NETNUT

NetNut is a residential and ISP proxy provider founded in 2017 in Israel and acquired in 2019 by Safe-T Group Ltd (now Alarum Technologies Ltd). It originally specialized in ISP proxies and has since expanded across datacenter, residential, and mobile pools aimed at a premium segment of the market, alongside pre-built scraper APIs for use cases such as ecommerce and B2B contact-data acquisition. NetNut sources part of its network through DiViNetworks, a platform that purchases spare bandwidth from ISPs, and requires customers to pass a KYC procedure to access its ISP and residential networks.

Synthient's research associates NetNut with Popa, an Android proxyware SDK that enrolls consumer devices — phones, tablets, and streaming boxes — as residential proxy egress nodes from inside third-party streaming, IPTV, and utility applications. Across the samples analyzed, the SDK began relaying traffic at host-app launch with no informed-consent prompt; an optional consent dialog added in version 2.7.46 was not observed being invoked by any of the 20+ publishers tracked, many of which were tied to piracy-related applications.

The SDK has been operated continuously since at least 2020 under several labels, including Moneytiser, Popa, Loopop, Neupop, and the early Hopanet build, which Synthient assesses share operational infrastructure and telemetry. Eighteen distinct samples first observed between November 2020 and May 2026 beacon directly to sdk.netnut.io, and multiple samples carry the cyberprotector.online C2 within the same APK. Later builds retrieve their relay servers from AES-ECB-encrypted Google Drive blobs that decrypt to nice-protect.com. Public business-registry records compiled by Qurium Media Foundation, and not independently verified by Synthient, associate the founder of the NinjaTech platform with NetNut executive leadership.

On June 17, 2026, in a controlled test using systems Synthient operated on both ends, a request carrying the path /NETNUT_EXT_TRAFFIC_FROM_PROXY was issued into NetNut's commercial gateway at gw.netnut.net:9595 and arrived at a Synthient honeypot, sourced from a host running the Popa SDK, with no third-party traffic involved. On this basis Synthient assesses with high confidence that at least some Popa-enrolled devices act as egress nodes for NetNut's proxy network. This is an analytic judgment, not a statement of NetNut's internal knowledge or intent. NetNut rejects the assessment, stating that it operates a lawful proxy network with KYC, customer due diligence, and misuse monitoring; its full response is published alongside the report.

Observables

Network Observables

File Observables