⏱️ Reading time: 10 min
For almost a month, someone connected to the White House network pushed internet traffic through residential proxies 236 times, without anyone inside seeming to notice. The threat intelligence firm Layer3 Intel discovered it by accident, while testing a new tool that maps this anonymization infrastructure worldwide.
📑 En este artículo
The autonomous system where those exits appeared, AS2650, is registered under the Executive Office of the President of the United States, the entity that operates the White House network. The timing pattern of those 236 connections points more to a personal device used every night than to an open guest network.
TL;DR
- Layer3 Intel logged 236 residential proxy exits from the White House network between October 5 and November 3, 2026.
- Just 6 IP addresses generated those exits on 26 of the 30 days, through 28 different proxy services.
- Almost half of the traffic occurred between 5 p.m. and midnight, Eastern time: a pattern typical of personal use, not guest wifi.
- Spur and Synthient independently confirmed that those IPs are residential proxy exits.
- The real risk is a poorly secured proxy SDK: it can grant lateral access, as Synthient documented with the Kimwolf botnet.
What Are Residential Proxies
Residential proxies are services that resell access to the home internet connection of real devices: a client’s traffic goes out to the internet with that household’s IP, not its own. They’re purchased by subscription, without breaching anything, because the device already runs an SDK that resells its bandwidth.
The model is legal in most jurisdictions and massive in scale. Companies like Bright Data, IPRoyal, and Smartproxy sell rotating access to millions of residential addresses for a few dollars a month. The buyer picks a country or network, and the traffic exits with the IP of a real household, nearly indistinguishable from that of an ordinary user to most IP reputation based antifraud systems.
The tradeoff is that someone, somewhere, installed that software without fully understanding what they were giving up. It often arrives bundled inside a free app (a VPN, an ad blocker, a game) that offers some benefit in exchange for sharing background bandwidth.
What Happened on the White House Network
Layer3 Intel launched its Residential Proxy Observatory this week, a public interface that lets any researcher see, almost in real time, where residential proxy traffic is exiting around the world. While the team was reviewing the first results, it found sustained exit activity on AS2650.
Between October 5 and November 3, 2026, its enumeration pipeline exited 236 times through the White House network. Those 236 exits came from just 6 IP addresses, active on 26 of the 30 days in the period, and passed through 28 different residential proxy services: this isn’t one provider leaking data, it’s the same handful of addresses being sold through nearly three dozen brands.
To rule out a false positive, Layer3 cross-checked those addresses against other established proxy detectors, Spur and Synthient. Both independently confirm that those IPs are residential proxy exits. Access is also public: anyone can pay for a subscription and request that their traffic exit through rotating addresses from any country. Layer3 clarifies that it didn’t design probes to force the exit through that network: it found it by chance, requesting global rotating access the way any client would.
Context: How Layer3 Built the Map
The residential proxy market isn’t new, but it’s hard to audit from the outside. Unlike a datacenter, there’s no fixed IP range to block, because the addresses are real households that come and go from the network all the time. Observatories like Layer3’s, or the ones already run by Spur and Synthient, exist to reconstruct that moving map: which IP exited, through which service, and for how long.
The underlying concern isn’t new either. Synthient documented how the Kimwolf botnet infected at least 2 million devices, most of them Android with the ADB debugging service exposed, recruiting them as exit nodes for residential proxy networks without their owners knowing. The mechanism is simple: an attacker scans the internet looking for that open port, gets in, installs the proxy SDK, and that phone starts reselling its connection to whoever pays for it.
Technical Details: Why a Poorly Secured Proxy SDK Is an Entry Point
Technically, what runs on the compromised device is a lightweight daemon that opens an outbound connection to a control server, registers itself as an available node, and waits for instructions: which packet to forward, to which destination, and with which source IP. The following diagram summarizes that flow.
sequenceDiagram
participant C as Client
participant S as SDK
participant K as Control
participant D as Destination
C->>K: requests available residential IP
K->>S: assigns the task to the device
S->>D: forwards the request with its IP
D-->>S: responds
S-->>C: delivers the response
Note over S,D: the site sees the residential IP, not the client'sFrom the destination site’s perspective, the request arrives with the real IP of the household or office where that device lives, which makes it nearly indistinguishable from legitimate traffic to any IP reputation based antifraud system. The SDK doesn’t need special privileges on the device: an internet connection and permission to run in the background are enough.
| Proxy Type | When It’s Used | Advantage | Limitation |
|---|---|---|---|
| Datacenter | Fast, large-scale scraping | Cheap and fast | Easy to block by known IP range |
| Residential | Evading geolocation or reputation blocks | Looks like traffic from a real user | Depends on infected or monetized third-party devices |
| Mobile (carrier) | App verification and fine-grained geolocation testing | Carrier IP, maximum trust | More expensive and with less available volume |
How can you confirm from the outside whether a specific IP is a residential proxy exit? The public panels from Spur and Synthient let you paste an address and see its network infrastructure classification; both flag the six addresses in the White House case as residential exits. There’s no direct way, however, to verify which specific device is behind each IP or who operates it: only the proxy service provider has that information, and it’s usually not handed over without a legal order.
