Layer3 finds residential proxy traffic on White House network

Layer3 Intel says it detected residential proxy traffic exiting through AS2650, a network registered to the Executive Office of the President, which hosts the White House network. Between 5 October and 3 November 2026, its observatory recorded 236 connections from six IP addresses on 26 of the 30 days. Twenty-eight residential proxy services were able to use the network. Layer3 says it found the activity by chance while requesting global rotating access through public proxy services, and did not target the network. It cross-checked the addresses with Spur and Synthient, which also classified them as residential proxy exit points.

Residential proxies route customers’ internet traffic through everyday devices, making it appear to come from those devices’ usual connections. Layer3 cannot identify the device or person behind the White House network traffic and has not alleged wrongdoing by White House staff. It notes that about half the activity occurred between 5pm and midnight Eastern time, with almost none in the early morning, and interprets this pattern as more consistent with a person’s device than public guest Wi-Fi. That interpretation is not confirmation of who or what was involved.

Layer3 warns that a poorly secured proxy software development kit could potentially provide a route into internal systems, but says it has no evidence that this happened on the White House network. Synthient has previously documented the Kimwolf botnet reaching at least 2 million devices, mostly Android devices with an exposed ADB service, through residential proxy networks. Layer3’s findings show proxy traffic exits; they do not establish that internal systems were accessed.