Residential Proxies Detected on White House Network

Layer3 Intel says its new observatory detected residential-proxy traffic exiting through AS2650, registered to the Executive Office of the President and hosting the White House network. Between October 5 and November 3, 2026, its system recorded 236 exits from six IP addresses on 26 of 30 days, involving 28 proxy services. Spur and Synthient independently classify the addresses as residential-proxy exits. The activity surfaced incidentally during broad requests for rotating proxy access, not through probes aimed at the White House. About half the observations occurred between 5 p.m. and midnight Eastern time, with almost none in the early morning. That pattern may indicate a regularly used device rather than public guest Wi-Fi, but the data does not identify the device or its user.

The concern is that proxy software installed on a device can create risks beyond anonymized internet traffic: poorly secured SDKs may expose internal networks and enable lateral movement. Layer3 Intel cites research on the Kimwolf botnet, which spread through residential proxies to millions of devices, while noting that its own observations do not establish a vulnerability or intrusion at the White House. The observatory also recorded proxy activity in remote locations, including 413 addresses and more than 32,000 observations on Saint Helena, and three observations tied to a Cloudflare WARP address associated with McMurdo Station in Antarctica. Activity also appeared in places such as Pitcairn, Svalbard, the Falklands, and the Chagos Islands. Layer3 Intel says it has preserved raw logs for relevant agencies.