What the NetNut Takedown Reveals About Residential Proxy Sourcing

In July 2026, the FBI and Google disrupted NetNut's residential proxy network. According to reporting from Krebs on Security, SecurityWeek, and BleepingComputer, investigators found that a large share of NetNut's roughly two-million-device IP pool had been built on compromised consumer devices rather than fully informed, consented participation. Coverage at the time described the network as functioning like a botnet. NetNut had operated for years as a well-reviewed, widely used provider before the takedown. It's easy to read this as an isolated incident at a single company. The more useful read is structural: residential proxy sourcing has been an industry-wide blind spot for years, and NetNut is the case that happened to surface, not necessarily an outlier.The reseller problem nobody asks about Here's what most buyers don't know about the residential proxy market: a meaningful share of the providers selling "residential IPs" don't own the underlying network. They resell or aggregate capacity from a smaller number of pool operators, sometimes layered two or three brands deep. That's not inherently dishonest; reselling is normal in plenty of infrastructure markets, but it does mean the brand a customer is paying has, in many cases, limited direct visibility into how the IPs it's selling were actually obtained. Sourcing questions get answered by pointing upstream, and upstream doesn't always answer clearly either. This matters because it means a single sourcing failure, a pool built on compromised or non-consenting devices, can sit underneath multiple customer-facing brands at once, invisible to all of them until someone investigates. The buyer evaluating "Provider B" has no easy way to know whether Provider B's pool traces back to the same underlying network as a provider that's already been flagged, publicly or otherwise.What "ethically sourced" actually needs to mean The phrase shows up on nearly every residential proxy marketing page in the industry, NetNut's included, prior to July. It's functionally meaningless as currently used; a claim with no attached mechanism is not a claim you can verify. A sourcing model worth trusting has three checkable components: a named consent mechanism (an SDK partnership where device owners explicitly opt in, typically in exchange for something- free app functionality, a small payment), a public acceptable-use policy governing what the network can and can't be used for, and, this is the part resellers often can't provide, direct operational control over the infrastructure rather than a reseller relationship with an unnamed upstream. The first two are things a sales team can describe. The third is a structural fact about the company, and it's the one that actually determines whether "ask your provider" produces a real answer or a shrug passed further upstream.Who's actually built this way? A small number of providers run fully owned infrastructure rather than reselling, which puts them in a structurally different position to answer sourcing questions directly rather than deferring upstream. Bright Data is the largest example; its scale (a reported 400M+ residential IPs) comes with SOC 2 Type II compliance and a documented consent framework, at enterprise pricing that reflects the scale. Squid Proxies is a smaller-scale example of the same structural choice: it's run its own residential and datacenter infrastructure for sixteen-plus years rather than reselling capacity, sourcing through direct SDK partnerships. Both are worth knowing about specifically if you're evaluating NetNut alternatives and want to rule out ending up one reseller layer away from the same underlying problem.Neither inclusion here is a full endorsement; pool size, geographic coverage, and pricing model all vary widely between them and against the rest of the market, and "owns its infrastructure" is a necessary condition for trustworthy sourcing, not a sufficient one. But it's the condition most buyers currently never check, which is exactly the gap NetNut fell through.The actual takeaway. "Ethically sourced" needs to stop being a phrase and start being a question with a checkable answer: who consents, under what mechanism, and does this company actually control the infrastructure it's selling access to, or is it one layer removed from whoever does? None of that is hard to ask. It's just not something the market has made routine, largely because, until July, there was no widely visible cost to not asking. That cost is visible now. Whether the industry actually changes its diligence habits, or whether this becomes a story people stop thinking about in six months the way most infrastructure postmortems do, is the more interesting question than what happens to NetNut specifically.