For roughly four years, a botnet called Popa has been quietly conscripting millions of cheap Android TV boxes sitting in living rooms around the world and forcing them to relay other people’s internet traffic. Advertising fraud, account takeovers, mass scraping. This week researchers from several firms tied that infrastructure to NetNut, a “residential proxy” service run by Alarum Technologies, a company that trades on the NASDAQ. If you run any kind of public-facing login or API, this is the cybersecurity problem you’ve probably been pretending doesn’t exist: the attack traffic hitting you increasingly comes from real homes, on real consumer IPs, that look exactly like your actual customers.

That’s the whole point of a residential proxy. It takes a request that would normally come from a flagged data center or a known-bad IP and launders it through a compromised smart TV in suburban Ohio. Your firewall sees a residential cable subscriber. Your fraud team sees a plausible user. The malware on that TV box sees a payday for whoever rented the proxy.

A Residential Proxy Botnet, Built On Compromised TV Boxes

Popa works because the hardware is disposable and nobody patches it. These off-brand Android boxes ship with outdated firmware, sideloaded apps, and zero update path. Once compromised, each box becomes an exit node. The operator pools millions of them and sells access by the gigabyte to anyone who wants traffic that blends in.

The buyers aren’t all running ad fraud. Credential-stuffing crews love residential proxies because they spread a brute-force campaign across thousands of clean IPs, so no single address trips a rate limit. Scrapers use them to bypass bot defenses. Account-takeover operators use them to make a fraudulent login look like it came from the victim’s own city. The infrastructure is neutral. The abuse is not.

What makes the NetNut link uncomfortable is the corporate wrapper. This isn’t a teenager in a basement. It’s a publicly traded firm whose proxy network appears to be partly fed by malware-infected consumer devices that never consented to anything. That’s a governance failure dressed up as a SaaS product, and it tells you the residential proxy market has graduated from gray to industrial scale.

Why This Is A Cybersecurity Blind Spot, Not A Firewall Problem

Here’s the part that breaks most defensive playbooks. Nearly everything you do to keep bad traffic out leans on the idea that bad traffic comes from identifiably bad places. IP reputation feeds, geo-blocking, data-center ASN filters, threat-protection rules tuned to known-hostile ranges. Residential proxies vaporize all of it. The traffic originates from Comcast, BT, Deutsche Telekom, the same carriers your paying users sit behind.

So a brute-force attack stops looking like a brute-force attack. Instead of ten thousand attempts from one server, you get one or two attempts each from ten thousand homes. Per-IP rate limiting never fires. Your block list stays empty. And your threat detection, if it’s keyed on volume-per-source, reports a quiet day while someone walks your authentication endpoint at a leisurely pace.

This is exactly why defense in depth stopped being a slogan and became survival. You cannot win at the network edge alone when the edge has been colonized by the enemy. The signal you need lives higher up, in the behavior of the session, the velocity of the identity, and the shape of the request, not in the source address.

Detection And Response When Traffic Looks Legitimate

You can’t block your way out of a residential proxy problem with an IP list. You can make yourself a brutally expensive target. Shift your controls from “where did this come from” to “what is this actor doing across my whole surface.” Concrete steps you can start this week:

• Rate-limit on identity, not just IP. Count failed logins per username and per credential, so a low-and-slow brute-force spread across thousands of homes still trips a threshold tied to the account being attacked.
• Add impossible-travel and device-binding checks. A residential proxy can fake the city, but it struggles to fake a consistent device fingerprint plus a plausible movement pattern over time.
• Enforce phishing-resistant MFA everywhere it matters. Clean source IPs don’t help an attacker who still needs a hardware-bound second factor.
• Cap session lifetimes and bind tokens. If a stolen credential does get through a proxy, a short-lived, bound session limits how far it travels.
• Watch for distributed low-volume auth failures. Tune threat detection to flag many IPs each making one or two attempts against the same account, which is the residential-proxy signature.
• Keep aggressive per-IP brute-force controls anyway. Tools in the ipban and IPBan Pro mold still catch the noisier, non-proxied attackers, and they shrink the surface so your behavioral alerts aren’t drowning in commodity noise.

For incident response, write the residential-proxy scenario into your playbook before you need it. The first question during an account-takeover wave should not be “which IP do we block.” It should be “which identities are under pressure, and what can we step up or lock without nuking legitimate users.” Rehearse the case where the source addresses are useless and your only leverage is on the account side. Security hardening of your auth stack pays for itself the first time a clean-IP campaign hits.

The Accountability Gap Behind Proxy Providers

There is a sliver of good news on the enforcement side, and it’s worth holding next to the Popa story. This same week, the Operation Endgame coalition knocked 106 SocGholish servers offline and cleaned nearly 15,000 compromised websites. Coordinated takedowns work, and they hurt.

They also don’t reach far enough. Takedowns hit the malware delivery layer. They rarely touch the residential proxy layer, partly because some of that infrastructure hides behind real companies with lawyers and ticker symbols. When the exit nodes are compromised consumer devices and the broker is a NASDAQ-listed firm, “just take it down” turns into a years-long legal question instead of a 3 a.m. seizure warrant. That gap is where your risk lives, and it’s why your cyber security strategy can’t assume someone upstream will solve this for you.

Sources

• ‘Popa’ Botnet Linked to Publicly-Traded Israeli Firm
• Law enforcement hits SocGholish: 106 servers down, 15,000 sites cleaned