Residential proxies detected on White House network by researchers

Security researchers at Layer3 Intel have discovered residential proxy exit activity originating from the network infrastructure of the White House. The finding sheds light on how deeply proxy networks have penetrated critical government and corporate environments.

• The proxy enumeration pipeline exited through the White House network 236 separate times.
• A total of 28 distinct residential proxy services were able to route traffic through this network.
• Most activity occurs during evening hours, suggesting regular individual usage.
• Data points toward a device infected with a proxy SDK rather than public guest Wi-Fi.

Discovery through the proxy observatory

While evaluating their newly launched Residential Proxy Observatory, researchers noticed traffic exiting through AS2650, an autonomous system registered to the Executive Office of the President. Independent verification through public IP context providers such as Spur and Synthient confirmed that these addresses function as residential proxy exits.

Access to this type of routing is publicly available to anyone willing to pay a few dollars for a commercial proxy subscription. The researchers emphasized that they did not target the White House network intentionally, but rather stumbled upon it during routine global monitoring of rotating proxy infrastructure.

Behavioral patterns and potential risks

An analysis of the traffic timestamps revealed that roughly half of the activity takes place between 5 p.m. and midnight Eastern time, with virtually no activity in the early morning hours. This daily pattern strongly suggests the presence of a specific user regularly connected to the White House network late into the evening, whose personal device happens to be running an infected proxy SDK.

Previous security studies have demonstrated that poorly secured proxy SDKs can facilitate lateral movement within internal networks, a mechanism frequently exploited by botnets like Kimwolf to infect millions of devices. If a device on a sensitive network like the White House contains such a vulnerability, malicious actors purchasing proxy access could theoretically probe internal systems.

Global implications of proxy proliferation

The White House is not the only surprising location tracked by the observatory. Researchers also identified residential proxy activity in some of the most remote and isolated places on Earth, including Antarctica, Svalbard, and isolated South Atlantic territories, proving that proxy networks now cover virtually every corner of the planet.

For cybersecurity professionals, this incident underscores the importance of strict endpoint security and application auditing. Ensuring that employee devices do not inadvertently include rogue proxy SDKs is essential for preventing unauthorized internal network access and maintaining robust organizational security.