Proxy-detection firm Layer3 Intel says it routed traffic out through the White House's own network 236 times between October 5 and November 3, simply by buying access to commercial residential proxy services. In a November 4 post, the company says the exits came from six addresses on AS2650, a network it says is registered to the Executive Office of the President, and that 28 different proxy services could use them on 26 of the 30 days it observed.
Why it matters: a residential proxy exit means some device on that network is relaying strangers' internet traffic, usually because an app, browser extension or SDK on it quietly enrolled it in a proxy pool. Anyone paying a few dollars could have had their traffic appear to come from inside the network, according to Layer3. The bigger worry is what else a badly written proxy SDK lets through.
What Layer3 found
| Metric | Layer3's figure |
|---|---|
| Observation window | Oct 5 – Nov 3, 2026 (30 days) |
| Proxy exits through the network | 236 |
| Distinct addresses | 6 |
| Days with activity | 26 of 30 |
| Proxy services that could use the exits | 28 (not named) |
| Timing | About half between 5 p.m. and midnight ET; almost none early morning |
Layer3 says it wasn't targeting the White House. The addresses turned up "by chance" while its pipeline was requesting global rotating access from public proxy services for its new Residential Proxy Observatory. It says two other detection services, Spur and Synthient, also label the addresses as residential proxy exits, though RuntimeWire notes it reported that as Layer3's claim and didn't confirm it independently.
What it doesn't prove
Layer3 is careful on this point, and so should readers be:
- It's exits, not a device or a person. Layer3 says its data shows where traffic left the network, not which device or who used it. Its guess is that someone who regularly uses the network in the evening has a device with a proxy SDK on it, but that is an inference from the timing.
- No sign of a breach. RuntimeWire found nothing showing proxy customers reached internal systems. Layer3 raises that only as a risk, pointing to earlier research on the Kimwolf botnet, which Synthient says reached at least 2 million devices, where flawed proxy SDKs allowed access into the networks behind them.
- Could be one device or several. RuntimeWire points out that 28 services could reflect one device resold through many brands, and that network address translation means one address can hide many devices.
- Details withheld, no response. Layer3 hasn't published the six addresses or named the services. Neither its post nor RuntimeWire's report includes comment from the White House or the EOP. Layer3 says it has backed up its raw logs and will share them with relevant agencies on request.
Pinning down the device would take internal records outside researchers can't see, such as DHCP and NAT logs and endpoint telemetry, RuntimeWire notes.
Why this keeps happening
Residential proxy networks pay app developers to embed SDKs that turn users' phones, PCs and TV boxes into exit nodes, and sometimes skip the "pay" and "consent" parts entirely. Earlier this week Google said it had dismantled XCPE, a botnet that a TV box maker allegedly built into 1.3 million Android devices partly to sell as proxy capacity. The White House finding is a reminder that the same software lands on networks that are supposed to be tightly managed.
What to do on your own network
- Check your public IP. Layer3's "Is my network a residential proxy?" page checks your current address against what it says is a database of 70 million-plus live proxy IPs and shows which proxy networks were seen using it. Run it from home, office and guest Wi-Fi.
- Hunt the usual culprits. Layer3 lists free VPNs, "share your bandwidth" apps, browser extensions and SDKs inside mobile apps as common ways devices get enrolled. Remove anything you don't recognise, and treat cheap Android TV boxes with suspicion.
- For admins: keep personal and unmanaged devices on a separate network segment from anything sensitive, and watch for steady outbound connections to known proxy-provider infrastructure. If an address is flagged, expect more captchas and blocked logins until it's cleaned up.
