Layer3 Intel observes residential proxy exit traffic leaving AS2650, the Executive Office of the President network
Layer3 Intel reported that its residential proxy enumeration pipeline exited through AS2650, the autonomous system registered to the Executive Office of the President, which hosts the White House network. Between 5 October and 3 November 2026, the firm recorded 236 connections through six IP addresses on 26 of those 30 days, reachable through 28 distinct residential proxy services. The researchers say the discovery was incidental, made while requesting global rotating access through commercial proxy providers, and that their telemetry shows only exit points, not the device or the person behind them. The addresses were cross-checked against Spur and Synthient, which also classify them as residential proxy exits. SecurityWeek reports that Windows machines on the network were running the InfaticaSDK, used by numerous residential proxy services (securityweek.com). Layer3 makes no allegation of wrongdoing and frames the internal-network risk as conditional.
Detalhes técnicos
Residential proxy services monetise end-user devices by embedding an SDK that turns the host into an exit node, so outbound traffic appears to originate from an ordinary home or corporate connection. Layer3 notes that about half of the AS2650 activity fell between 5 p.m. and midnight Eastern time, with almost none in the early morning — a pattern it reads as a single person regularly present on the network in the evening rather than a public guest Wi-Fi segment. The firm warns that poorly secured proxy SDKs have historically allowed inbound reach into the hosting network: Synthient's research A Broken System Fueling Botnets documented the Kimwolf botnet reaching at least 2 million devices, mostly Android hosts with an exposed ADB service, through residential proxy networks. If an SDK present on this network carried a comparable flaw, any paying proxy customer could potentially reach internal systems; Layer3 does not assert that this is the case. The same observatory also mapped proxy exits in extremely remote locations, including 413 addresses in Saint Helena, Ascension and Tristan da Cunha, 388 in the Falkland Islands, 43 in the Chagos Islands, 21 in Tokelau, seven in South Georgia, single observations on Pitcairn, Norfolk Island and Svalbard, and three instances in Antarctica from a Cloudflare WARP address linked to McMurdo Station.
Remediação
Enterprise and government security teams should inventory endpoints for proxy-monetisation SDKs and bundled "free VPN"/reward applications, block known residential proxy provider infrastructure at the egress, monitor for unexpected inbound-initiated sessions to internal hosts, and correlate corporate egress IP ranges against commercial proxy exit feeds such as Spur or Synthient. No statement from the Executive Office of the President on this activity has been published.
Linha do tempo
-
Layer3 Intel observes residential proxy exit traffic leaving AS2650, the Executive Office of the President network
ler a análise desta fonte ocultar
Layer3 Intel reported that its residential proxy enumeration pipeline exited through AS2650, the autonomous system registered to the Executive Office of the President, which hosts the White House network. Between 5 October and 3 November 2026, the firm recorded 236 connections through six IP addresses on 26 of those 30 days, reachable through 28 distinct residential proxy services. The researchers say the discovery was incidental, made while requesting global rotating access through commercial proxy providers, and that their telemetry shows only exit points, not the device or the person behind them. The addresses were cross-checked against Spur and Synthient, which also classify them as residential proxy exits. SecurityWeek reports that Windows machines on the network were running the InfaticaSDK, used by numerous residential proxy services (securityweek.com). Layer3 makes no allegation of wrongdoing and frames the internal-network risk as conditional.
Technical Details
Residential proxy services monetise end-user devices by embedding an SDK that turns the host into an exit node, so outbound traffic appears to originate from an ordinary home or corporate connection. Layer3 notes that about half of the AS2650 activity fell between 5 p.m. and midnight Eastern time, with almost none in the early morning — a pattern it reads as a single person regularly present on the network in the evening rather than a public guest Wi-Fi segment. The firm warns that poorly secured proxy SDKs have historically allowed inbound reach into the hosting network: Synthient's research A Broken System Fueling Botnets documented the Kimwolf botnet reaching at least 2 million devices, mostly Android hosts with an exposed ADB service, through residential proxy networks. If an SDK present on this network carried a comparable flaw, any paying proxy customer could potentially reach internal systems; Layer3 does not assert that this is the case. The same observatory also mapped proxy exits in extremely remote locations, including 413 addresses in Saint Helena, Ascension and Tristan da Cunha, 388 in the Falkland Islands, 43 in the Chagos Islands, 21 in Tokelau, seven in South Georgia, single observations on Pitcairn, Norfolk Island and Svalbard, and three instances in Antarctica from a Cloudflare WARP address linked to McMurdo Station.
Remediation
Enterprise and government security teams should inventory endpoints for proxy-monetisation SDKs and bundled "free VPN"/reward applications, block known residential proxy provider infrastructure at the egress, monitor for unexpected inbound-initiated sessions to internal hosts, and correlate corporate egress IP ranges against commercial proxy exit feeds such as Spur or Synthient. No statement from the Executive Office of the President on this activity has been published.