On July 3, 2026, the FBI, Google, Lumen’s Black Lotus Labs, and Shadowserver Foundation dismantled NetNut — a residential proxy network built on over 2 million secretly hijacked smart TVs, streaming boxes, and Android devices. In a single week during June, Google’s Threat Intelligence Group observed 316 distinct threat clusters routing attacks through NetNut exit nodes, including nation-state espionage groups using the network to mask origin IPs while conducting password spray attacks. This week, security researchers revealed that 42.5% of LG smart TV apps contained residential proxy SDKs that quietly routed strangers’ internet traffic through living rooms worldwide.
The NetNut takedown is the second major residential proxy disruption in 2026 alone — Google and FBI dismantled the IPIDEA network in January. Each operation exposes the same structural problem: residential proxy networks now operate at the scale of major internet transit providers, and the attacker traffic running through them is nearly impossible to distinguish from real user traffic.
The TV in Your Living Room Is Already Infrastructure
The LG finding is the most concrete illustration of how residential proxy networks recruit devices. Security researchers at Spur Intelligence scanned 6,038 apps across LG webOS and Samsung Tizen platforms and found that 42.5% of LG webOS apps had embedded proxy SDKs — code that, when running, uses the TV’s network link to carry third-party internet traffic. Most users consented to nothing meaningful. LG VP John Taylor announced in July 2026 that any developer failing to strip the proxy code will lose app access entirely.
NetNut used a similar method at scale. The service distributed its SDK to device makers under the pretense of bandwidth monetization, building a 2-million-device network that Alarum Technologies — an Israeli-listed firm — then rented to cybercriminal gangs and government-backed espionage operations. The network also powered downstream botnets including BADBOX 2.0 and Mirai variants. One domain was seized in the July takedown; another remained accessible days later, illustrating how difficult permanent disruption actually is.
Why Residential Proxy Networks Break IP-Based Defenses
The security implications for anyone running authentication or fraud detection are direct. Every standard IP-based defense fails against residential proxies. Rate limiting by IP address is irrelevant when attackers rotate through thousands of real home IPs, each appearing to make one request. Geo-blocking fails because attackers select exit nodes in the target country. IP reputation lists don’t flag residential addresses — the homes weren’t on any list before their devices were compromised.
GreyNoise tracked 4 billion malicious sessions over a 90-day period that were statistically indistinguishable from legitimate user traffic. Nokia’s 2026 threat report estimates 8–9 million residential proxy endpoints globally, across more than 20 distinct botnet families. The FBI’s 2026 PSA on residential proxies warns that these networks are used for “infrastructure supporting foreign covert influence campaigns” — not just credential stuffing.
Related: PolinRider: 108 Open Source Packages Poisoned — Act Now
What Works Instead of IP Blocking
The shift is from IP identity to session behavior. A residential proxy typically fails two or three behavioral signals simultaneously: TLS fingerprint inconsistency with the claimed browser, latency that doesn’t match the stated geolocation, and machine-speed request patterns with no session context. Scoring these signals together — rather than relying on any single indicator — gives a workable risk signal even when the IP looks clean.
Cloudflare’s approach combines proxy classification with browser fingerprint, account history, route context, and behavioral velocity before deciding on an action. Hard blocks based on proxy detection alone generate too many false positives — real users also shift IPs constantly, especially on mobile. The workable response is friction: CAPTCHA, step-up verification, or rate reduction on sessions flagged as high-risk. According to Google’s threat intelligence team, sustainable disruption requires ISP cooperation — not just periodic law enforcement operations. Commercial residential proxy classification APIs from providers like Spur and IPASIS now specifically classify residential exit nodes, giving detection pipelines a dedicated input.
Persistent device identifiers and behavioral fingerprints are now more reliable than IP addresses for establishing session continuity. The LG app ban and the NetNut takedown remove some supply from the market, but demand from attackers is not going away.
Key Takeaways
- NetNut, dismantled July 3, 2026 by FBI and Google, was built on 2+ million hijacked consumer devices and served 316 distinct threat clusters — including nation-state espionage groups — in a single week
- 42.5% of LG smart TV apps contained residential proxy SDKs that silently routed third-party traffic; LG has announced a ban on apps that retain the code
- IP-based defenses — rate limiting, geo-blocking, and reputation lists — are no longer reliable against attackers using residential proxies; the traffic is indistinguishable from real users at the IP level
- Multi-signal session scoring (TLS fingerprint + latency + behavioral velocity + device identifiers) is the current best practice; hard IP blocks generate too many false positives
- Each law enforcement takedown fractures rather than eliminates the infrastructure — the residential proxy ecosystem is now estimated at 8–9 million endpoints globally
