The Silent Hijack: How Millions of Consumer Devices Power the Global AI Scraping Economy

For the past four years, a massive, clandestine network known as the "Popa" botnet has been quietly commandeering millions of consumer Android TV boxes. Rather than launching the headline-grabbing distributed denial-of-service (DDoS) attacks typically associated with malicious botnets, Popa operates with a more subtle, persistent purpose: it turns domestic hardware into a global relay station for internet traffic.

Security researchers from multiple firms have now linked the infrastructure of this sprawling botnet to NetNut, a residential proxy provider operated by the publicly traded Israeli firm Alarum Technologies Ltd [NASDAQ: ALAR]. This revelation highlights a growing, uncomfortable symbiosis between the thriving artificial intelligence industry, which demands vast amounts of scraped data, and a shadowy ecosystem of hardware exploitation.

The Anatomy of the Popa Botnet

Popa is not a traditional piece of malware designed to destroy or encrypt data. Instead, it acts as a persistent communication layer, designed to register a device, maintain long-lived encrypted tunnels, and allow third parties to route internet traffic through the user’s home network.

Experts categorize Popa as a plugin component of the broader "Vo1d" botnet—a large-scale campaign targeting unofficial, inexpensive Android-based TV streaming boxes. These devices, sold under thousands of varying brand names at major e-commerce outlets, are marketed as low-cost solutions for streaming subscription content. However, as the FBI and security researchers have repeatedly cautioned, these devices often arrive pre-installed with firmware that secretly transforms the user’s home internet connection into a "residential proxy."

Once the device is plugged into a power source and connected to a local network, it becomes an open relay. This allows any customer of the proxy provider—ranging from legitimate researchers to malicious actors—to mask their traffic behind the IP address of an unsuspecting homeowner.

A Chronology of Discovery and Disruption

The origins of Popa remained largely obscured until 2025, when researchers at the Chinese security firm XLAB identified at least nine domain names used to register and direct the activities of compromised hardware.

The investigation intensified in May 2026, when the security firm Qurium identified those same domains while analyzing a series of disruptive data-scraping events. The scraping, which targeted organizations hosted by Qurium, was distributed with surgical precision across more than 1.4 million unique internet addresses.

Qurium’s analysis linked these activities to several dozen domains, including gmslb[.]net, safernetwork[.]io, tera-home[.]com, and ninjatech[.]io. These domains were found embedded within various pirated or modded streaming applications, such as CRICFy, DooFlix, Sprozfy, RTS Tv, Flixoid, CyberFlix, and Rapid Streamz.

While a coalition of Google, HUMAN Security, and Trend Micro successfully seized many of these control domains in July 2025 as part of the "Badbox 2.0" disruption, the botnet proved resilient. Within days of the takedown, new domains were registered. Among the survivors was ninjatech[.]io, a domain founded by Moishi Kramer, who currently serves as the vice president of research and development at NetNut.

Supporting Data: The Scale of the Intrusion

The sheer volume of devices involved in the Popa ecosystem is staggering. Chris Formosa, a senior lead information security engineer for Black Lotus Labs (a division of Lumen Technologies), estimates that Popa averages between 1.5 million and 2.5 million distinct IP addresses daily.

"What makes Popa especially dangerous is how widely used NetNut is for reselling," Formosa explains. "These IPs appear in tons of different services all over the ecosystem, which makes it one of the most problematic and dangerous proxy botnets on the market."

Jérôme Meyer, a researcher at Nokia Deepfield, suggests the actual population of the botnet may be even higher. By monitoring a subset of relay nodes, Meyer observed that each node could handle between 35,000 and 60,000 concurrent clients, leading to a massive volume of traffic that threatens to overwhelm network infrastructure.

Official Responses and Denials

In response to inquiries regarding the findings, Moishi Kramer stated that Ninjatech ceased operations five years ago when it sold the Popa SDK. Kramer maintains that the software was designed for bandwidth sharing with user consent and that the original developer has no control over how third parties have rebranded or deployed the code today.

"I didn’t register the June 2025 domains you mention, and I don’t know who did," Kramer said. "I have no control over, or visibility into, that infrastructure."

Alarum Technologies, the parent company of NetNut, issued a robust denial, labeling the reports from Synthient and Qurium as containing "demonstrably inaccurate assertions and flawed deductions." The company stated that their SDKs are designed for "lawful and responsible" bandwidth-sharing and that they perform "know your customer" (KYC) checks to prevent misuse.

However, independent research from the proxy-tracking firm Spur contradicts this claim. According to Spur, NetNut does not require meaningful corporate verification, allowing individuals to purchase access to residential IP pools using little more than a burner email address and cryptocurrency. "The ‘verified corporations only’ claim is simply marketing," Spur concluded.

Implications: The AI Scraping Economy

The rise of the Popa botnet is inextricably linked to the global gold rush for AI training data. Modern AI models, including large language models (LLMs), require continuous, mass-scale harvesting of text, images, and video.

Websites frequently block requests originating from data centers to prevent automated scraping. By routing this activity through residential IP addresses—like those of a TV box in a living room—scraping bots can bypass these protections, appearing as legitimate home internet users.

This aggressive scraping has reached a breaking point. Organizations, libraries, and academic repositories are reporting frequent service disruptions as they struggle to differentiate between legitimate traffic and the relentless, investor-funded bot armies of the AI industry. A recent survey by the Confederation of Open Access Repositories (COAR) found that 90% of respondents encounter aggressive bots at least once a week, often leading to total service outages.

The Broader Threat to Home and Workplace Security

The threat is no longer confined to low-cost streaming boxes. Research from Spur and Infoblox indicates that the proxy SDKs underpinning these botnets have permeated the mainstream app ecosystem.

Spur discovered that approximately 42% of apps in the LG webOS store and over 25% of apps on Samsung’s Tizen platform contain code that turns a television into an always-on residential proxy node. This means that a simple game or screen-saver app installed on a family TV could be monetizing the household’s bandwidth to help train a corporate AI model without the owners ever realizing it.

The danger extends into the corporate world. Infoblox found that 65% of its customer base—including pharmaceutical, food and beverage, banking, and government entities—was querying residential proxy-related domains. This represents a significant security risk: if a malicious actor uses an employee’s home device to attack a third party, the source of the attack will trace back to the company’s network, creating massive legal exposure and reputational damage.

Conclusion: A Call for Oversight

The Popa botnet is a symptom of a larger, systemic failure in the digital economy. As companies prioritize the "AI scraping economy" over the integrity of the consumer network, the security of millions of home and enterprise devices remains compromised.

Security experts emphasize that current disclosure methods—such as burying proxy consent in dense, unreadable privacy policies navigated by TV remotes—are insufficient. Without a fundamental shift in how proxy SDKs are regulated and permitted within consumer operating systems, the "smart" devices in our living rooms will continue to function as the silent, unconsenting backbone of the next generation of artificial intelligence. As industry watchdogs and policymakers begin to take notice, the question remains: will the platforms themselves step up to block these rogue nodes, or will the "Popa" model continue to scale until the entire residential internet becomes a commodity for the highest bidder?