NextFin News - The FBI is probing whether a unit tied to Alarum helped power co-opted home internet devices used to mask malicious online activity, a development that puts a small but fast-growing Israeli web-data company under fresh legal and commercial pressure. The issue is no longer limited to abstract abuse risk. It now reaches domains, device supply, customer trust and the durability of a business model built around residential proxy infrastructure.
Alarum and its NetNut unit were informed on Thursday that some of their domains had been seized by the FBI, the company said. At the same time, Google said it had weakened the NetNut residential proxy network, also known as Popa, in partnership with the FBI and Lumen. Google said the effort reduced the available pool of devices for the proxy operator by millions and caused significant degradation to NetNut’s business operations.
NetNut offers rotating residential, ISP, mobile and datacenter proxies. The subsidiary was founded in 2017 and sits inside Alarum, which trades on the Tel Aviv exchange under the ticker ALAR.TA. That detail matters because the parent company is being judged not just on whether it can answer the law-enforcement questions, but on whether a proxy business can keep scaling once investigators and platform partners start publicly describing its infrastructure as part of a malware ecosystem.
Residential proxies are useful for legitimate tasks such as ad verification, testing and web data collection, but they are also attractive to cybercriminals because they route traffic through consumer IP addresses and obscure the source. That dual-use structure has always given the sector a reputational edge to manage. Once the FBI is involved in domain seizures and a major platform is describing a network as tied to malware command-and-control activity, that edge becomes a far more immediate commercial problem.
Alarum said it would fully cooperate with law enforcement to ensure any misuse of its infrastructure is thoroughly investigated and those responsible are held to account. That is the right immediate response, but it does not by itself resolve the harder question for shareholders: whether the company can separate a potentially tainted proxy operation from the rest of its growth story fast enough to avoid a broader business hit.
The company had been coming off a period of strong revenue growth. In the first quarter of 2026, Alarum reported revenue of $11.7 million, up 64% from a year earlier, with net profit of $0.6 million and adjusted EBITDA of $2.1 million. In the fourth quarter of 2025, revenue was $11.8 million, up 60% year over year, while full-year 2025 revenue reached $40.7 million, up 28% from 2024. Those are solid growth figures for a small company, but they also show a business that still runs on relatively modest absolute dollars.
That scale matters because small revenue bases can absorb only so much friction. If customers slow renewals, if counterparties demand extra compliance checks or if the company has to add legal and forensic costs, the effect can hit earnings quickly. In a proxy business, the commercial risk is often not just one headline event, but a cascade of smaller decisions by banks, vendors and enterprise buyers who decide they no longer want to be associated with the network.
The market’s first question will therefore be whether the current action is narrow or structural. If the FBI action is limited to a subset of domains or traffic patterns, the damage may be contained to reputation and near-term customer conversations. If it exposes broader problems in how the unit sourced devices, monitored abuse or screened customers, the issue becomes much larger. In that scenario, the problem is not only legal. It becomes a question about whether the business can keep operating in its current form.
What The FBI Action Changes
The FBI probe changes the narrative because it turns a business-category debate into an operational one. Residential proxies have always lived in a gray area: they are legitimate infrastructure, but they can also be used to disguise malicious activity. That ambiguity is manageable when the business stays out of the headlines. It becomes much more dangerous when investigators and major technology companies are both acting against the same network.
Google said the coordinated actions caused significant degradation to NetNut’s proxy network and reduced the available pool of devices by millions. That matters because the device pool is the product. Fewer usable devices means less routing capacity, weaker redundancy and less room to absorb customer demand. In network businesses, supply constraints can be as damaging as demand shocks.
It also matters that Google described the network as being used to hide and route malicious online activity, and said it disabled accounts and services used in NetNut-related malware command-and-control operations. Those details push the controversy beyond vague suspicion. They suggest an ecosystem that law enforcement and platform partners believe needs active disruption, not just monitoring.
