Residential proxy traffic was detected exiting the White House network 236 times over 30 days, according to Layer3 Intel, the security firm behind a new Residential Proxy Observatory. The activity ran from October 5 to November 3 on AS2650, the network registered to the Executive Office of the President, and passed through 28 public proxy services.
The finding matters because residential proxy services sell access to ordinary devices, routing customers' traffic so it appears to come from that device's home network. Layer3 Intel says it did not target the White House on purpose: its researchers spotted the exits by chance while requesting global rotating access through public proxy services.
How the White House proxy exits were found
Layer3 Intel launched its Residential Proxy Observatory earlier that week as an interface for tracking residential proxy and anonymized internet activity worldwide. While reviewing it, the team noticed exit activity on AS2650. To rule out a fluke, it checked the addresses against Spur and Synthient, two other residential proxy detection services. Both independently identify the addresses as residential proxy exits, according to Layer3 Intel.
The company stresses that its data shows the exits, not the device or the person behind them. Anybody can buy this kind of access by signing up to a public residential proxy service, paying a few dollars and sending requests through it.
Timing pattern suggests an infected device, not guest Wi-Fi
The activity clusters in the evening, Eastern time. About half of the exits fall between 5 p.m. and midnight, while almost none happen in the early morning. Layer3 Intel reads that pattern as a person rather than a public guest Wi-Fi network: someone regularly on the White House network late into the evening, with a device running an infected proxy SDK.
