Researchers at Layer3 Intel have identified residential proxy traffic originating from the network infrastructure assigned to the Executive Office of the President. The discovery was made using the firm's Residential Proxy Observatory, a monitoring tool designed to track global anonymized internet activity. By analyzing traffic patterns, the researchers observed exit nodes operating within AS2650, the autonomous system identifier associated with the White House network.
The activity was recorded between October 5 and November 3, 2026. During this 30-day window, Layer3 detected 236 individual connections routed through the network, involving six distinct IP addresses. The researchers confirmed these findings by cross-referencing their data with external security services, including Spur and Synthient, both of which categorized the identified IP addresses as residential proxy exit points.
A residential proxy service functions by routing a user's internet traffic through third-party devices, effectively masking the user's true location and identity. Layer3 clarified that they did not specifically target the White House network; rather, the activity was captured incidentally while the firm was conducting broad, automated probes of global residential proxy infrastructure. The researchers emphasized that they have not accused any specific individual or entity within the White House of intentional misconduct.
The observed traffic patterns suggest the involvement of a device rather than a public-facing guest network. Approximately half of the recorded connections occurred between 5:00 p.m. and midnight Eastern time, with almost no activity detected during early morning hours. This temporal consistency led researchers to conclude that the traffic likely originates from a device regularly present on the network that has been compromised or inadvertently configured to act as an exit node.
The primary security concern involves the potential for unauthorized internal network access. Devices often become part of these proxy networks when users install software that includes a proxy software development kit (SDK). If these SDKs are poorly secured or contain vulnerabilities, they can facilitate lateral movement, allowing external parties who purchase access to the proxy service to reach internal systems that would otherwise be protected behind a firewall.
While Layer3 noted the theoretical risk of such an intrusion, they stated that their data is limited to identifying exit points and cannot confirm the specific device or the nature of the software installed on it. The researchers highlighted that this issue is part of a broader trend where residential proxy services have expanded into nearly every geographic region, including remote locations such as Antarctica, the Falkland Islands, and Saint Helena.
The presence of proxy traffic in highly sensitive networks underscores the risks posed by the proliferation of these services. In previous instances, such as the Kimwolf botnet, attackers leveraged vulnerabilities in exposed services—specifically Android Debug Bridge (ADB) instances—to turn millions of devices into proxy nodes. While the current situation at the White House remains unconfirmed as a malicious compromise, the researchers warned that the mere existence of these exit nodes on restricted networks creates a potential vector for exploitation.
The Executive Office of the President has not publicly commented on the findings. Layer3 maintains that their observations serve as a reminder that residential proxy networks have become pervasive, and that any device connected to a protected network could, if compromised, inadvertently expose that network to external traffic.
