TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Layer3 Intel says its monitoring recorded 236 residential proxy exits through six IP addresses associated with AS2650, registered to the Executive Office of the President, between October 5 and November 3, 2026. The observations were independently identified as residential proxy exits by Spur and Synthient, but they do not establish which device or person was involved or whether any internal systems were accessed.
Layer3 Intel says it recorded residential proxy activity exiting through six IP addresses on AS2650, a network registered to the Executive Office of the President, between October 5 and November 3, 2026. The company counted 236 exits and said public IP context pages from Spur and Synthient also identified the addresses as residential proxy exits; the observations do not identify a person or prove that White House systems were accessed.
According to Layer3 Intel, its Residential Proxy Observatory recorded exits through the six addresses on 26 of the 30 days in the observation period. The company said 28 residential proxy services were able to route traffic through the network. It described the observatory as a new interface for monitoring residential proxy and anonymized internet activity.
Layer3 Intel said the activity was detected while its team was requesting global rotating access through residential proxy services. It said it did not target the White House network or try to make its probes exit there. The company characterized the access as publicly available: customers can pay residential proxy providers to send traffic through participating devices, making requests appear to originate from those devices’ internet connections.
The company said it checked the six addresses against other detection services, including Spur and Synthient, whose public context pages independently label them as residential proxy exits. That corroborates the proxy classification reported by Layer3 Intel, but does not establish how the traffic reached the network, who controlled any device, or whether the activity was authorized.
Potential Exposure Inside the Network
The finding matters because residential proxies can obscure the origin of internet traffic and, depending on how a proxy component is installed and configured, may create security risks beyond the use of an address as an exit point. Layer3 Intel cited prior research on poorly secured proxy software that could permit access to internal networks or movement between devices. Those are potential risks described in earlier research, not evidence that either occurred on the White House network.
Layer3 Intel also pointed to Synthient research on the Kimwolf botnet, which it said reached at least 2 million devices, mostly Android devices with exposed ADB services, through residential proxy networks. That example supplies relevant security context, but it does not connect Kimwolf to the White House observations. For the public, the key distinction is that a proxy exit on a government-registered network warrants attention, while the available data alone cannot show compromise or access to sensitive systems.
Products Worth Considering
Samsung Galaxy Tab A7 Lite 8.7 32GB Wi‑Fi Android Tablet – Long‑Lasting Battery, Compact Slim Design, Sturdy Metal Frame (US Version)
LG UltraGear 34GX90SA-W 34-inch WQHD Curved OLED Gaming Monitor
Samsung Galaxy Tab A11 (2026) – 8.7 90Hz Android Tablet, 64GB/4GB Wi‑Fi, Octa-core MediaTek Helio G99, Dual Dolby Speakers, 20W Fast Charger
As an affiliate, we earn on qualifying purchases.
How the Proxy Detection Works
Residential proxy providers sell customers the ability to route traffic through everyday devices and their internet connections. A destination website may then see the device’s public IP address rather than the customer’s original address. The model can be used for legitimate purposes, but networks may also be used without the device owner’s informed consent if proxy software is installed through an unwanted or compromised application.
Layer3 Intel says its observatory tracks proxy infrastructure worldwide and that the White House-related observation was one result of broad monitoring. The report also describes activity in remote locations, including addresses in Saint Helena, the Falkland Islands and other territories, along with three observations associated with a Cloudflare WARP address pointing to McMurdo Station. These examples illustrate the reach of the company’s dataset; they do not establish that the remote activity and the White House observations share a cause.
“We did not selectively target this network or try to make our probes exit from it.”
— Layer3 Intel
What the Exit Data Cannot Show
The report does not identify the device, user, or proxy software behind the six addresses. Layer3 Intel said about half of the activity occurred between 5 p.m. and midnight Eastern time and almost none in the early morning. It suggested the timing could fit a person regularly using the network, but said the pattern only supports an inference and does not establish the activity’s source. The report does not provide evidence that the exits came from a particular employee, visitor, or government device.
It is also unclear whether the activity reflected an infected device, an authorized proxy installation, a guest or other network connection, or another explanation. The observations do not show that proxy operators accessed internal systems, moved laterally, or obtained data. The available source material contains no response from the Executive Office of the President or details of any investigation, mitigation, or confirmed security incident.
Logs and Official Follow-Up
Layer3 Intel said it has preserved raw logs of the recorded activity and is willing to share them with relevant agencies through its contact page. Those records could help establish the timing and network details behind the reported exits, although the source does not say whether an agency has requested or received them.
The next significant information would be an account from the Executive Office of the President or relevant network administrators clarifying whether the addresses were part of the White House network at the time, what devices or services were involved, and whether investigators found any internal access. Until such information is available, the report supports the presence of proxy exits on addresses associated with the network, but not a conclusion that the network was breached.
Key Questions
What did Layer3 Intel detect?
It reported 236 residential proxy exits through six IP addresses on AS2650, a network registered to the Executive Office of the President, from October 5 to November 3, 2026.
Does the report prove the White House network was breached?
No. The report documents proxy exit activity, but does not show that anyone accessed internal systems, stole data, or moved between devices.
Does the data identify who was responsible?
No. Layer3 Intel said its data shows the exit addresses, not the device or person behind them. The report does not identify a user or specific device.
How did Layer3 Intel say it found the activity?
The company said it was requesting global rotating access through residential proxy services and observed the exits without targeting the White House network. It said Spur and Synthient also labeled the addresses as residential proxy exits.
What happens next?
Layer3 Intel says it has retained raw logs and will share them with relevant agencies on request. The source material does not confirm whether an agency has requested the data or whether the Executive Office of the President is investigating.
Source: layer3intel.com
