Security firm detects residential proxy traffic exiting the White House network
Cybersecurity company Layer3 Intel says its new monitoring platform spotted residential proxy traffic leaving through the US presidential administration's network. The firm believes it may point to an infected device on that network.
Cybersecurity company Layer3 Intel reports that it detected residential proxy activity on the White House network in the United States between October 5 and November 3, 2026. Residential proxy services sell access to ordinary people's devices so that customers' traffic appears to come from that device's network. The finding matters because an infected device inside a government network could, in theory, offer a path to internal systems.
What was found
Researchers noticed the activity while browsing their newly launched Residential Proxy Observatory, a tool that gives a global view of residential proxy and anonymized internet activity. It was tied to autonomous system AS2650, registered to the Executive Office of the President, the federal agency that hosts the White House network.
Over the period:
- traffic exited through the network 236 times;
- this came from 6 addresses on 26 of the 30 days;
- 28 separate residential proxy services were able to exit through it.
Other detection services, Spur and Synthient, independently identify the addresses as residential proxy exits. Layer3 Intel says anyone can get such access by paying a few dollars to a public proxy service, and that it did not deliberately target this network.
Possible risks
About half of the activity falls between 5 p.m. and midnight Eastern time, with almost none in the early morning. The company says this suggests a person with an infected device rather than a public guest Wi-Fi network, though the data shows only the exits, not the device or the person.
Earlier research has shown that poorly secured proxy software kits can allow access to internal networks. Synthient documented that the Kimwolf botnet reached at least 2 million devices this way.
Activity in remote places
Proxies were also recorded in Saint Helena, Ascension and Tristan da Cunha (413 addresses, over 32,000 observations), the Falklands (388 addresses), and in Antarctica, Svalbard and Pitcairn. Layer3 Intel says it has backed up the raw logs and is willing to share them with relevant agencies.
