Israel's Residential Proxy Problem — And What Alarum's Collapse Means for the Sector

On July 2, 2026, the FBI replaced NetNut's homepage with a seizure banner. Within 24 hours, Alarum Technologies (NASDAQ: ALAR) — NetNut's Israeli parent — lost more than 70% of its market value. The company had traded at roughly 15x its price a year earlier. A single Krebs investigation, a Google Threat Intelligence Group report, and a federal domain seizure erased the entire run.

The Alarum collapse is not an isolated event. It is the second major residential proxy takedown of 2026 — Google disrupted IPIDEA in January — and both stories run through the same country.

Israel exports residential proxy infrastructure at a scale no other country matches.

The sector map

Residential proxy networks route internet traffic through real consumer devices — home routers, smart TVs, streaming boxes, mobile phones — rather than data-center IPs. Legitimate buyers use them for ad verification, price monitoring, and market research. Illegitimate buyers use them for credential stuffing, scraping, ad fraud, and espionage. The line between the two markets is thinner than the industry admits.

The category is disproportionately Israeli:

• Bright Data — formerly Luminati Networks, spun out of Hola VPN. The category's largest player. Settled a Meta lawsuit over Instagram and Facebook scraping in 2024. Israeli-founded, Israeli-headquartered.
• NetNut / Alarum Technologies — publicly listed on Nasdaq. Seized by the FBI on July 2, 2026. Parent company market cap collapsed to under $20M.
• Oxylabs — Lithuanian on paper. Deep operational and personnel overlap with the Israeli proxy industry.
• IPRoyal, Smartproxy, and a long tail of resellers — Google Threat Intelligence Group assessed with "high confidence" that many popular residential proxy brands are, in fact, white-labeling NetNut's network.

The founder graph is small. The infrastructure graph is smaller. When one operator gets seized, the resellers rebuild by buying capacity from the survivors — a pattern security researchers documented after the IPIDEA takedown and expect to see again now.

What Krebs, Google, and Synthient actually found

Three findings drove the enforcement action:

1. Roughly two million consumer devices — primarily smart TVs and low-cost streaming boxes — were enrolled in the Popa botnet without meaningful consent. Researchers at Synthient examined more than 20 host applications carrying NetNut's SDK and found none presented users a clear disclosure prompt.
2. 316 distinct threat actor clusters used suspected NetNut exit nodes in a single week in June 2026, according to Google Threat Intelligence Group. The clusters included cybercriminal groups and state-sponsored espionage operators.
3. Direct links between Alarum's executive leadership and the developers of the Popa SDK — established independently by Qurium and Synthient. This is the finding that made the story a governance story, not a security story.

Alarum's public position, before and after the seizure, has been that its software is a consensual bandwidth-sharing product and that independent research findings are "demonstrably inaccurate." The FBI, the IRS Criminal Investigation division, Google, Lumen, and Shadowserver acted on the opposite conclusion.

The Krebs → GTIG → FBI enforcement pattern

The NetNut takedown followed a template that is now the template.

• June 19, 2026 — three security firms (Qurium, Synthient, and a third) publish technical findings linking NetNut infrastructure to the Popa botnet.
• Late June — Brian Krebs publishes on KrebsOnSecurity, moving the story from cybersecurity press into general business coverage.
• July 2, 2026 — Google Threat Intelligence Group publishes a coordinated blog post disclosing the technical basis for enforcement. The FBI seizes hundreds of domains the same day.

This is the second time in six months this exact sequence has run. IPIDEA — NetNut's largest competitor — was dismantled the same way in January 2026. The lag between researcher publication and federal action was under three weeks in both cases.

For the residential proxy category, that timeline is now the operating assumption. Once a technical link between commercial infrastructure and a botnet is published in a credible outlet, the FBI has demonstrated it can and will move on it inside a month.

What buyers of "residential proxy" services need to ask now

The legitimate use cases for residential proxy networks — ad verification, brand protection, competitive intelligence — have not gone away. The compliance exposure for the buyers has changed.

Any enterprise procurement team currently paying for residential proxy access should be asking their vendor four questions, in writing, this quarter:

1. What is the consent mechanism presented to the end users whose devices are carrying our traffic? Show the disclosure copy and the user flow.
2. Where does the exit-node capacity come from? Owned infrastructure, licensed SDK partnerships, or wholesale purchase from another network. If the answer is "we don't disclose," treat it as a red flag.
3. What is the vendor's public position on the Krebs, Qurium, Synthient, and Google Threat Intelligence Group findings on NetNut? Silence is a position.
4. If the FBI seized this vendor's domains tomorrow, what is the continuity plan? Where does our traffic route on day two?

The residential proxy industry will not disappear. It will restructure — probably around a smaller set of operators with defensible consent flows and, more likely, a shift toward genuinely opt-in bandwidth-sharing models with real user compensation. The category is not over. The version of the category that shipped SDKs into 2 million smart TVs without meaningful consent is over.

The Israeli reputation question

Israel exports category-defining technology in cybersecurity, defense, medical devices, and now AI infrastructure. Residential proxy networks have quietly become another Israeli export category — and this one is now on the wrong side of two federal enforcement actions in six months.

The reputational cost of that concentration is not evenly distributed. It falls first on Israeli-founded companies operating in adjacent categories — data collection, web intelligence, alternative data, marketing technology — that will now be asked harder questions by U.S. enterprise buyers and by U.S. regulators. It falls second on the Israeli venture ecosystem, which has funded this category heavily.

The industry-level response — from the Israel Innovation Authority, from the sector's trade associations, from the surviving operators — has so far been silence. That is a choice. It is likely to be a costly one.

For the crisis-communications read on Alarum's specific response — the 18-word statement, the missing CEO, the $290M silence — see Ronn Torossian's companion analysis.

Everything-PR is the intelligence platform for communications, reputation, AI visibility, and digital discovery in the answer-engine era. Thirty-plus publications. Publishing since 2009. Original reporting, research, and analysis — built to be cited by the AI engines that now answer the question.