On 2 July 2026 the FBI and IRS Criminal Investigation seized NetNut’s domains, and netnut.io still served a federal seizure banner when we checked on 28 August 2026. If NetNut was your supplier, you are not shopping for a discount — you are shopping for a network that will still exist next quarter.
Treat this as a supply-chain incident rather than a vendor switch. The takedown did not just remove one provider from the market; it produced a public statement from the investigating side that other brands were reselling the same pool. That changes what you should be asking a replacement, and it is worth an hour before it is worth a migration.
On 2 July 2026 the FBI and the Internal Revenue Service Criminal Investigation division seized hundreds of domains belonging to NetNut, the residential proxy service operated by the Nasdaq-listed Israeli company Alarum Technologies. The seizure notice credited Google, Lumen and Shadowserver. Two weeks earlier, three security firms had independently linked NetNut’s exit nodes to a botnet called Popa — a pool of at least two million consumer devices, largely smart TVs and streaming boxes, enrolled by bundled software with little or no consent from the people who owned them.
Reported by KrebsOnSecurity and Cybernews in July 2026. The Google Threat Intelligence Group, which took part in the disruption, said that during a single week in June 2026 it observed 316 distinct clusters of threat actors using suspected NetNut exit nodes, and that the action caused significant degradation to the network. We re-checked the domain ourselves from a US exit on 28 August 2026.
Price is not the first question after a takedown, but it is the question you land on once a provider has passed the checks below. This is our residential pricing index: every provider we track, the rate a new account actually pays, the cheapest rate each one advertises, and what unlocking that cheapest rate costs. We name them and we do not link to them — the index records a source page for every figure, so all of it can be checked without taking our word for it.
| Provider | Pay-as-you-go per GB | Cheapest advertised rate | Minimum to start |
|---|---|---|---|
| QuantumProxies — Residential Basic | $1.00 | $0.80 | $5 minimum, no subscription |
| DataImpulse | $1.00 | $0.50 | $5 (5GB) |
| Decodo | $4.00 | $2.75 | $11.25/mo (3GB) |
| SOAX | $5.00 | $0.85 | none |
| NodeMaven | $5.00 | $2.20 | none (PAYG) / $2.20 tier requires 1TB monthly plan |
| Proxy-Cheap | $5.99 | $0.52 | $1.99 |
| Webshare | $7.00 | $1.40 | none |
| IPRoyal | $7.35 | $1.75 | none; $1.75 only from 10TB |
| Bright Data | $8.00 | $2.50 | none (PAYG) / $1999-mo for $2.50 tier |
| Oxylabs | No pay-as-you-go rate | $2.50 | $30/mo (5GB starter); $2.50 tier requires $2500/mo |
Competitor prices verified 2026-07-29. Sorted by pay-as-you-go rate, lowest first. That is an arithmetic order, not a ranking: providers publishing no pay-as-you-go rate appear last, and nothing here scores quality, success rate or support. Figures are advertised list prices taken from each provider's own public pricing page on the verification date shown above, in USD, excluding VAT.
Most “best NetNut alternatives” lists have the same flaw: they were written to sell the next proxy network, so they treat a federal seizure as a marketing event. The useful version of this page is shorter and less flattering to everyone in the market, us included. NetNut is gone. The reason it is gone is that its residential pool was substantially built on devices whose owners had not knowingly agreed to be in it. And the organisation that helped take it down said publicly that other brands were reselling that same pool. That last point is the one worth carrying into your next purchase, because it is the one that decides whether you have to do this again in six months.
A provider that is having an outage comes back. A provider whose domains have been seized by two federal agencies is in a different situation, and it is not one that resolves on a schedule you can plan around. As of our check on 28 August 2026, nearly two months after the action, netnut.io was still returning a seizure banner rather than a service. Whatever balance you were holding sits with a seized operator, and any credentials, IP allowlists or webhook endpoints you shared with the platform should be rotated on the assumption that the environment around them is no longer under its original management. That is ordinary hygiene after any vendor compromise, and it is cheaper than finding out otherwise.
The instinct after a takedown is to buy the largest, most established network available, on the theory that size means legitimacy. The Google Threat Intelligence Group specifically warned against that inference. In its write-up of the disruption it said it has high confidence that many popular residential proxy brands are in fact white-labelling the NetNut botnet, and it noted that when a network is degraded, operators tend to buy capacity from competitors and quietly become resellers. Both halves matter to a buyer. A brand you have heard of may be a storefront on someone else’s pool, and the composition of that pool can change underneath a stable-looking logo without any announcement at all.
Five questions separate a provider that has thought about this from one that has not. Where do the residential IPs come from, and by what mechanism does a household end up in the pool? Are the people supplying that bandwidth told what they are joining, compensated for it, and able to leave? Is the network operated or resold, and if it is resold, from whom? What happens to my balance and my sessions if the upstream disappears the way NetNut did? And can I buy a small amount first, without a subscription, a sales call or a contract, so that the answer to all of the above can be tested rather than believed? A provider that answers the first four cleanly and refuses the fifth has told you something about how it expects to be evaluated.
