Layer3 Intel reported that the White House network, registered to the Executive Office of the President as AS2650, served as an exit point for residential proxy services. The firm's proxy enumeration pipeline exited through AS2650 236 times between October 5 and November 3. The exits came from six addresses on 26 of those 30 days, and 28 separate residential proxy services offered the route.
Residential proxy services sell access to everyday devices, letting customers send traffic through them so it appears to come from that device's network. Layer3 said anyone can buy this access through a public service. The firm said it did not target the network. Its staff found the activity while reviewing the company's Residential Proxy Observatory. The firm checked the addresses against other proxy detection services.
Layer3 said about half of the traffic falls between 5 p.m. and midnight Eastern time. The company believes this pattern points to "someone regularly on the White House network late into the evening, whose device is infected with a proxy SDK." Layer3 said its data shows only the exits, not the device or the person using it.
Security researcher Matt Johansen posted on X that someone at the White House between 5 p.m. and midnight "has some compromised devices. Or at least some that are providing residential proxy access to botn