Residential Proxies Detected on White House Network

Residential proxy exit traffic was detected on AS2650, the network registered to the Executive Office of the President, between October 5 and November 3, 2026, according to a new Residential Proxy Observatory launched this week. The monitoring pipeline exited through the White House network 236 times from six addresses across 26 of 30 days, with 28 separate residential proxy services observed, and the findings were corroborated by Spur and Synthient. Activity clustered in the evening Eastern time—roughly half between 5 p.m. and midnight and almost none in the early morning—suggesting an individual device infected with a proxy SDK rather than guest Wi-Fi. The detection matters because poorly secured proxy SDKs can expose internal networks to lateral movement, as seen when Synthient documented the Kimwolf botnet reaching at least 2 million mostly Android devices. The observatory also logged 413 addresses and more than 32,000 observations in the South Atlantic territory of Saint Helena, Ascension and Tristan da Cunha, plus three observations from Antarctica via a Cloudflare WARP address pointing to McMurdo Station. What to watch next is whether the White House identifies and remediates the affected device, and whether the observatory's global view surfaces further unexpected networks.