Our stated position is that our residential pool is built from participants who join knowingly and are compensated for the bandwidth they contribute, across roughly 90 million addresses. We are not going to pretend that stating it settles it. After a takedown in which the investigators said the quiet part out loud about white-labelling, a sourcing claim from any vendor — this one included — is a claim, and the only honest thing to do with it is make it cheap to test. That is what the $5 minimum is for: five gigabytes, no subscription, no identity check, no call. Point it at the targets you actually scrape, look at the success rate and the exit addresses you get back, and judge from that rather than from this paragraph.
Residential Basic is $1.00 per gigabyte pay-as-you-go with a $5 minimum order and no subscription attached. As recorded in our pricing index on the verification date shown on this page, no provider in that index publishes a lower pay-as-you-go rate, and one — DataImpulse — matches it at $1.00. At volume our rate falls to $0.90 per GB at 500 GB and $0.80 per GB at 1 TB, and it falls because you bought bandwidth, not because you committed to a monthly spend. The table above sets those figures beside every other provider we track so you can see where the whole market sits rather than only where we do.
The practical part is usually smaller than people expect. Our residential endpoints speak ordinary HTTP, HTTPS and SOCKS5 with username and password authentication, with rotating and sticky sessions and country-level targeting across 200+ countries, so for most codebases a migration is a change of host, port and credentials rather than a change of architecture. If your integration was built against NetNut’s gateway pattern, the shape of it — a single endpoint, session control in the username, geo selection as a parameter — is the same shape here. Move one job first, compare success rates against your own logs for a day, then move the rest.
Signup is an email address. Card, PayPal, Apple Pay and Google Pay all work, as do Bitcoin, Ethereum, USDT, Monero and around 300 other cryptocurrencies, credited automatically on confirmation with no KYC at any plan size. Crypto and account-balance payments carry no VAT while card, PayPal and Stripe add 22%, so the payment method is itself worth roughly eighteen percent of the total. For a team that has just lost a supplier overnight, the relevant part is that nothing here requires a quote, a contract or a scheduled call before traffic can move.
Effectively, yes. The FBI and IRS Criminal Investigation seized hundreds of NetNut domains on 2 July 2026, and netnut.io was still serving a federal seizure banner when we checked from a US exit on 28 August 2026. It is not selling and should not be treated as a supplier you can plan around.
According to the seizure notice and the reporting around it, NetNut’s residential proxy network was populated by a botnet called Popa: at least two million consumer devices, largely smart TVs and streaming boxes, running bundled software that turned them into always-on proxy exit nodes with little or no consent from their owners. NetNut was operated by the Nasdaq-listed Israeli company Alarum Technologies, which said it would cooperate with investigators.
Nothing about a domain seizure by two federal agencies suggests a timeline you can plan around, and the domains were still seized nearly two months later. Treat the capacity as gone, rotate any credentials that were shared with the platform, and move the workload rather than waiting.
It depends on what you were using NetNut for, but the selection criteria changed with the takedown: sourcing you can question, a small enough first order to test properly, and no commitment that would hurt if it happened again. QuantumProxies Residential Basic is $1.00 per GB with a $5 minimum and no subscription. The table on this page lists every other provider in our pricing index with its published rates so you can shortlist rather than take a single recommendation.
On the verification date shown on this page, no provider in our residential pricing index publishes a pay-as-you-go rate below our $1.00 per GB, and DataImpulse matches it at $1.00. Several providers advertise lower cheapest-tier rates — Proxy-Cheap at $0.52 and SOAX at $0.85, for example — but those are volume floors rather than the rate a new account pays, which is why the table shows both numbers.
Residential proxies are a normal tool for price monitoring, ad verification and public data collection, and nothing about the takedown changes that. What it changes is the diligence: the Google Threat Intelligence Group said many popular brands white-label pools they did not build, so the sourcing question is now a purchasing question rather than an ethics footnote. Ask it of every provider you shortlist.
No — QuantumProxies is a separate network and has never been operated by Alarum Technologies. On the wider question of where any provider’s addresses come from, this page argues that no vendor’s self-description should be accepted on trust, and that includes ours. What we publish is that participants in our pool join knowingly and are compensated for the bandwidth they contribute. What we suggest is that you spend $5, run your own targets through it, and judge the result.
“Best” is the wrong frame two months after a federal seizure. The provider you want is the one whose sourcing you can interrogate, whose smallest order is small enough to test properly, and whose pricing does not depend on a commitment you would regret if this happened again. We think that describes us at $1.00 per gigabyte with a $5 minimum, and we have put the rest of the market in the table above rather than hiding it, because a comparison that only lists the author is not a comparison. Buy 5 GB, run your own targets, and decide from your own numbers.
Skip the marketing. QuantumProxies.io publishes a machine-readable site map, Markdown for every page, a free MCP server, and APIs billed from the same balance as your proxies.
Connect in one command: npx -y quantumproxies-mcp