Alternatives
Need NetNut Alternatives? 5 Options and How to Migrate
Leaving NetNut? What Google's report, Alarum's filings and the domain notice do and don't establish, plus 5 conditional replacements and a migration plan.
For NetNut alternatives, I would first preserve the existing setup privately, verify the dated status and then compare approved, traceable replacement suppliers.
Google published its own NetNut-related action report in July 2026; the public domain displayed a separate action notice when inspected on October 15, and on November 12 it still served a page headed “Seized by the Federal Bureau of Investigation”. Alarum also filed dated company statements about associated-domain seizures and disruption, plus later filings about lawsuits and delayed results, summarized below. These sources do not establish a court outcome, current company status or every customer’s service position. Google report, Observed domain notice, Alarum July 2 statement, Alarum July 3 statement.
Short on time?
Here's my take
- Big pool, strict checks
- Bright Data
- It advertises the largest pool on this list (400M+ residential IPs, company-reported) and publishes the strictest buyer gate, with a registered company, corporate email and human KYC required for new residential zones.
- Cheapest pay-as-you-go
- Decodo
- Its $4/GB pay-as-you-go rate is the lowest pay-as-you-go price on this shortlist without a coupon, and a free 100 MB, 3-day trial (it rolls into the chosen paid plan unless you cancel) lets you check the fit first.
- Small or shared-IP jobs
- Webshare
- Its 100 shared datacenter IPs for $2.99 a month and 1 GB residential plan for $3.50 are the cheapest published plan cards I found on this shortlist, though both renew monthly.
Prices verified . Sponsors cannot buy a verdict or a position.
On the evidence I have, I’d pick Bright Data if you need a big pool and can pass company KYC, Decodo if you want the cheapest pay-as-you-go rate, and Webshare for small or shared-IP jobs. IPRoyal and Oxylabs fit narrower cases, covered in which one should you pick. No supplier here has approved an account for me, and no live migration or proxy evaluation was performed. The proxy pillar helps identify the product you actually need.
What is actually known about NetNut? #
Google’s dated report, Alarum’s issuer statements and the visible domain notice are separate evidence. I would preserve their attribution and dates rather than combine them into a claim that Google seized the business or that a particular legal outcome followed.
| Signal | What was read | What it does not establish |
|---|---|---|
| Google, July 2026 | Google’s account/service and Play Protect actions, with reported coordination involving FBI, Lumen and others | A court finding, conviction or a conclusion about every customer |
| NetNut public domain, observed October 15 and November 12, 2026 | A visible image (October 15) describes FBI action coordinated with DOJ/IRS-CI, and separately Google/Lumen/Shadowserver disruptions; on November 12 the page was still headed “Seized by the Federal Bureau of Investigation” | An independently authenticated notice, underlying order, case number or outcome |
| Alarum issuer statements and filings, July 2 – November 9, 2026 | Dated company acknowledgments and descriptions, detailed below | An independent finding, completed restoration or current account/service status |
Google describes disabling associated accounts/services, sharing SDK/backend intelligence and using Play Protect against identified apps. Those remain Google’s attributed findings and account of its own actions; they are not measurements or judicial findings I made. Google’s report.
Google’s November 3, 2026 report on the XCPE set-top-box backdoor says one module loaded through it starts NetNut’s Popanet SDK, and that all Popanet C2 infrastructure connected to that backdoor had already been taken down in the July NetNut disruption. Google attributes the backdoor itself, with high confidence, to the device maker Videostrong; it does not say NetNut knew of or took part in it. Google XCPE report.
The visible notice did not show a date, case number or court order. This research did not independently establish its authenticity, charges, defendants, current corporate status, lawful availability, refunds, ongoing service or legal outcome. The source links show what was available to inspect, not a guarantee of those missing facts. Observed notice.
The October 15 searches for a directly matching DOJ/FBI/Europol release or order did not produce one in that research, and repeat searches on November 11 and 12 did not surface one either. That is a retrieval limit, not evidence that no proceeding exists. I would not call NetNut a scam, state insolvency or closure, infer subscriber culpability or recommend using its service from this record.
