those separately; trial static ISP on a small Nefo order
- Buy 5GB, run your hardest target, then scale
Who should wait for NetNut and who should move to Nefo
Wait for NetNut's own updates, or move to another enterprise vendor, if what you bought was the enterprise surface rather than the bandwidth: scraper or SERP APIs, packaged datasets, reseller sub-accounts and a management API, or a signed agreement with an SLA and a named account manager. Nefo does not offer all of those, and a narrower provider is a downgrade if that is the requirement, whatever the per-GB rate says.
Nefo fits a different shape of buyer: teams whose requirement is rotating and sticky residential bandwidth, optionally alongside mobile ports, who want to start small and scale on evidence. It suits bursty or seasonal usage, projects with a defined end, agencies billing bandwidth to specific clients, and anyone who would rather hold a balance that does not expire than commit to a monthly allowance they may not use. It also suits anyone who wants to evaluate a provider without a sales call.
We are still a smaller vendor than NetNut was, and it is more useful to be plain about that than to claim otherwise. If your job is residential, mobile, datacenter or static IP proxies, the catalogue, which now includes static residential ISP IPs, is broader than it used to be and the entry model is still straightforward. If your architecture depends on a managed scraping API or datasets, buy from someone who sells those.
Frequently asked questions
As of early August 2026 the position was unresolved in public. The FBI seized hundreds of NetNut-associated domains on 2 July 2026, and Alarum Technologies said it temporarily paused traffic through the affected services. We know of no verifiable restoration timeline or charges. Rely on Alarum's own announcements for current status.
No. No provider can transfer another provider's balance, and questions about unused NetNut allowance are between you and Alarum. What Nefo changes is forward risk: flexible plans are prepaid and non-expiring, so a balance stays until traffic consumes it. See pricing.
Yes. Nefo sells static residential ISP IPs: dedicated to you, in 24 countries, rented for 7 to 360 days from $1.76 for 7 days and $3.51 for 30 days, over HTTP(S) and SOCKS5 (see ISP proxies). Each IP has a 100 GB per 30 days fair-use limit. Static IP proxies and IP Vault are further fixed-address options. Check your country and speed needs on a small order.
The protocol layer stays: HTTP, HTTPS and SOCKS5 with username and password (or an IP allowlist on Nefo). The endpoint and the way targeting and session parameters are expressed change, so update wherever your code assembles a proxy string and revisit retry logic written around sessions whose length you could not set.
Ask in writing who operates the upstream supply, whether participants consent knowingly and can opt out, what they receive, and what abuse controls exist. Nefo use is bound by an acceptable use policy that prohibits credential stuffing, fraud, phishing and network attacks. Contact Nefo about supply arrangements.
Buy 5 GB and point your hardest target at it, not a generic IP echo service. Credentials are free, so you can create separate ones per country, ASN and session type and compare them within those 5 GB. Whatever you do not spend stays in the account.