The Popa botnet, a large-scale Android-based botnet, is linked to NetNut, a residential proxy service operated by Alarum Technologies. It uses compromised consumer TV boxes to relay traffic for advertising fraud, account takeovers, and data scraping. The botnet is associated with the Vo1d malware campaign and leverages domains like gmslb.net, safernetwork.io, and ninjatech.io for control.
| Vendor | Product | Versions |
|---|---|---|
| alarum | netnut | — |
