Layer3 Intel, a threat intelligence outfit that launched a public Residential Proxy Observatory this week, stumbled onto something ugly while testing its own tool: commercial residential proxy traffic is exiting from AS2650, the autonomous system registered to the Executive Office of the President. That is the White House network. Over 30 days — October 5 to November 3, 2026 — the firm logged 236 separate proxy exits from 6 IP addresses, across 28 different proxy services, on 26 of the 30 days observed. Residential proxy services work by routing paying customers' traffic through ordinary devices — phones, laptops, IoT gear — that have been enrolled, often unknowingly, through bundled SDKs in free apps or via outright malware. The customer gets an IP address that looks like a normal household or office connection. The device owner gets nothing except risk. In this case, the "device owner" appears to be someone working inside the White House. The timing pattern is the tell. Roughly half of the observed exits clustered between 5 p.m. and midnight Eastern, with almost no activity in the early morning hours. That is a human usage pattern — someone bringing a compromised device onto the network in the evening and keeping it active through the night. A guest Wi-Fi access point or an always-on server would show a flatter distribution. The security implications run deeper than embarrassment. Past research, including Synthient's documentation of the Kimwolf botnet (which reached at least 2 million devices through poorly secured proxy SDKs), has shown that these SDKs can expose internal network paths. If the compromised device sits inside the White House perimeter and the proxy SDK has a lateral-movement vulnerability, anyone paying a few dollars to a commercial proxy service could potentially probe internal systems. Layer3 did not claim to have attempted this — they flagged the exits and cross-verified with two independent detection services, Spur and Synthient. The broader dataset is equally striking. Layer3's observatory recorded residential proxy activity from Saint Helena (413 addresses, 32,000+ observations), McMurdo Station in Antarctica (3 observations via Cloudflare WARP), Pitcairn Island, Svalbard, the Falklands, the Chagos Islands, and Tokelau. The message is blunt: proxy SDK infections have reached the most isolated networks on Earth. No network perimeter is immune by default. What makes this disclosure unusual is the vector of discovery. Layer3 was not targeting the White House. It was enumerating global proxy exit points passively, requesting rotating residential proxy access from commercial services. The White House network showed up in the data because a device on that network is enrolled as a proxy node — available to anyone who pays. The firm has offered raw logs to relevant agencies. The deeper structural question is not about one compromised device. It is about the entire residential proxy ecosystem — a multi-billion-dollar shadow infrastructure built on millions of infected devices, where the end user bears all the risk and the proxy operators capture all the revenue. That this infrastructure now reaches inside the most security-sensitive network in the United States is a symptom, not the disease.
