Threat Intel

Google’s Continued Disruption of Malicious Residential Proxy Networks

Google, FBI, and Lumen dismantled the NetNut/Popa residential proxy network—building on the earlier IPIDEA takedown and highlighting persistent adversary reliance on proxy infrastructure to evade enterprise defences.

Summary written by editorial AI · Source link below

Filed by Google Threat Intel2 July 20261 min readRead at source ↗

Background Today, in coordination with the FBI, Lumen, and others, Google took action against the NetNut residential proxy network, also known as Popa. This action builds on our disruption of the IPIDEA proxy network that took place in January 2026, and is a continuation of Google’s objective to dismantle malicious residential proxy networks. Actions Taken As a part of this disruption we took the following actions: Disabled Google accounts and associated Google services used by NetNut for malwar

Editorial Analysis

Why it matters

Residential proxy networks undermine IP-reputation and geo-fencing controls; their coordinated disruption reduces but does not eliminate a key adversary anonymisation layer.

What to do

Cross-reference published IOCs from this takedown with your network logs and update proxy-detection rules accordingly.

Board brief

A coordinated takedown of a major residential proxy network reduces a key tool attackers use to bypass corporate security controls.

Forward-looking interpretation drafted by editorial AI under human review — not a reproduction of the source. See methodology.

Continue at the source

Read the full report at Google Threat Intel

External link — opens at Google Threat Intel in a new tab.

Continue with

Editorial Analysis

More from the Threat Intel Desk