Attributed metadata history
Up to 100 retained publisher events per page for 7cab3f907318322188117aa794af6418d3938f0eeb8d8f63b583bdf5fe4936e0. Withdrawals and unavailable references remain attributed to their publishers.
intelligence_src_029e2f07006b78ebcb
observed · 2026-10-12 05:29:01 UTC
available
Fingerprint: e71aa6d523741f9f527f5071fd96527dbb781bc01e36c89fd9ec28cdb29f734f
intelligence_src_029e2f07006b78ebcb
observed · 2026-10-12 05:29:01 UTC
Background Today, in coordination with the FBI, Lumen, and others, Google took action against the NetNut residential proxy network, also known as Popa. This action builds on our disruption of the IPIDEA proxy network that took place in January 2026, and is a continuation of Google’s objective to dismantle malicious residential proxy networks. Actions Taken As a part of this disruption we took the following actions: Disabled Google accounts and associated Google services used by NetNut for malware command and control (C2), which directly violates Google’s Terms of Service and Acceptable Use Policy. Shared technical intelligence on NetNut software development kits (SDKs) and backend C2 infrastructure with platform providers, law enforcement, and research firms to help drive ecosystem-wide awareness and enforcement. We ensured Google Play Protect, Android’s built-in security protection, automatically warned users and disabled applications known to incorporate NetNut SDKs, and the system will continue to protect users against future install attempts. These efforts to help keep the broader digital ecosystem safe supplement the protections we have to safeguard Android users
Fingerprint: 68c94d2bcf306ef53121f4814098a94e0c3589b890800a900e47849343fdfd66