NETNUT

NetNut is an Israeli company, part of Alarum Technologies, operating since 2017. It is known for residential and ISP proxies, web unblocking, and data APIs and is considered large sized. Synthient observed an IPWeb gateway accessing NetNut infrastructure; this establishes that supply route, not ownership or exclusive sourcing. Company history.

NetNut is observed leveraging Popa, Loopop, Hopmn, AppBandwidthMonetizer, Moneytiser, KProxy, and ThreeProxy, primarily on Android, with some Windows/macOS variants. These are App Monetization / proxyware families found in SportsFire 2.0.7, UKTurks, and Nova AdPlugin samples. A June 17, 2026 controlled test routed a NetNut request through Synthient's Popa-enrolled host; the report also documents the Neupop lineage.

Synthient's Research Team has not assigned a randomized cross-family consent risk score. Popa 2.7.46 had an optional consent prompt, but none of the 20-plus examined publishers invoked it. NetNut rejected the report's premise and stated that its sourcing uses lawful consent, KYC, due diligence, and monitoring. The test does not establish NetNut's knowledge or intent.

Provider relationships

Yara Rules

rule Proxyware_Popa_Android_TlvTunnelSdk
{
    meta:
        description = "NetNut Popa Android SDK with its nested TLV tunnel protocol"
        provider    = "Netnut"
        sdk         = "Popa"
        platform    = "Android DEX"
        variant     = "tlv-tunnel"
        category    = "proxyware"
        author      = "Synthient"
        date        = "2026-08-28"
        confidence  = "high"
        intel_family = "popanet"
    strings:
        $open   = "Lio/popanet/protocol/OpenTunnelMessage;" ascii
        $close  = "Lio/popanet/protocol/CloseTunnelMessage;" ascii
        $relay  = "Lio/popanet/protocol/TunnelMessage;" ascii
        $status = "Lio/popanet/protocol/TunnelStatusMessage;" ascii
        $tlv    = "Lio/popanet/protocol/TlvBox;" ascii

        $service = "Lio/popanet/service/PopaService$ProxyServiceBinder;" ascii
        $thread  = "Lio/popanet/task/TunnelAsyncThread;" ascii

        $register        = "/devicereg" ascii
        $consent_remnant = "popa.permission" ascii
    condition:
        uint32(0) == 0x0a786564 and
        filesize < 20MB and
        $open and
        2 of ($close, $relay, $status, $tlv, $service, $thread, $register, $consent_remnant)
}

This rule identifies an SDK family. A match alone does not establish malicious activity or the absence of consent.

Indicators of Compromise

File Hashes

Domains

IP Addresses