Researchers at Layer3 Intel have identified residential proxy activity originating from the White House network. Residential proxy services function by selling access to everyday internet-connected devices, allowing customers to route their web traffic through these devices to mask their true location and identity. This discovery was made using a new Residential Proxy Observatory, a tool designed to provide a global view of anonymized internet activity and proxy infrastructure.
Between October 5 and November 3, 2026, the research team's enumeration pipeline recorded 236 separate exit events from the White House network (registered as AS2650). These exits were distributed across six different IP addresses over a 30-day period. The data showed that 28 separate residential proxy services were successfully routing traffic through this network. To confirm the findings, the researchers cross-referenced these addresses with other detection services, which independently identified the IPs as residential proxy exits. The team noted that this activity was not a result of targeted probing; rather, it was caught by chance while requesting global rotating access through public proxy services.
The researchers highlighted a specific pattern in the data: most of the activity occurred during the evening hours (Eastern Time), with a significant concentration between 5 p.m. and midnight. This timing suggests the traffic originated from a specific device used by an individual rather than a public guest Wi-Fi network. The primary concern is that a device on the internal network may be infected with a proxy Software Development Kit (SDK). Past research has demonstrated that poorly secured proxy SDKs can create vulnerabilities that allow external actors to bypass firewalls and move laterally within a private network. While the researchers can confirm the existence of the proxy exits, they cannot identify the specific device, the individual behind it, or the exact method of infection on the White House network. This discovery is part of a broader trend where residential proxies have been detected in extreme locations, including Antarctica and the remote islands of the South Atlantic, illustrating the global reach of this infrastructure.