Researchers Say Residential Proxy Traffic Routed Through White House Network

Security researchers at Layer3 Intel say they observed residential proxy traffic originating from a network registered to the Executive Office of the President, which hosts the White House network. Their findings raise concerns about possible misuse of government infrastructure, but do not identify a specific device or confirm that it was compromised.

The researchers reported 236 instances of residential proxy traffic between October 5 and November 3, 2026. They said the activity involved at least 28 residential proxy services and that six IP addresses appeared on 26 of the 30 days they observed the network. Layer3 Intel said it encountered the traffic while testing a platform for viewing residential proxy and anonymized internet activity.

Residential proxy services route customers’ internet requests through devices on residential connections. The services have legitimate uses, but cybercriminals also use them to obscure the origins of traffic and evade security controls. Layer3 Intel said poorly secured proxy software development kits could potentially enable access to internal networks and lateral movement. The researchers warned that someone buying proxy access could reach internal systems if software on the network had such a flaw.

About half of the observed connections occurred between 5 p.m. and midnight Eastern time, according to the report. The researchers said the pattern could point to a device connecting regularly in the evening, but stressed that their data showed network exits, not the devices behind them. They could not determine whether the source was a personal device, guest Wi-Fi or something else.