What did Alarum say, and when? #
I first read the July issuer documents on October 16, 2026 and re-read them, plus four later filings, on November 11 and 12, 2026. They add the company’s own historical account; furnishing a statement through the SEC does not turn it into a court or agency finding.
| Company statement date | What the issuer reported | Limit on the inference |
|---|---|---|
| July 2, 2026 | Alarum said it had become aware of FBI seizures of associated domains. July 2 exhibit | This is a company acknowledgment of domain action, not proof of every allegation or any customer’s position. |
| July 3, 2026 | Alarum reported additional domain seizures and disruption to part of its service. July 3 exhibit | The dated report does not establish all-service downtime or October availability. |
| July 4 release / July 6 filing | Alarum announced a temporary pause of certain network services for several days, with significantly reduced availability. The parent Form 6-K identifies a July 4 release, matching the original issuer wire; the attached exhibit’s body dateline says July 6. Parent filing, pause exhibit, original July 4 release | I retain the release/filing distinction and the dateline mismatch. A planned several-day pause does not prove a resumption date. |
| July 13, 2026 | Alarum said the root cause remained unknown and an external review was ongoing, while describing recovery options and workforce measures. July 13 exhibit | An ongoing company review is neither a completed finding nor proof of restoration, wrongdoing or exoneration. |
| July 22, 2026 | Alarum reported an Israeli shareholder discovery motion and a motion to certify a class action against the company and two officers alleging misleading statements about its residential proxy business; it said it intends to defend itself vigorously. July 22 filing | A pending motion is an allegation, not a finding. |
| August 13, 2026 | Alarum reported an additional discovery motion that lists NetNut Ltd. as a respondent (hearing set for December 14, 2026) and a U.S. complaint filed August 5 that it had not yet been served with. August 13 filing | Pending proceedings establish no outcome. |
| August 27, 2026 | Alarum delayed its first-half 2026 results, citing the previously reported developments; its forward-looking statements refer to an expectation of significant operating and net losses. August 27 filing | Says nothing specific about NetNut service status. |
| November 5, 2026 (furnished November 9) | The annual-meeting proxy statement says the audit committee is overseeing matters relating to previously disclosed seizures of certain NetNut Ltd. domains, which it attributes to the U.S. Department of Justice. Proxy statement | A governance note, not a status update on service, charges or restoration. |
These statements do not establish current charges, a legal outcome, permanent closure or the availability of any particular service today. None of the filings I read through November 9 announces restored service, criminal charges or a sale of NetNut. I would obtain a fresh, account-specific status before making an operational decision; this article does not recommend NetNut.
Which alternatives would I look at? #
I would compare the following only after replacement identity, use-case approval and sourcing checks. Prices/specifications, including IPRoyal’s selected pricing tabs and fee terms and each advertised pool size, were verified 2026-11-12. USD as displayed, before tax, any disclosed service fee and selected quote conditions. This is a procurement shortlist, not a list of accounts already approved for me.
| Candidate | Advertised pool (company-reported) | Published buying input | Approval/evidence condition |
|---|---|---|---|
| Bright Data | 400M+ residential IPs, 195 countries | Residential $8/GB list; conditional $4/GB coupon | Registered company, corporate email, human KYC and funded new-zone access |
| Decodo | 115M+ IPs, 195+ locations | Residential $4/GB PAYG; ten GB/$35 monthly, excluding VAT; 100 MB, 3-day trial | Customer checks and sourcing documentation; documentation-only here |
| Webshare | 80M+ residential IPs, 195 countries | Residential one GB/$3.50; discounted ten GB/$27.50 monthly; no residential trial listed | Identity, use-case and payment verification; selected quote required |
| IPRoyal | 64M+ IPs, 195 countries and regions | Subscription: one GB/$7 or ten GB/$52.50; regular PAYG: one GB/$7.35 or ten GB/$55.10 | Identity, fraud-screening and use-case checks and a selected quote including any disclosed fee |
| Oxylabs | 175M+ residential IPs (no country count on the pricing page) | $15 Starter shared wallet, residential $6/GB, up to two GB | KYC/use-case review; documentation-only under monitoring terms |
The pool column is each company’s own headline count, and they don’t count the same way, so I wouldn’t pick on it. The number of IPs in the country you need matters more, so check the per-country figure on the provider’s own page before you buy.
The recommendation is conditional on completed relevant checks, not the presence of a KYC policy page. I did not verify my own eligibility, any supplier chain end to end or the intended targets’ permission. Bright Data alternatives covers Decodo, Webshare, IPRoyal and Oxylabs too, sorted by the product being replaced.
Bright Data, for registered companies #
New residential zones after July 7, 2026 require a registered company, corporate email, human KYC and real funds. I would rule out a generic personal/free signup as proof of residential access. Residential policy.
