Layer3 detected residential proxy exits through White House network
The security firm counted 236 exits from six addresses over a month; The Register reports activity later stopped and the State Department requested its logs.
Layer3 Intel says it recorded 236 residential proxy exits through six addresses on the White House network between October 5 and November 3, 2026. The Register reported on November 5 that the latest activity had occurred the previous night and that the State Department had requested Layer3’s logs. The observations show traffic exiting through network addresses; they do not identify a device or user or establish access to internal systems.
What Layer3 recorded on the White House network
Layer3’s Residential Proxy Observatory logged exits on 26 of the 30 days in its observation period. The firm said 28 distinct residential proxy services were able to exit through the network. It also checked the six addresses against public IP context pages from Spur and Synthient, which it said identified them as residential proxy exits.
About half the activity fell between 5 p.m. and midnight Eastern time, Layer3 said, with almost none in the early morning. The firm interpreted that pattern as suggesting someone regularly used the network in the evening, possibly on a device running proxy software. Its records show the network exits, however, and do not identify the person or device behind them.
Why residential proxy exits can pose a security risk
Residential proxies route customers’ traffic through ordinary internet connections, making it appear to come from the network using the device rather than a data centre. The Register reported that such services can be used to conceal command-and-control infrastructure, conduct phishing and send spam. In March 2026, the FBI warned that malware, illicit software partnerships and VPNs with hidden terms can turn devices into proxy nodes without their owners’ consent.
Layer3 warned that poorly secured proxy software development kits could potentially give attackers a route into internal systems or allow them to move laterally. As an example of the broader risk, the firm cited Synthient research that traced the Kimwolf botnet to at least two million devices, mostly Android devices with an exposed ADB service, through residential proxy networks. That precedent does not establish that the same weakness was present on the White House network.
What happened after Layer3’s detection
Layer3 founder Sergiy Usatyuk told The Register that the latest observed activity was on Wednesday night, November 4, hours after the firm’s blog post went live, and had since stopped. He said the State Department contacted Layer3 on Thursday morning, November 5, to request the logs, which the company sent. The Register said the White House did not respond to its questions. The cause of the activity and whether any internal systems were accessed have not been established.
Read in depth: Technology
After Democratic midterm gains, tech figures turn to data centers in space
Elon Musk and other technology figures discussed orbital computing after projected Democratic gains, as data-center opposition featured in some campaigns.
Amazon’s new Echo Dot is on sale, while Echo Show 16 awaits December launch
The Echo Dot adds smart home hub and eero extender functions. The larger Echo Show 16 can be preordered, with The Verge reporting a December 16 launch.
Sources and context
- The White House is apparently a popular residential proxy exit spotThe Register
- Residential Proxies Detected on White House NetworkLayer3 Intel
AI-assisted article checked against the listed sources. NewsJaws did not conduct interviews or attend the reported events.