Researchers at Layer3 Intel detected residential proxy activity on the White House network while testing their newly launched Residential Proxy Observatory, a tool designed to track anonymized internet activity globally.
Between October 5 and November 3, the team observed 236 separate residential proxy exits from AS2650, the autonomous system registered to the Executive Office of the President. These exits originated from 6 addresses across 26 of the 30 days monitored, involving 28 different residential proxy services.
Residential proxy services work by selling access to everyday devices, allowing customers to route internet traffic through them so it appears to originate from those devices’ networks. The researchers verified their findings by cross-referencing the identified addresses with other proxy detection services, Spur and Synthient, which independently confirmed them as residential proxy exit points.
According to Layer3 Intel, this activity was discovered passively—not through targeted investigation. The researchers found it by chance while requesting global rotating proxy access through public services available to anyone willing to pay a few dollars.
What makes the pattern noteworthy is its temporal distribution. About half of the proxy activity occurred between 5 p.m. and midnight Eastern time, with minimal activity in early morning hours. This schedule suggests human behavior rather than automatic network traffic, indicating that a device on the White House network may be infected with a proxy software development kit (SDK).
The concern centers on security vulnerabilities. According to Layer3 Intel, poorly secured proxy SDKs can allow internal network access and lateral movement—a technique past botnets have exploited. The researchers cited the Kimwolf botnet as an example, which spread through residential proxy networks to reach at least 2 million devices, primarily Android devices. If the White House network’s infected device contains a similarly flawed SDK, anyone purchasing proxy access could potentially reach internal systems.
The Residential Proxy Observatory also revealed that such proxy infrastructure extends to Earth’s most remote locations. The researchers documented 413 addresses and over 32,000 observations in Saint Helena, Ascension, and Tristan da Cunha—territories including the world’s most remote inhabited island. Three observations came from Antarctica, specifically from McMurdo Station via a Cloudflare WARP address. Other remote regions with detected activity include Pitcairn, Norfolk Island, Svalbard, the Falklands, the Chagos Islands, Tokelau, and South Georgia.
Layer3 Intel’s findings demonstrate that residential proxy infrastructure has become globally pervasive, reaching even the planet’s most isolated locations.
Key facts
- 236 residential proxy exits detected from White House network (AS2650) between October 5 and November 3
- Activity came from 6 addresses across 26 days, involving 28 different proxy services
- Most activity (about 50%) occurred between 5 p.m. and midnight Eastern time, suggesting an infected device rather than network traffic
- Poorly secured proxy SDKs can allow internal network access and lateral movement according to researchers
- Residential proxy activity was also detected in extremely remote locations including Antarctica and Saint Helena