Between October 5 and November 3, 2026, Layer3 Intel recorded 236 residential-proxy exits through six public IP addresses associated with AS2650, the autonomous system registered to the Executive Office of the President. Traffic reached those exits through 28 separate residential-proxy services. Spur and Synthient independently classified the six addresses as residential-proxy exits, corroborating the classification of those public addresses.
What a Residential Proxy Actually Does
A residential proxy disguises internet traffic as ordinary consumer activity by routing it through a device’s home or office connection.
A residential proxy routes internet traffic through ordinary consumer devices, making requests appear to originate from that device’s connection. In some cases, proxy software is bundled into mobile app SDKs without meaningful disclosure to the device owner, effectively enrolling the device as a node in a surveillance app commercial proxy network.
How Layer3 Intel Encountered the Addresses
The six addresses surfaced not through targeted investigation but through routine use of public proxy services.
Layer3 Intel found these addresses while requesting rotating global proxy access through public commercial services, not by targeting the White House network. The six addresses appeared during that process, which is itself a notable detail about how widely distributed this infrastructure has become.
What the Traffic Pattern Suggests, and What It Does Not Prove
Layer3 Intel identified a timing pattern it considers more consistent with a regularly used device than with always-on guest infrastructure, though this remains an inference.
Roughly half of the observed activity occurred between 5 p.m. and midnight Eastern time, with very little traffic in the early morning hours. Layer3 Intel interpreted that pattern as more consistent with a regularly used device than with continuously available guest Wi-Fi infrastructure. The company presents this as a reasonable inference, not a confirmed identification of any specific device or user.
The Security Concern Behind the Data
Residential proxy SDKs can create pathways for lateral movement within a local network, a risk Synthient documented at scale with the Kimwolf botnet.
Synthient reported that the Kimwolf botnet exceeded 2 million infected devices, primarily Android devices with exposed Android Debug Bridge services, and used residential proxies as part of its infection chain. Poorly secured proxy SDKs can create pathways for lateral movement within a local network. Traffic exiting through a compromised node could potentially be used to probe internal systems, establishing a plausible concern for any sensitive network where this activity appears.
Where the Evidence Stops
The confirmed finding covers proxy exits through public addresses associated with AS2650; it does not establish a device, an owner, or any access to internal systems.
Residential-proxy traffic exited through public addresses associated with the White House network’s autonomous system across 26 of the 30 measured days. What the data does not establish is equally important: the identity of the device, its owner, the responsible software, whether any device was infected, and whether any actor accessed internal systems all remain unknown. Describing this situation as a confirmed breach or compromise of the White House network is not supported by the available evidence.
A Wider Pattern Worth Noting
Layer3 Intel’s observatory found residential-proxy activity across some of the world’s most remote and specialized networks during the same measurement period.
More than 32,000 observations were logged in Saint Helena, Ascension, and Tristan da Cunha. Three exits appeared from Antarctica through a Cloudflare WARP address pointing to McMurdo Station. Additional activity was recorded in Pitcairn, Norfolk Island, the Falkland Islands, and Svalbard, reinforcing the conclusion that residential-proxy infrastructure extends well beyond ordinary consumer broadband environments and making its appearance on a government autonomous system worth scrutiny rather than certainty.
