Residential Proxy Traffic Found Exiting Through White House Network

Layer3 Intel says it spotted the activity while browsing its new Residential Proxy Observatory, a tool that provides a global view of residential proxy and anonymized internet activity. Layer3 recorded 236 connections through the network between 5 October and 3 November, from six IP addresses on 26 of those 30 days. A total of 28 residential proxy services were able to use the network. Layer3 compared the IP addresses with data from Spur and Synthient, which also identify them as residential proxy exit points.

Layer3 says it did not target the network and found the activity by chance while requesting global rotating access through public residential proxy services. It has not accused anyone at the White House of wrongdoing, and it says its data cannot identify the device or the person behind the activity. The researchers note that about half of the activity falls between 5 p.m. and midnight Eastern time, which they read as a person regularly using the network in the evening rather than public guest Wi-Fi.

Layer3 warns that poorly secured proxy SDKs can allow internal network access and lateral movement, citing Synthient's research on the Kimwolf botnet, which reached at least 2 million devices through residential proxy networks. Layer3 describes the risk as conditional: if an SDK on this network has the same flaw, anyone buying proxy access could reach internal systems. It does not claim that this is the case.

Why it matters For security teams, the concern is that devices on protected networks could unknowingly become proxy exit points, exposing those networks to outside traffic. Investigators should note that exit data shows where proxy traffic leaves, not which device or person generated it, so attribution requires further evidence. Organizations should check whether any proxy SDK is present on their own networks and whether those SDKs are securely configured.