23 June 2026
Qurium has released the findings of a new technical investigation into the “Popa” residential proxy network, a system that transforms consumer devices into residential internet exit nodes and which our previous research linked to infrastructure associated with NetNut and Alarum Technologies.
To better understand how the network operates in practice, Qurium joined the Popa network and voluntarily contributed bandwidth as a residential proxy node. Over the course of the investigation, our systems recorded and analyzed more than ten million proxy requests transiting the network.
The results indicate that the traffic carried by the network extends far beyond ordinary web browsing or public data collection. Among the observed destinations and activities were advertising-attribution and affiliate-marketing systems, large-scale account-registration operations, ticketing-related services commonly associated with automated purchasing and scalping, and substantial volumes of traffic consistent with email spam campaigns.
These findings demonstrate that the network is being used to facilitate a broad spectrum of commercial activities that depend on access to residential IP addresses and the appearance of legitimate consumer-originated internet traffic.
Residential proxy providers, including NetNut, publicly state that they maintain customer-verification procedures, monitoring systems, abuse-prevention policies, and technical controls intended to prevent misuse of their networks. According to their public statements, these measures are designed to identify, restrict, and mitigate malicious or unauthorized activity.
However, the evidence collected during our investigation raises serious questions regarding the effectiveness of those safeguards in practice.
Our research challenges the simplified public narrative often associated with residential proxy services. While these networks are commonly marketed for activities such as web data collection, localization testing, or market research, the ecosystem observed during our investigation appears to support a far wider range of commercial and potentially abusive uses.
The scale and diversity of the traffic observed, combined with the apparent inability to prevent even basic categories of abuse, raise important questions about accountability, transparency, and the effectiveness of abuse-prevention mechanisms throughout the residential proxy industry.
Qurium believes these findings contribute to a growing public-interest discussion regarding the operation of residential proxy networks, the rights of device owners whose connections are monetized, and the responsibilities of companies that facilitate large-scale access to residential IP addresses.
Finally, Qurium invites the general public to dig into the 10 million requests that were recorded to see for themselves what information that regular consumer devices are collecting on behalf of commercial proxy providers. The dataset is available under https://popa.live/
Today, the U.S.-based cybersecurity and fraud-intelligence company SPUR released the report “Nearly Half of LG Smart TV Apps Are Laced with Proxies“, adding further evidence to a growing body of research showing how smart TVs are being converted into residential proxy nodes.
Forensic report: The uncomfortable truth behind 10 million Popa proxy requests
Dig into Popa with Poopa: popa.live
Press Contacts
Digital forensics
Tord Lundström <t at virtualroad.org>
Technical Director
Media
Clara Zid <info at virtualroad.org>
Outreach and Media manager
About Qurium
Qurium Media Foundation is an international non-profit organization that provides secure hosting, digital forensics, incident response, and infrastructure protection for journalists, human rights defenders, and public-interest media organizations worldwide. Its investigations focus on censorship, surveillance, digital attacks, and the infrastructures that enable them.