White House network addresses rented through 28 proxy services
Original title: Researchers Discover White House Network IP Available for Rent Through 28 Proxy Services
Layer3 Intel logged 236 exits from six Executive Office addresses on 26 of 30 days from October 5 to November 3.
Layer3 Intel says 28 residential proxy services rented addresses on AS2650, a block registered to the Executive Office of the President. The team was not targeting that network; rotating global proxy requests returned the addresses on their own. Spur and Synthient also list the addresses as exits. Researchers suspect one personal device running a proxy kit, but the logs show only exits.
Unconfirmed: Layer3 Intel has not identified the device or person and calls a personal proxy kit the most likely cause.
- Activity ran from October 5 to November 3, 2026.
- Exits came from six addresses on 26 of the 30 days.
- About half of the activity fell between 5 p.m. and midnight Eastern.
- Spur and Synthient also list these addresses as proxy exits.
- Layer3 Intel saved the raw logs and will share them with agencies.
Impact: Outsiders can route traffic through White House network addresses.
- 1.Check DNS logs for known proxy domains.
- 2.Review apps and browser add-ons on work devices for proxy code.
- 3.Keep low-cost Android devices off sensitive networks and disable unused debug service.
- ATT&CK
- T1090 Proxy
- Organizations
- Layer3 IntelSpurSynthient
From the original article
3 min read at cybersecuritynews.com
Researchers at Layer3 Intel found that 28 residential proxy services rent addresses on the White House network. Anyone with a few dollars could send web traffic through them. The activity ran from October 5 to November 3, 2026.
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.