Its pricing page advertises 400M+ rotating residential IPs in 195 countries and matches a first deposit dollar for dollar up to $500 (verified 2026-11-12). The $4/GB rate needs the RESIGB50 coupon; the list rate is $8/GB. Residential pricing.
For an assigned-ISP requirement, its published shared ten-IP/$18 or dedicated ten-IP/$35 monthly options are distinct from rotating residential GB. Integration documentation also separates raw proxy transport from managed Browser API and restricts specified account-management uses. ISP pricing, Playwright integration.
Bright Data describes opt-in and withdrawal controls in its sourcing policy, but those are provider assertions. The licence and acceptable-use restrictions still apply to target rights and the proposed workload. Sourcing, Licence, AUP.
Decodo: check the plan terms first #
Residential PAYG is $4/GB; a ten-GB monthly allowance is $35 excluding VAT. Dedicated ISP three IPs/$9.99 or ten/$29 monthly is a separate reserved-IP product. I would match geography, sessions and required IP persistence before comparing totals. Residential, ISP.
The same pricing page offers a free 100 MB, 3-day residential trial that activates the chosen plan automatically when it ends, and says the 14-day money-back option doesn’t apply if you take that trial (verified 2026-11-12). It advertises 115M+ IPs in 195+ locations. Residential pricing.
Its sourcing/compliance pages describe compensated peers, explicit consent and customer checks, not an independent audit completed here. Its licence restricts public performance analysis, and its dedicated refund policy has first-purchase, trial, payment, enterprise and usage conditions. I would not treat the purchase as guaranteed free testing. Sourcing, Compliance, Licence, Refunds.
Webshare: three products, so pick the right one #
Webshare’s monthly residential cards list one GB/$3.50, then discounted ten/$27.50 and 100/$225. Its static ISP product and default 100 shared datacenter IPs/$2.99 monthly are separate configurations; its free ten IPs/one-GB offer is datacenter. On November 12 a “Cyber Month” banner advertised up to 70% off residential with code CYBER26; I did not verify how it changes these cards. The residential page lists no residential trial (its “No trial period” FAQ line describes the free datacenter tier) and advertises 80M+ residential IPs in 195 countries (verified 2026-11-12). Residential, Static ISP, Datacenter, Free offer.
Webshare’s compliance policy says it requires users to verify identity, proxy use case and payment method. Paid subscriptions renew and refunds are discretionary under short time/traffic conditions; fair-use throttling can also apply to relevant unlimited plans. I would not present it as unrestricted anonymous transport or unlimited speed. Compliance, Terms, Fair use.
IPRoyal: check the fees and suppliers #
I would check IPRoyal’s fee terms before comparing the quoted tariff: section 6.17 permits a disclosed fixed or percentage Service Fee at order/payment/deposit, with no second fee when spending an already funded wallet balance. The actual fee is unverified, and applicable tax is also outside the quoted prices. Terms, §6.17.
The pricing-page review (October 16, re-checked November 12) resolves the earlier toggle ambiguity: subscription cards list one GB for $7 and ten GB for $52.50; regular PAYG cards list one GB for $7.35 and ten GB for $55.10. The $1.75/GB subscription headline requires ten TB, not one TB. Exact 100-GB/one-TB quotes, account eligibility and final checkout totals remain unknown. Its residential page says the traffic never expires and advertises 64M+ IPs in 195 countries and regions (verified 2026-11-12). Exact residential pricing tabs, residential product.
Its sourcing page describes a vetted partner network (third-party identity checks, business-model review, evidence of device-owner consent) without naming suppliers, while the help-centre FAQ says the network was built through Pawns.app with voluntary participation. That is not evidence every exit comes exclusively from Pawns or that every consent record was audited. Sourcing, Pawns FAQ.
I would complete relevant KYC/use-case checks, review rights obligations and resolve refund conditions before payment. A refund path is not a generic free trial. KYC, Terms, AUP, Refunds.
Oxylabs, another option for companies #
Oxylabs’ shared wallets are $15/$100/$500 monthly, with residential rates $6/$5/$4 per GB. Its $5 welcome credit is for verified companies; Web Unblocker consumes the wallet at different GB rates. The wallet is not a complete separate allowance for every product, and the pricing page says unused credits expire at the end of the billing cycle. It advertises 175M+ residential IPs (verified 2026-11-12). Residential, Welcome credit, Web Unblocker.
Customer identity/use-case review and acceptable use still apply. Written consent is required for availability/performance/functionality monitoring, so this project keeps Oxylabs documentation-only; self-service nonrefund wording and conditional PAYG exceptions must be resolved against the actual contract. KYC, AUP, General conditions, Pricing.
