NetNut takedown: 28% of IPs still reachable via Bright Data
Sign inGet started
TripwirePricingBlogDocsContactSign in
Measuring the NetNut takedown: 28% of its IPs are still reachable through Bright Data<br>On July 2, the FBI and Google seized a residential proxy network with 33 million monthly exit nodes. We watched it drain in real time. Then we checked where those IPs went, and found that the industry's biggest "ethically sourced" provider can still reach 28% of them.
Layer3 Intel Research·July 18, 2026
27.85%of NetNut's IPs remained reachable through Bright Data alone<br>78.8%of NetNut's freshest IPs reappeared on other proxy networks within 14 days<br>~1.06MIPs actually removed from the ecosystem beyond normal churn
On July 2, 2026, the FBI, working with Google, Lumen, and Shadowserver, seized hundreds of domains behind NetNut, one of the largest residential proxy providers in the world. The seizure followed KrebsOnSecurity's reporting linking the network to the Popa botnet: at least two million compromised devices, including smart TVs and streaming boxes enrolled as proxy exit nodes without their owners' consent.<br>For us, NetNut was never just a headline. Layer3 Intel's enumeration pipeline was routing roughly 2 million requests per hour through the network and watching ~1.2 million unique exit IPs come out of it every hour. Over the last four months we attributed 63.7 million distinct IPv4 addresses to NetNut, 32.96 million of them observed in the 30 days before the network went fully dark on July 4.<br>Takedowns of this size are rare, and they create a natural experiment: when a major proxy network disappears, does its underlying inventory of residential devices disappear with it, or does the same inventory stay reachable through everyone else? Layer3 Intel observes exit nodes across every major residential proxy network (over 500 million unique signals a day), so we could measure the answer directly.<br>Watching a proxy network go dark<br>The collapse was staged, not a kill switch. NetNut looked completely healthy through 15:00 UTC on July 2, posting 1.27 million unique IPs that hour, about 2% below its peak for the entire period. Then, within hours of the seizure announcement, the network began to drain: below 50% of baseline by 08:00 UTC on July 3, below 10% by midnight, below 1% by 09:00 UTC on July 4. The biggest single-hour loss came mid-afternoon on July 3, when the network shed 229,000 IPs between 14:00 and 15:00 UTC. But the most telling step came at the very end: between 05:00 and 06:00 UTC on July 4, hourly counts fell from 78,479 to 19,345. A 75% cut in one hour, at the bottom of a three-day drain, looks like a central service or a major supplier finally being switched off.<br>The drawn-out profile, roughly 60 hours from first decline to darkness, suggests staged supplier disconnection, credential revocation, and session draining rather than one global off switch. It also looks nothing like an ordinary outage. NetNut had bad days in June, the worst of them cut capacity roughly in half overnight, a dip we observed around the same time as Spur's investigation into how NetNut co-opts entire partner networks for exit capacity. Every one of those June dips was back at baseline within hours. This time nothing came back. By July 5 hourly unique-IP volume fell 99.92%.<br>NetNut exit nodes observed per hour<br>Unique residential IPv4 addresses, June 1 – July 5, 2026 (UTC)
A steady ~1.2M unique IPs per hour begins draining within hours of the FBI seizure announcement on July 2 and falls 99.9% over roughly 60 hours, with a final 75% single-hour cut early on July 4. Source: Layer3 Intel residential proxy database.Did 33 million IPs actually disappear?<br>To find out, we took every IP observed on NetNut in the 30 days before July 4, the point at which the shutdown was essentially complete, and checked whether it reappeared on any other proxy network in the 14 days after. The headline number: 16.90 million of those IPs, 51.27%, were re-observed elsewhere.<br>That raw figure is misleading in both directions. Residential IPs churn constantly: devices go offline, DHCP leases rotate, carrier-grade NAT reshuffles address pools. An IP last seen on NetNut three weeks before the shutdown was already unlikely to resurface anywhere, takedown or not. So we bucketed the cohort by how recently each IP was last seen on NetNut, and ran the identical analysis against a June 4 placebo cutoff.<br>IP age at cutoffJune baselinePost-takedownChange1–2 days86.29%78.81%−7.48 pts3–6 days62.63%60.38%−2.25 pts7–13 days49.28%46.49%−2.79 pts14–30 days37.06%35.22%−1.84 pts<br>Two things jump out. First, the placebo curve looks almost identical to the takedown curve, which means most of the apparent "disappearance" in the raw 51.27% figure is just normal residential churn. Second, every post-takedown bucket underperformed its historical baseline, and the gap is largest exactly where it should be if the takedown had a real effect: among the freshest IPs....