Researchers Discover White House Network IP Available for Rent Through 28 Proxy Services

Researchers at Layer3 Intel found that 28 residential proxy services rent addresses on the White House network. Anyone with a few dollars could send web traffic through them. The activity ran from October 5 to November 3, 2026.

The team spotted the activity while browsing its new Residential Proxy Observatory, a tool that shows proxy and hidden internet activity around the world. The traffic came from AS2650, a network block registered to the Executive Office of the President. In 30 days, the team’s tools exited through this network 236 times. The exits came from 6 addresses on 26 of the 30 days.

Layer3 requested rotating global access through proxy services, which then revealed the White House addresses on their own. Additionally, Spur and Synthient, two other firms that specialize in proxy detection, also identify these addresses as proxy exits. This makes it unlikely that the identification of these addresses is merely a one-time error.

White House Network IP for Rent

A residential proxy sends web traffic through a real home or office connection, so the traffic looks like it comes from an ordinary user. Many device owners never agree to this. Hidden software in an app or a cheap device can sell bandwidth without the owner’s knowledge. Because the addresses look normal, simple blocklists often fail to catch them.

About half of the activity fell between 5 p.m. and midnight Eastern time, and almost none happened in the early morning. Layer3 Intel says this looks like one person on the network in the evening, not a public guest Wi-Fi setup. The most likely cause is a personal device carrying a proxy software kit. The data shows only the exits. It does not show which device or person is behind them.

The risk is that a weak proxy kit can give outsiders a path inside a network. Synthient’s earlier research on the Kimwolf botnet shows how this happens. Kimwolf reached more than 2 million devices, mostly Android boxes with an open debug service, by moving through residential proxy networks. In that case, attackers reached devices on private home networks that should have been out of reach.

This is not a new pattern. Cyber Security News has already covered how Kimwolf infected 2 million devices and turned them into proxy nodes. It also reported that Google disrupted the IPIDEA proxy network, which relied on hidden software kits inside ordinary apps. Later research found that nearly half of the apps on LG and Samsung TVs carried proxy code.

The risk also reaches the workplace. One report on a bandwidth-sharing app showed that a single enrolled employee device could give outsiders a way to reach a router’s management page.

The White House was not the only surprise. Layer3 Intel logged 413 addresses and more than 32,000 observations in Saint Helena, Ascension and Tristan da Cunha.

It also saw three observations in Antarctica, all from a Cloudflare WARP address tied to McMurdo Station. Smaller counts came from Pitcairn, Norfolk Island and Svalbard. The Falklands (388 addresses), the Chagos Islands (43), Tokelau (21) and South Georgia (7) also showed activity.

Layer3 Intel says it has saved the raw logs and will share them with relevant agencies. Network teams can take simple steps now. They can check DNS logs for known proxy domains and review apps and browser add-ons on work devices for proxy code. They should also keep TV boxes and other low-cost Android devices off sensitive networks, and turn off Android’s debug service where it is not needed.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.