For Alarum, the immediate challenge is to show that the parent company can ring-fence the affected operations. Investors will want to know whether NetNut is economically central or strategically peripheral, whether any revenue depends on the affected infrastructure and whether management expects any material impact on cash flow, compliance expense or customer retention.
Alarum said it would fully cooperate with law enforcement to ensure any misuse of its infrastructure is thoroughly investigated and those responsible are held to account.
That statement is necessary, but it is also only the start. The market usually waits for more granular disclosure: how much revenue is exposed, whether any contracts have been suspended, whether the company has changed customer onboarding or device-sourcing practices and whether it expects the issue to have a material effect on full-year results.
Why Residential Proxy Businesses Are So Hard To Defend
The core problem with residential proxy businesses is that they are built on an attribute that can be both legitimate and suspicious at once. Routing traffic through consumer IP addresses is useful for checking websites, validating ads and collecting public data. The same feature can also help malicious actors evade defenses. That is why the industry often faces a credibility gap even before a specific enforcement action arrives.
When a company sells infrastructure rather than end-user behavior, it can argue that it is not responsible for every downstream use. But once law enforcement says the infrastructure itself is implicated, that argument becomes harder to sustain in the court of public opinion. The company then has to prove that it had robust screening, monitoring and enforcement controls, and that any abuse was truly exceptional rather than systematic.
This is where reputational damage can become financial damage. Enterprise customers do not need a criminal indictment to walk away. Many only need enough uncertainty to justify a vendor review, a compliance escalation or a temporary pause. For a small company, even modest churn can matter.
There is also the issue of counterparties. Banks, payment processors, hosting providers and resellers often react cautiously to businesses that become linked to cyber abuse investigations. Those reactions can happen even when the company itself has not been accused of wrongdoing. The result can be a slower sales cycle, a higher cost base and more working-capital pressure.
Alarum’s recent financials show why that matters. Revenue of $11.7 million in the first quarter and $40.7 million in full-year 2025 indicates a company that is growing but still relatively small. Net profit of $1.0 million for all of 2025 leaves limited room for legal bills, compliance costs or customer losses to rise meaningfully before they show up in reported earnings.
How Much Damage Can The Business Absorb?
The answer depends on whether the current action creates a one-off dip or a longer re-rating of the company’s prospects. If the issue is confined to a narrow set of domains or a single unit, the effect could be manageable. If it undermines trust in the broader proxy offering, the damage could last much longer than the headlines.
That is why the company’s next disclosure matters so much. The market will be looking for any comment on revenue exposure, customer retention, legal reserves and remediation steps. It will also watch whether the company gives a fuller explanation of how NetNut fits into its operating model and whether the affected activity is separable from the rest of the business.
Even if revenue remains intact, costs may rise. Legal advice, forensic reviews, compliance work and customer outreach can all add expense. For a company that posted just $1.0 million in net profit last year, a modest increase in operating costs could erase a meaningful share of earnings.
There is a second-order risk as well: if customers believe the network is under active law-enforcement scrutiny, some may prefer to avoid it even if they previously had no objection. In markets built on trust, perception can move faster than formal legal outcome.
What To Watch Next
The next catalyst is management communication. Investors will want details on the domains seized, the role of the affected unit, any anticipated financial impact and whether the company expects further disruption. A vague statement would likely leave the stock vulnerable to more uncertainty; a detailed response could at least help the market separate operational risk from headline risk.
Beyond that, the broader enforcement campaign is worth monitoring. Google said the takedown effort was coordinated with the FBI and Lumen, which suggests this is part of a wider technical response rather than a one-off event. If the disruption widens, device supply and customer confidence could weaken further before the company has had time to stabilize its narrative.
The central takeaway is that the Alarum story has moved from growth-company optimism to infrastructure-risk scrutiny. The real question now is not whether the business can keep talking about proxy demand. It is whether the market still believes that a proxy network under active enforcement pressure can be cleanly separated from the rest of the company’s value.
Explore more exclusive insights at nextfin.ai.
