White House Network Spotted Routing Traffic for 28 Proxy Services

What Layer3 Intel actually saw

The researchers weren't looking for the White House. They were testing a new platform that maps residential proxy activity worldwide and stumbled on traffic from AS2650, the autonomous system registered to the Executive Office of the President.

Between October 5 and November 3, 2026, Layer3 Intel recorded 236 instances of residential proxy traffic originating from the White House network. The traffic involved 28 separate proxy providers, and six IP addresses kept showing up on 26 of the 30 days observed.

The team cross-checked those addresses against public databases from Spur and Synthient, two companies that track residential proxy exits. Both flagged them as proxy endpoints.

In plain terms: someone paying a few dollars to a proxy service could route their internet requests through a device sitting on the White House's network. The researchers put it bluntly — "This is public access."

The evening pattern points to a person, not a guest Wi-Fi network

Roughly half of the connections happened between 5pm and midnight Eastern time, with almost nothing in the early morning.

That rhythm matters. A public guest network would show steadier, broader activity. Layer3 Intel instead suspects a specific device that regularly joins the White House network late in the evening and is infected with a residential proxy SDK — a software kit bundled into apps that quietly turns the host into a proxy node.

The researchers were careful about what they don't know. The data shows network exits, not devices, so they can't say whether the source is a personal phone, a guest network, or something else entirely.

The cybersecurity community's reaction was less cautious. In a Reddit thread, IT professionals swapped stories about senior leaders in both public and private organizations skipping 2FA and leaving devices wide open for convenience. One commenter guessed someone at the White House "probably installed a sketchy free app on their phone."

Why a proxy on a sensitive network is a real problem

Residential proxies aren't inherently malicious — they're used for ad verification, price monitoring and geo-testing. The danger is what happens when one runs inside a network that wasn't designed to host it.

Layer3 Intel notes that poorly secured proxy SDKs can expose internal network access and enable lateral movement. "This is how past botnets have spread," the researchers wrote. "If an SDK on this network has the same kind of flaw, anyone buying proxy access could use it to reach internal systems."

That's the scenario worth taking seriously. A proxy exit is one thing; a proxy exit with a path into the Executive Office of the President's internal network is another. The researchers stress the flaw is hypothetical until proven, but the exposure is public and cheap to buy.

The report also found proxy activity in far stranger places: Saint Helena, Ascension and Tristan da Cunha, with 413 IP addresses and over 32,000 observations across Starlink and local ISP Sure Saint Helena, plus Antarctica, the Falklands, the Chagos Islands and Svalbard. Residential proxy networks, it turns out, reach almost everywhere.

What it means for you

The White House hasn't commented on the findings, and there's no product to buy or update here. The practical takeaway for US, UK and EU readers is about the apps on your own devices: free apps that ask for unusual network permissions can turn a phone or laptop into a proxy node without the owner noticing.

If you manage devices on a corporate or public-sector network, the Layer3 Intel report is a reminder to block known residential proxy ranges at the firewall and to audit what SDKs ship inside approved apps.

Layer3 Intel's report is a snapshot, not a verdict. It shows a pattern consistent with an infected device on a highly sensitive network, and it shows how cheap and public residential proxy access has become. The White House has yet to respond — and until it does, the six recurring IP addresses are the detail to watch.