← Hell World Blog··3 min read
Where Do Residential Proxy IPs Come From? Sourcing, Botnets and What to Ask (2026)
How residential, static ISP and mobile proxy IPs are normally sourced, what the 2026 NetNut seizure showed about compromised devices, how Hell World handles sourcing, and the questions to ask any provider.
Short answer: residential proxy IPs belong to real home internet connections. Legitimate networks get access to them through apps and SDKs whose users agree to share spare bandwidth. Static ISP IPs are addresses issued by internet providers and hosted in datacenters. Mobile proxy IPs come from real carrier connections. The risk is IPs taken from devices whose owners never agreed, which is what researchers alleged about NetNut before its domains were seized in July 2026.
The three common sources
| Proxy type | Where the IP comes from | What to check |
|---|---|---|
| Rotating residential | A home device running an app or SDK that shares bandwidth | Whether the device owner opted in, and can opt out |
| Static ISP | An IP block issued by an internet provider, hosted on servers in a datacenter | Which providers the addresses are registered to |
| Mobile | A device or modem on a real mobile carrier network | Which carriers, and in which countries |
What went wrong with NetNut
According to KrebsOnSecurity, security researchers linked NetNut to the “Popa” botnet, described as at least two million compromised devices, mostly smart TVs and streaming boxes, turned into proxy exit nodes. On 2 July 2026 the FBI seized hundreds of NetNut domains. The report does not mention criminal charges. Hell World stopped selling all NetNut pools (details).
How Hell World handles sourcing
- Hell World is a proxy aggregation platform. It sells 14 residential pools plus ISP, mobile, datacenter and unlimited plans from one balance.
- Three residential pools are our own: Geofast, F-Private and Goatx. The other eleven are aggregated from other proxy networks. We do not publish which wholesale suppliers sit behind each pool.
- We drop pools when the network behind them becomes a problem. NetNut and F-Netnut were removed from sale in 2026; F-Oxylab was retired at the same time.
- Static ISP: the carriers listed for each ISP pool on the ISP page are reference information; a specific carrier is not guaranteed for any order.
- Mobile: FP-Mobile, US-Mobile and ET Mobile run on real carrier connections; US-Mobile is a US-only pool.
What we require from customers
Our terms of service prohibit using the service for any unlawful purpose, and we may terminate accounts that break the terms. You are responsible for respecting the terms of the sites you access and the laws that apply to you.
Questions to ask any proxy provider
- Does the provider say how its residential IPs are obtained, at least at the level of “opt-in app or SDK”?
- Did it react publicly when a network it resold was seized or exposed?
- Does it name the internet providers behind its static ISP addresses?
- Does it have written terms that ban unlawful use, and does it enforce them?
- Can you test with a small purchase before committing?
FAQ
Are Hell World’s residential IPs from botnets? We stopped selling every NetNut pool after the seizure, and we remove pools when the network behind them becomes a problem. We do not publish the wholesale supplier behind each pool.
Which pools does Hell World operate itself? Geofast, F-Private and Goatx.
Where can I see which carriers a static ISP pool uses? On the ISP page and the US static ISP guide. Carriers are reference information, not a guarantee for a specific order.
Sources: KrebsOnSecurity, “FBI Seizes NetNut Proxy Platform, Popa Botnet” (opened 23 October 2026).
