In a surprising discovery, Layer3 Intel researchers have found that 28 residential proxy services are renting out IP addresses associated with the White House network. This revelation means that anyone with a modest budget could potentially route their web traffic through this prestigious network. The activity was observed over a month-long period, from October 5 to November 3, 2026.
Investigating the Proxy Network Activity
The team at Layer3 Intel identified this activity while utilizing their Residential Proxy Observatory, a tool designed to monitor proxy and hidden internet activities globally. The traffic originated from AS2650, a network block officially registered to the Executive Office of the President. Within 30 days, the researchers documented 236 instances where traffic exited through this network, occurring on 26 out of the 30 days.
Layer3’s request for rotating global access through various proxy services inadvertently revealed the White House IP addresses. This finding was corroborated by Spur and Synthient, firms specializing in proxy detection, which also recognized these addresses as proxy exits. This consistent identification suggests that the presence of these addresses is not a mere anomaly.
Understanding Residential Proxy Risks
A residential proxy operates by routing web traffic through a legitimate home or office internet connection, making it appear as if it is coming from a regular user. Often, device owners are unaware of this usage, as hidden software within apps or inexpensive devices can sell bandwidth without consent. The normal appearance of these addresses often allows them to bypass simple blocklists.
Analysis of the activity shows that approximately 50% occurred between 5 p.m. and midnight Eastern time, with minimal activity in the early morning hours. Layer3 Intel speculates that this pattern aligns with one individual using the network during the evening, rather than a public Wi-Fi setup. It is likely caused by a personal device running proxy software, though the specific device or user remains unidentified.
Implications and Prevention Strategies
The risk associated with this proxy activity is significant, as compromised proxy software can allow unauthorized access to internal networks. Previous research by Synthient on the Kimwolf botnet illustrates how such vulnerabilities can be exploited, impacting over 2 million devices primarily through Android boxes with open debug services. These threats can extend to workplaces, where a single compromised device may expose critical network infrastructure.
Layer3 Intel’s findings extend beyond the White House, with 413 addresses and over 32,000 observations in remote regions like Saint Helena, Ascension, and Tristan da Cunha, as well as smaller counts in other isolated locations. The firm plans to share its raw data logs with relevant authorities to aid in preventive measures.
To combat these threats, network teams are advised to scrutinize DNS logs for known proxy domains, assess apps and browser add-ons on work devices for proxy code, and prevent low-cost Android devices from accessing sensitive networks. Disabling unnecessary Android debug services is also recommended to enhance network security.
