--- title: ‘Popa’ Botnet Linked to Publicly-Traded Israeli Firm –... description: The Popa botnet, an Android-based network averaging 1.5–2.5 million daily IP addresses, has been linked by multiple security researchers to NetNut, a... canonical: https://daily.dev/posts/popa-botnet-linked-to-publicly-traded-israeli-firm-krebs-on-security-uiuu7khvo twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: ‘Popa’ Botnet Linked to Publicly-Traded Israeli Firm – Krebs on Security | daily.dev og:description: The Popa botnet, an Android-based network averaging 1.5–2.5 million daily IP addresses, has been linked by multiple security researchers to NetNut, a... og:url: https://daily.dev/posts/popa-botnet-linked-to-publicly-traded-israeli-firm-krebs-on-security-uiuu7khvo og:image: https://api.daily.dev/og/posts/uiuu7KHVo.png og:image:alt: ‘Popa’ Botnet Linked to Publicly-Traded Israeli Firm – Krebs on Security og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # ‘Popa’ Botnet Linked to Publicly-Traded Israeli Firm – Krebs on Security **[Krebs on Security](https://daily.dev/sources/krebsonsecurity)** · 14 min read · 1 upvotes · 0 comments ## Summary The Popa botnet, an Android-based network averaging 1.5–2.5 million daily IP addresses, has been linked by multiple security researchers to NetNut, a residential proxy service operated by NASDAQ-listed Israeli firm Alarum Technologies. Popa operates as a plugin of the Vo1d botnet, silently turning cheap Android TV boxes and smart TV apps into residential proxy nodes used for advertising fraud, account takeovers, and AI training data scraping. Synthient found outbound Popa traffic clearly routed through NetNut clients, while Alarum denies the botnet characterization. Spur found that over 42% of LG webOS apps and 25% of Samsung Tizen apps include proxy SDKs, and that NetNut's KYC controls are largely ineffective. Security experts warn that these proxy networks are increasingly found inside corporate environments, creating legal and reputational risk for organizations whose IP space is co-opted without their knowledge. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [FBI Seizes NetNut Proxy Platform, Popa Botnet – Krebs on Security](https://daily.dev/posts/fbi-seizes-netnut-proxy-platform-popa-botnet-krebs-on-security-kdkdrksub) · Krebs on Security · 3 upvotes · 0 comments - [Google’s Continued Disruption of Malicious Residential Proxy Networks](https://daily.dev/posts/google-s-continued-disruption-of-malicious-residential-proxy-networks-6zdypafgl) · Google Cloud · 1 upvotes · 0 comments - [NetNut proxy network disrupted, 2 million infected devices cut off](https://daily.dev/posts/netnut-proxy-network-disrupted-2-million-infected-devices-cut-off-ywibtnja8) · BleepingComputer · 1 upvotes · 0 comments - [Google and FBI Dismantle NetNut Residential Proxy Botnet](https://daily.dev/posts/google-and-fbi-dismantle-netnut-residential-proxy-botnet-iusqk4knt) · Latest Hacking News · 8 upvotes · 1 comments --- Tags: [#malware](https://daily.dev/tags/malware) [View this post on daily.dev](https://daily.dev/posts/popa-botnet-linked-to-publicly-traded-israeli-firm-krebs-on-security-uiuu7khvo) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"‘Popa’ Botnet Linked to Publicly-Traded Israeli Firm – Krebs on Security","url":"https://daily.dev/posts/popa-botnet-linked-to-publicly-traded-israeli-firm-krebs-on-security-uiuu7khvo","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/popa-botnet-linked-to-publicly-traded-israeli-firm-krebs-on-security-uiuu7khvo"},"datePublished":"2026-06-18T17:46:31.733Z","dateModified":"2026-06-18T17:56:10.860Z","description":"The Popa botnet, an Android-based network averaging 1.5–2.5 million daily IP addresses, has been linked by multiple security researchers to NetNut, a...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/291d180f95639b19243562c49903aacb?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/291d180f95639b19243562c49903aacb?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Krebs on Security","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Krebs on Security","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/deb3e417ddef4d0e8cc4d704becf6004","url":"https://daily.dev/sources/krebsonsecurity"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/popa-botnet-linked-to-publicly-traded-israeli-firm-krebs-on-security-uiuu7khvo","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"malware","timeRequired":"PT14M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Krebs on Security","item":"https://daily.dev/sources/krebsonsecurity"},{"@type":"ListItem","position":3,"name":"‘Popa’ Botnet Linked to Publicly-Traded Israeli Firm – Krebs on Security"}]} ```