Researchers Find White House Network Used as Proxy
Layer3 Intel identified 236 residential proxy exits tied to the Executive Office of the President's network over a 30-day period.
Updated on Nov. 5, 2026 in Cybersecurity
Layer3 Intel found 236 separate residential proxy exits from the AS2650 autonomous system, which is registered to the Executive Office of the President. The activity was recorded between October 5 and November 3 and originated from six IP addresses.
Why it matters
Residential proxy services route paying customers' traffic through ordinary devices on home networks, and the discovery shows such traffic can appear on a federal government network. The finding raises questions about how the network is being accessed and what traffic is passing through it.
Layer3 Intel found 28 residential proxy services capable of routing traffic through the network, with activity appearing on 26 of 30 days examined. Available data does not show which services were used or what traffic was carried.
The players
Layer3 Intel
Layer3 Intel is a threat intelligence firm that operates a Residential Proxy Observatory tracking residential proxy networks.
The details
Layer3 Intel encountered the activity while requesting access through globally rotating residential proxy services. Researchers found the exits were concentrated in the evening hours, with roughly half occurring between 5 p.m. and midnight Eastern time.
Timeline
October 5, 2026: Start of the 30-day period of proxy activity examined.
November 3, 2026: End of the 30-day period of proxy activity examined.
November 5, 2026: Article published reporting the findings.
Threat Tracking
Layer3 Intel's Residential Proxy Observatory is the source of this finding, which documents how residential proxy services route traffic through ordinary home devices. The observation adds a government network to the set of networks the Observatory has identified as affected.
Residential proxy services use ordinary home devices to carry paying customers' traffic, so people with devices on such networks may be unknowingly part of that traffic. Government and private networks alike can be affected when those devices connect to them.
The takeaway
Residential proxy networks can route traffic through devices that owners do not control, and that traffic can reach sensitive networks. Checking which devices are connected to a home network is a practical step for reducing exposure.
Further reading
Explore more Cybersecurity coverage for context on how residential proxy networks are being tracked.