NodeMaven is not included as a verified replacement recommendation in this sensitive shortlist. Its FAQ, read November 12, says KYC is not required, which does not establish completed customer/use-case verification or an anonymity guarantee. KYC FAQ.
DataImpulse shows up on several pages that rank for this search, and it is the cheapest pay-as-you-go option I saw: from $1/GB, traffic that never expires, and a $5 intro plan (5 GB) for new customers (verified 2026-11-12). I left it off the shortlist by the same rule as NodeMaven: its residential page lists no buyer identity or use-case check, and its terms only let it request ID when use looks ambiguous or prohibited (sections 7.1–7.2), with upfront KYC only for resellers. DataImpulse residential, DataImpulse terms.
How do you migrate a legitimate workload? #
I would stage a migration around the workload and a recoverable configuration, rather than send old credentials or private customer data to comparison vendors. These are proposed operating steps; none was performed for this article.
- Preserve existing contracts, invoices and configuration locally; record dependencies and open obligations.
- Pause routing whose reseller or supplier provenance cannot be established; rotate old credentials privately through the appropriate account controls.
- Inventory permitted targets, data rights, geography, session persistence, assigned IP needs and expected metered traffic.
- Verify the replacement legal entity, supplier chain, customer/use-case approval, payment and recurring terms.
- Run a capped check on owned targets only after the provider terms and required permissions allow it; retain validation and rollback records.
- Move the allowed workload in stages, monitor the actual selected units and retain a rollback configuration consistent with approved service access.
For step 3, ISP versus residential proxies helps decide whether the workload needs an assigned IP or rotating household traffic.
The identity, content-right and use-case gates are grounded in the providers’ published policies, rather than an assumption that paid proxy access permits every target. Bright Data access, Bright Data AUP, Decodo licence, Webshare compliance, IPRoyal AUP, Oxylabs AUP.
Why sourcing and privacy still need checking #
Google’s January 29, 2026 IPIDEA investigation describes its findings on SDKs, consent and reseller opacity. The FBI’s March 12 guidance describes residential peer/hidden-SDK risks; those reports justify supplier scrutiny, not allegations that every residential vendor or alternative here uses malware. Google investigation, FBI guidance.
I would ask for the actual opt-in screen, supplier identities, withdrawal path, consent logs and audit scope. Buyer KYC is a different check from a peer agreeing to share bandwidth, and an IP address should not automatically be described as nonpersonal: European Commission guidance includes IP addresses among personal-data examples. Commission guidance.
Where did NetNut’s IPs go? #
Switching vendors doesn’t by itself mean switching device supply. Layer3 Intel, a company that sells IP-intelligence data, reported on July 18 that 51.27% (16.90M) of the IPs it saw on NetNut in the 30 days before July 4 were re-observed elsewhere within 14 days, and that 27.85% (9.18M) were reachable through Bright Data alone. Layer3 Intel study.
The same study found 59% of Bright Data’s exit IPs on at least one competitor, so the overlap isn’t limited to NetNut’s former IPs. That overlap is Layer3 Intel’s own measurement, not a finding of wrongdoing by any vendor, and I didn’t reproduce it. It is why I’d ask every pick on this page for its supplier documentation, not just Bright Data.
Which one should you pick? #
These picks rest on the prices, pool sizes and buyer rules I read on November 12, 2026, not on measured speed or a consent audit. Each one still needs the buyer and supplier checks above before you move traffic.
- Need a big pool and can pass company KYC? Bright Data. It advertises the largest pool on this list (400M+ residential IPs, company-reported) and publishes the strictest buyer gate, with a registered company, corporate email and human KYC required for new residential zones. Access rules.
- Want to pay as you go, no subscription? Decodo. Its $4/GB pay-as-you-go rate is the lowest pay-as-you-go price on this shortlist without a coupon, and a free 100 MB, 3-day trial lets you check the fit first (it rolls into the chosen paid plan unless you cancel). Pricing.
- Small job, or shared IPs are fine? Webshare. Its 100 shared datacenter IPs for $2.99 a month and 1 GB residential plan for $3.50 are the cheapest published plan cards I found on this shortlist, though both renew monthly. Decodo’s shared ISP rate starts lower, at $0.27/IP, but its page doesn’t say at what quantity. Datacenter, Residential.
- Want traffic that never expires? IPRoyal. Its residential traffic doesn’t expire, which suits uneven usage, but you start at $7/GB on a one-GB subscription and should confirm any service fee at checkout. Residential, Terms, §6.17.
