Alarum must stabilize NetNut before domain disruptions reach revenue
The service-disruption update around NetNut's proxy network changes the Alarum debate. The burden now is to prove a return to full operation before the damage reaches key-customer usage volumes and operating costs.
Alarum received two trigger filings in two consecutive days that do not belong to another earnings recap: domains associated with NetNut were seized by the FBI, then additional domains were seized, and the company is already describing disruptions to part of its services. That changes the analytical center of gravity. Until now, investors could judge the story through gross margin, collections, NRR, and the mix of AI-related products. Now they need to add a more basic test: whether the proxy network that supports a central part of the service remains operational, and whether customers stay when the network enters a law-enforcement event. There is still no finding of wrongdoing and no formal demand directed at the company, and Alarum says neither it nor NetNut had been formally contacted by the FBI or any other governmental or regulatory authority as of the update. But this is no longer only reputational risk, because the company itself says that prolonged disruptions are likely to have a material adverse effect on operations, financial results, and its ability to provide certain services to customers.
The Trigger: From External Reports To Service Disruption
The first announcement, on July 2, 2026, was a response to reports concerning residential proxy network activity. Alarum and NetNut became aware that certain domains associated with NetNut had been seized by the FBI, and the main message was internal investigation and full cooperation with law enforcement to examine misuse of the infrastructure.
The next update, one day later, is the more material one. Alarum is no longer speaking only about domains previously seized, but about additional seized domains and existing disruptions to part of its services. The key sentence is the company's warning that if the disruptions continue for an extended period, they are likely to have a material adverse effect on operations, financial results, and the ability to provide certain services to customers.
That gap matters. A company can go through negative publicity and close it with a legal clarification. Service disruption is a different path: a customer does not need to wait for a lawsuit or formal investigation before changing usage, freezing a project, demanding alternatives, or shifting volume to another vendor.
Why This Touches Alarum's Core Model
NetNut's main product is not software sold independently of external infrastructure. Its IPPN network lets customers connect to the internet through different types of IP addresses, including ISP IPs, data-center IPs, and residential service provider IPs. A significant part of the IP pool is sourced from third-party proxy providers and ISPs around the world, from which the company leases and resells capacity. Damage to domains or to trust around the network can therefore affect both the traffic-supply side and customer demand.
That is different from ordinary regulatory background risk in data companies. Alarum had already described an operating environment in which public web-data collection, automated tools, privacy, and platform restrictions sit under legal and regulatory uncertainty. That is part of the sector. What makes the current event sharper is the move from general uncertainty to an enforcement event with seized domains and actual service disruptions.
The 2025 revenue mix shows why the test is sensitive. IPPN revenue was $29.232 million out of total revenue of $40.755 million, before Data Collection revenue of $6.117 million and datasets revenue of $4.965 million. So even as Alarum tries to widen the story into AI data infrastructure, the proxy network still sits close to the revenue center.
The Damage Path Runs Through Customers, Traffic, And Costs
The possible financial hit does not have to start with legal expenses. It can move through three faster channels.
The first is customer usage. Part of Alarum's revenue is based on actual data volume or traffic speed, alongside subscription contracts. If service disruption reduces usage or prevents delivery of certain services, the revenue effect can appear before any legal conclusion.
The second is retention. At the end of 2025, two major customers represented 15% and 12% of revenue, and the top six customers represented about 49% of revenue. In that structure, even a behavior change by a few large accounts can change the reading of the next quarters. A customer does not need to leave completely. It is enough to reduce volume, demand different terms, or move a sensitive project to a competitor.
The third is operating cost. In 2025 Alarum already carried meaningful costs for IP addresses, networks, servers, subcontractors, and third-party services. An event that requires replacement capacity, internal review, stronger controls, legal advice, or work with ISPs can pressure margin even if revenue does not fall immediately.
What Needs To Show Up Next
The first data point is the duration of the disruption. The July 3 update already says disruptions exist in part of the services. As long as there is no clear timeframe for a return to normal operation, it is hard to separate one-off noise from damage to service capability.
The second data point is customer behavior. If NRR, actual usage, revenue from major customers, or contract terms weaken after the event, the market can read the domain seizure as a business problem, not only a legal problem. If those metrics remain stable, the story looks more like a contained operating event.
The third data point is disclosure around costs and legal or regulatory implementation work. Alarum already says it is devoting substantial resources to investigating the circumstances. Later filings need to show whether those resources remain reasonable internal work or turn into a more permanent cost layer around monitoring, supplier checks, legal advice, and infrastructure changes.
Valuation also does not provide a clean answer at this stage. Before the event, the stock question was whether the business improvement could justify the market value through margin, cash flow, and revenue retention. After the event, the burden shifts to a simpler metric: whether the service returns without visible customer damage. Until that is answered, a standard sales multiple or valuation screen matters less than proof of service continuity.
Conclusion
Alarum's event is still early, but it has already crossed the threshold for a separate note: the company itself reports additional seized domains and disruptions to part of its services, not only external reporting or a theoretical review. The current conclusion is not that Alarum is under a formal enforcement process, because it says it had not received a formal contact from the authorities as of the update. The conclusion is different: a risk that used to sit in the general regulatory background has become a direct test of network availability, customer trust, and revenue quality.
If the disruption is short and customers continue using the services, the event can remain a strong but limited warning flag. If the disruption lasts, or if large customers and recurring metrics respond, the debate will move quickly from financial recovery to risk in NetNut's traffic and distribution model. In the coming quarters, investors need fewer AI slogans and more hard proof: services back online, customers not reducing usage, NRR not deteriorating, and investigation plus regulatory implementation costs that do not consume the margin.
Disclosure: Deep TASE analyses are general informational, research, and commentary content only. They do not constitute investment advice, investment marketing, a recommendation, or an offer to buy, sell, or hold any security, and are not tailored to any reader's personal circumstances.
The author, site owner, or related parties may hold, buy, sell, or otherwise trade securities or financial instruments related to the companies discussed, before or after publication, without prior notice and without any obligation to update the analysis. Publication of an analysis should not be read as a statement that any position does or does not exist.
The analysis may contain errors, omissions, or information that changes after publication. Readers should review official filings and primary sources before making decisions.