Researchers renting ordinary residential proxy services found their traffic leaving the internet through the White House network, possibly via one person’s device carrying proxy software. It is a useful reminder that any organisation’s outbound IP addresses can be sold to strangers without anyone inside noticing.
What happened
On 4 November 2026 Layer3 Intel, a New York firm that tracks residential proxy and anonymisation infrastructure, published findings from its newly launched Residential Proxy Observatory. While reviewing the data, its team noticed exit traffic on AS2650, the block of addresses held by the Executive Office of the President, the US agency behind the White House network.
Over the 30 days from 5 October to 3 November, Layer3’s own enumeration pipeline left the internet through six AS2650 addresses on 236 occasions, on 26 of those days. Twenty-eight separate residential proxy services could route traffic out through those addresses. Layer3 checked the addresses against the public lookup pages of two other proxy detection services, Spur and Synthient, and both independently classed them as residential proxy exits.
Layer3 says it did not target the network; it bought ordinary global rotating access, available to anyone for a few dollars. Layer3 founder Sergiy Usatyuk told Infosecurity Magazine the latest activity was seen on the evening of 4 November. Layer3 reported no compromise of White House systems and has kept the raw logs; Infosecurity Magazine adds that it has shared its findings with a US federal agency. According to SecurityWeek, Synthient links the traffic to an Infatica software development kit on Windows 11 machines; Infatica is a proxy and web data company based in Singapore. Infosecurity Magazine said it had asked the White House for comment.
The technical picture
Residential proxy services sell the use of other people’s internet connections. Their customers send requests through a pool of everyday devices, so the traffic appears to come from a home broadband line, a mobile phone or, in this case, an office network. The devices usually join the pool because an app, browser extension or free utility bundles a proxy SDK.
The timing is the most telling detail. Roughly half the exits came in the evening, 5pm to midnight in Washington, and almost none in the early hours. Layer3 reads that as a person who is regularly on the network late into the evening with an infected device, rather than a shared visitor Wi-Fi service. The firm is careful to note its data shows exits, not the device or the individual behind them.
The bigger concern is what else an SDK can do. Layer3 points to Synthient’s earlier research on the Kimwolf botnet, which spread to two million or more devices, most of them Android hardware with Android Debug Bridge left exposed, through residential proxy networks. If a proxy SDK has that kind of weakness, a paying customer of the proxy service may be able to reach internal systems rather than just borrow an IP address. That turns a reputational nuisance into a lateral movement risk.
Layer3 also showed how far these networks reach, logging exits as far afield as Antarctica, Svalbard and the South Atlantic. One territory on its list is British: Saint Helena, Ascension and Tristan da Cunha. That is my observation; Layer3 does not draw any UK conclusion from it.
Why it matters for UK organisations
If proxyware can sit on a device inside one of the most closely watched networks in the world, it can sit inside a UK council, a law firm or an NHS supplier. The White House is the case that made headlines. The underlying problem is one most UK organisations do not monitor at all: whether their own public egress addresses are being rented out.
That matters for several reasons. First, criminals buy residential proxies precisely because the traffic looks legitimate. Credential stuffing, fraud, scraping and account takeover attempts that exit through your address carry your reputation, and your ranges can end up on blocklists or in another organisation’s incident report. Second, it erodes a defence many UK firms rely on. Conditional access policies and fraud rules that trust “UK business” or “UK residential” addresses are weaker when attackers can buy exactly those addresses. Third, the device carrying the SDK is running software nobody approved, and the earlier Kimwolf research shows that some of these SDKs open a path inward.
Personal phones on corporate Wi-Fi and unmanaged smart TVs in meeting rooms share an egress point with managed estate, and under UK GDPR an attacker reaching internal systems through such a device could still be a reportable breach for you to explain to the ICO.
Expert view
Very few organisations ever look at their own IP addresses from the outside in. SOC teams watch inbound alerts and outbound connections to known bad destinations, but proxy SDKs typically talk to the provider’s infrastructure and then make ordinary-looking web requests to ordinary-looking sites. Nothing about that trips a signature.
What I like about this research is that the detection came from outside: a third party looking at what its paid proxy traffic actually did. Defenders can borrow that idea cheaply. Checking your egress ranges against proxy intelligence sources is a five-minute job, and a positive result tells you more about your software hygiene than most audit questionnaires do.
I would also be cautious about reading much into the absence of any reported compromise. The risk Layer3 describes is precisely that the device could become a route in. When we test, unmanaged devices on flat networks are still one of the most reliable ways to move from an initial foothold to something that matters.
What to do now
- Check your own egress addresses. Look up every public IP your organisation uses for outbound traffic, including guest Wi-Fi and remote access gateways, on residential proxy intelligence services such as Spur and Synthient. Repeat it monthly.
- Inventory and remove unapproved software. Hunt for free VPNs, “earn from your bandwidth” apps, unofficial browser extensions and bundled utilities on endpoints. This maps directly to the Cyber Essentials secure configuration and malware protection controls; application allow-listing makes it far easier.
- Look for proxy-shaped behaviour. In firewall, DNS and proxy logs, flag single endpoints making large numbers of short outbound connections to unrelated destinations, particularly outside working hours.
- Segment unmanaged devices. Keep personal devices, smart TVs and Android boxes on isolated networks with their own egress address, and make sure Android Debug Bridge is not exposed on any device you own. This supports the Cyber Essentials firewalls and user access control requirements.
- Stop trusting IP reputation alone. Review conditional access and fraud rules that treat UK residential or business addresses as low risk, and lean on device compliance and phishing-resistant MFA instead.
- Plan for the bad day. If you find an exit, treat the device as compromised: isolate it, capture evidence, identify the software responsible and review what that device could reach internally.
Bottom line
A month of White House proxy exits shows even well-funded defenders can miss a device reselling their connection. For UK organisations, the takeaway is that egress reputation is part of your attack surface. Check your addresses, clear out unapproved software and segment what you cannot manage, before someone else rents your network for you.