- Want one company wallet for proxies and an unblocker? Oxylabs. Its $15/$100/$500 shared wallets cover residential and Web Unblocker, but unused credits expire at the end of each billing cycle. Pricing.
Not on my list: NetNut, because its status is unresolved in the record above, and DataImpulse and NodeMaven, because neither publishes an upfront buyer check for regular customers.
What this page does not claim #
This page does not recommend NetNut, assert a legal outcome, authorize a migration or establish a supplier’s lawful availability. No provider here has approved an account for me. The status above is dated; check the primary sources again before you act on it.
The picks above come from published prices and access rules. There is no measured performance or consent winner in this research, so complete the customer/use-case checks for your pick first.
Continue with ethical residential proxy sourcing, proxy pricing models, residential trial conditions, Bright Data pricing and the proxy provider guide for web scraping. Each addresses a separate part of the purchase rather than supplying a missing court finding.
FAQ #
What’s actually known about NetNut’s status? #
Google’s July report and the domain notice (observed October 15, still headed as an FBI seizure on November 12) are separate from Alarum’s July 2–13 issuer statements acknowledging associated-domain seizures and describing disruption, a pause and an ongoing review. Later filings through November 9 report pending lawsuits and delayed results, not restored service. Those dated company statements do not establish current service/company status or a legal outcome. Google report, Observed notice, July 2 exhibit, July 3 exhibit, July 13 exhibit.
Did Google seize NetNut? #
Google describes its own account/service and Play Protect actions. The visible domain notice attributes domain action to law enforcement, and Alarum’s July 2 statement acknowledges awareness of FBI seizures of associated domains. Neither establishes that Google seized the business or authenticates an underlying court order here. Google report, Notice, July 2 exhibit.
Which NetNut alternatives are worth a look? #
On the evidence I have: Bright Data if you need a big pool and can pass company KYC, Decodo for the lowest pay-as-you-go list price ($4/GB, no coupon), and Webshare for small or shared-IP jobs ($2.99 a month for 100 shared datacenter IPs). IPRoyal fits if you want traffic that never expires, and Oxylabs if you want one company wallet. Each still needs the buyer and supplier checks, and I hold no verified account with any of them. Bright Data, Decodo, Webshare, IPRoyal, Oxylabs.
Have you been approved by any of these providers? #
No. Published KYC or compliance policies are not completed onboarding, target approval or a supplier audit. Access, Compliance, KYC, KYC.
Can a free datacenter plan stand in for residential traffic? #
Not as an equivalent product. Webshare documents ten free datacenter proxies and one GB monthly, while rotating residential and static ISP products are distinct. Free offer, Residential, Static ISP.
Sources
54 sources, accessed to .
Official pricing, docs, changelogs and status pages 53
- Google NetNut report
- Current domain notice
- Google IPIDEA report
- FBI consumer guidance
- Personal data guidance
- Residential pricing
- ISP pricing
- Residential access
- Licence
- AUP
- Residential sourcing
- Playwright integration
- Residential pricing
- ISP pricing
- Refund policy
- Licence
- Sourcing and usage
- Security and compliance
- Rotating residential pricing
- Datacenter pricing
- Terms/refunds
- Free proxies
- Compliance checks
- Fair usage
- Static ISP product
- Residential product/pricing
- Residential sourcing
- KYC
- Terms
- AUP
- Refund FAQ
- Pawns sourcing FAQ
- Residential pricing
- Welcome credit
- General conditions
- AUP
- KYC policy
- Web Unblocker pricing
- KYC FAQ
- Alarum July 2 statement: associated-domain seizures
- Alarum July 3 statement: additional domains and partial disruption
- Alarum July 6 Form 6-K: July 4 release identification
- Alarum pause exhibit: July 4 heading and July 6 body dateline
- Alarum original issuer release: July 4 operational pause
- Alarum July 13 statement: unknown root cause and ongoing review
- IPRoyal exact residential pricing tabs
- Alarum July 22 Form 6-K: Israeli discovery and class-action motions
- Alarum August 13 Form 6-K: additional discovery motion naming NetNut Ltd
- Alarum August 27 Form 6-K: delayed first-half results
- Alarum proxy statement dated November 5 (furnished November 9): audit committee oversight of domain seizures
- Google XCPE report, November 3: Popanet C2 already taken down
- DataImpulse residential pricing
- DataImpulse terms: ID checks on request, reseller KYC
