Security researchers have found that 28 residential proxy services were able to route internet traffic through IP addresses assigned to the White House network, potentially allowing paying customers to make online requests that appear to originate from the Executive Office of the President. Layer3 Intel recorded 236 proxy exits from six addresses between October 5 and November 3, with activity on 26 of those 30 days. The findings show proxy access from the network, not a confirmed breach of White House systems.
In a November 4 report, Layer3 said its Residential Proxy Observatory identified the traffic on AS2650, a network registered to the Executive Office of the President. The company said the observations came from ordinary requests through public rotating proxy services rather than a targeted investigation. It also checked the addresses against other residential-proxy detection services, including Spur and Synthient.
The activity was concentrated between 5 p.m. and midnight Eastern time. Layer3 said that pattern could point to a person using a device on the network rather than a public guest Wi-Fi connection, but stressed that its data could not identify the device or the person behind the traffic. The company said anyone could obtain access through a public proxy provider by signing up and paying a small fee.
The Verge reported on November 6 that Synthient had also observed Windows 10 and Windows 11 devices on the network communicating with proxy providers including Geonode, Infatica and Mellowtel. Synthient suggested that the watch-party app Rave could be connected to the activity because it includes multiple proxy software development kits, but that link has not been confirmed. KrebsOnSecurity reported that the White House had not immediately responded to a request for comment.
Residential proxy services route a customer’s internet requests through another person’s or organization’s connection, making the traffic appear to come from that IP address. The services have legitimate uses such as ad verification and quality testing, but the FBI has warned that criminals also use them to mask locations, evade security filters and carry out account takeovers. Its March 12, 2026 alert said proxy networks can be built through app SDKs, VPNs with hidden terms, compromised internet-connected devices and malware.
The same technology has appeared in consumer devices. Researchers found residential-proxy software in some Samsung Smart TV apps, while Google said the XCPE botnet used infected Android TV boxes for residential proxy services. The Register reported that Layer3 founder Sergiy Usatyuk warned poorly secured proxy SDKs could potentially provide a route into internal networks, although Layer3 said it could not determine whether that happened at the White House.
Layer3 said it had preserved raw logs of the activity and was willing to share them with relevant agencies. The company said its findings showed traffic exiting through White House network addresses, not evidence that attackers had accessed internal government systems.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