⚠️ Heads up: Layer3 only observes network exits, not the device or the person behind them. With this public data, there’s no way to know whether it’s a personal phone, an employee’s laptop, or an IoT device forgotten in a conference room.
The timing pattern Layer3 recorded is the most concrete clue about the human origin of the traffic. Almost half of the 236 exits occurred between 5 p.m. and midnight, Eastern time, with almost none in the early morning hours. A public guest network wouldn’t show that daily regularity; what that pattern describes is a device that stays connected to the same network, routinely, until late at night.
Impact and Analysis
The White House case isn’t an isolated finding: it’s the most striking example of a global pattern the observatory itself reveals. In Saint Helena, Ascension, and Tristan da Cunha, the British territory that includes the most remote inhabited island on the planet, the team logged 413 addresses and more than 32,000 observations, split between Starlink and the local provider, Sure Saint Helena. They also captured three observations from Antarctica, all from a Cloudflare WARP address pointing to McMurdo Station.
The list of remote locations goes on. A Starlink address in the Pitcairn Islands contributed one observation; a Norfolk Telecom address on Norfolk Island, four; and a Starlink address in Longyearbyen, Svalbard, three. The Falkland Islands added up to 388 addresses, the Chagos Archipelago 43, Tokelau 21, and South Georgia 7. The takeaway is that virtually no network is isolated enough to fall outside the reach of these services.
💭 Key takeaway: If residential proxies reach a research station in Antarctica, reaching an office in Washington doesn’t require any special capability, just a device that’s been compromised or knowingly monetized.
For a security analyst, that reach is why the case matters beyond the symbolism. If residential exit infrastructure reaches McMurdo, reaching an institutional network in Washington doesn’t require any special capability. It just requires that a device inside that network has been compromised, or that someone has knowingly monetized it.
What’s Next
Layer3 Intel says it has kept the raw activity logs and offers to share them with relevant agencies through its contact page. As of this article’s publication, there’s no public confirmation from the White House or any federal agency about the origin of the traffic, and Layer3 clarifies that its data shows network exits, not the device or the identity of whoever is behind them.
What is predictable is that the observatory will keep running, and that cases like this one (a sensitive institutional network showing up on an anonymized traffic map that anyone can pay for) will keep repeating as long as the proxy SDK business keeps depending on devices their own owners don’t fully understand.
Try it yourself: open the public panel from Spur or Synthient, paste any IP address you’re curious about, and see if it shows up classified as a residential proxy exit.
Frequently Asked Questions
What did Layer3 Intel find on the White House network?
Between October 5 and November 3, 2026, its observatory logged 236 residential proxy exits from AS2650, the autonomous system of the Executive Office of the President, coming from just 6 IP addresses.
Are residential proxy services illegal?
No, in most jurisdictions they’re a legal commercial product. The risk isn’t in buying the access, but in the fact that the device lending the IP is often infected or monetized without its owner fully understanding what they’re giving up.
How does a residential proxy SDK differ from a datacenter one?
The datacenter kind exits from servers with known, easily blocked IP ranges. The residential kind exits from real home devices, which makes it nearly indistinguishable from an ordinary user’s traffic to antifraud systems.
Can a proxy SDK grant access to an organization’s internal network?
Yes, if it’s poorly secured. Synthient documented that the Kimwolf botnet exploited the exposed ADB service on Android devices to install proxies without authorization, which in theory also enables lateral movement within the network where that device lives.
What other remote locations show up in Layer3’s observatory?
The map includes 413 addresses in Saint Helena, Ascension, and Tristan da Cunha, three observations from Antarctica via Cloudflare WARP, and isolated activity in Pitcairn, Norfolk, Svalbard, the Falklands, Chagos, Tokelau, and South Georgia.
References
- Layer3 Intel: the original report on the residential proxy activity detected on AS2650.
- Spur: public proxy and anonymization infrastructure classification service used for cross-verification.
- Synthient: research on the Kimwolf botnet and the abuse of residential proxy SDKs.
- Wikipedia: general background on how proxy servers work.
📱 Like this content? Follow @programacion on Telegram for daily tech content in Spanish: quick summaries, fresh content every day.
Featured image: Foto de Kirill Sh en Unsplash
Did it work for you? Got a different error? Say so below: questions get answered and help the next reader.
Leave a comment
0 Comments