Layer3 Finds Residential Proxy Traffic Exiting White House Network

Residential proxy traffic has exited through the White House network on 236 occasions over a 30-day period, with 28 separate residential proxy services able to route traffic via six of its addresses, according to Layer3 Intel’s findings. Layer3, a New York-based residential proxy detection firm, published the research on 4 November 2026 and said the addresses sit in AS2650, the autonomous system registered to the Executive Office of the President.

The exits were recorded on 26 of the 30 days between 5 October and 3 November, after Layer3 cross-checked the addresses against public lookup pages from proxy detection services Spur and Synthient, which independently identified them as residential proxy exits.

Layer3 reported that anyone could route traffic out through the same addresses by subscribing to a public residential proxy service and paying a few dollars. About half of the activity occurred between 1700 and 2400 Eastern Time, with almost none in the early morning, which Layer3 said suggested a single device rather than a public guest Wi‑Fi network.

The firm noted that “Our data shows the exits, not the device or the person behind them.” Layer3 told Infosecurity that the most recent activity was recorded in the evening of 4 November and hoped it would stop soon. No compromise of White House systems was reported, but Layer3 said it has backed up the raw logs and shared their findings with a US federal agency.

Past research has shown that poorly secured proxy SDKs can permit access to internal networks and lateral movement, with examples such as the Kimwolf botnet affecting millions of devices via residential proxy networks. Layer3 suggested that if an SDK on the White House network carried a similar flaw, unauthorised proxy access could reach internal systems. Infosecurity states it has contacted the White House for comment.