Residential proxies detected on White House network
Original title: Residential Proxies Detected on White House Network
Proxy exits recorded 236 times from six addresses October 5 to November 3, 2026, raising lateral movement risks via SDK flaws.
Residential proxy exit activity detected on AS2650, the White House network run by the Executive Office of the President. The activity occurred 236 times from six addresses on 26 of 30 days, involving 28 proxy services. Most traffic happened in the evening Eastern time, pointing to a possibly compromised device. Researchers note that proxy SDK vulnerabilities could enable internal network access and lateral movement, mirroring past botnet infections.
Unconfirmed: Whether proxy SDKs are actively flawed or allow lateral movement is unknown; exact device or person behind activity unidentified.
- 236 proxy exits from 6 addresses
- 28 residential proxy services involved
- Activity peaks in evening hours
- Logs available for agencies
- Proxies reach remote sites including Antarctica
Impact: Potential unauthorized internal network access and lateral movement via compromised proxy SDKs
| Product | Affected |
|---|---|
| residential proxy services | — |
- 1.Share raw logs with Layer3 Intel
- Products
- residential proxy services
- Organizations
- Layer3 Intel
- Countries
- United States
From the original article
3 min read at layer3intel.com
Our Residential Proxy Observatory , launched earlier this week, is a first-of-its-kind interface that gives researchers a global view of residential proxy and anonymized internet activity. While our team was looking through it, we noticed residential proxy exit activity on AS2650 . AS2650 is registered to the Executive Office of the President, the federal agency that hosts the White House network.
By layer3intel.com via drmorr · layer3intel.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.