Follow us on Google News
WASHINGTON — Internet addresses linked to the White House network were used to route traffic through 28 residential proxy services across the globe, raising serious concerns regarding the digital security of the executive office. Cybersecurity researchers discovered that external users could pay nominal fees to channel their online traffic through six addresses registered to the Executive Office of the President under network block AS2650. The suspicious activity, recorded across 26 different days between October 5 and November 3, 2026, has prompted suspicions that unauthorized proxy software was operating on a personal device connected directly to the official network.
Patterns Point to Personal Device on Official Network
The activity came to light through the Residential Proxy Observatory, a monitoring platform developed to track global proxy traffic and hidden internet connections. Over a 30-day monitoring window, analysts cataloged 236 separate instances of online traffic exiting through the presidential network block. The findings gained further weight after two independent proxy detection firms, Spur and Synthient, corroborated the identification of the six addresses as active proxy exits, significantly reducing the likelihood of a temporary technical anomaly.
Residential proxy services operate by channeling external data requests through genuine domestic or workplace connections, disguising incoming traffic to make it appear as if it originates from legitimate everyday users. In many instances, hardware owners remain entirely unaware that their bandwidth is being monetized, as covert software embedded in applications or low-cost electronics can quietly sell connectivity without explicit user consent. Data logs revealed that nearly half of the White House network traffic occurred between 5 p.m. and midnight Eastern Time, with virtually no transmissions recorded during early morning hours. This distinct evening pattern led researchers to suspect an individual personal device rather than a standard guest Wi-Fi connection, though the data could not pinpoint the exact hardware or operator.
Hidden Gateway Risks and Botnet Parallels
Security analysts warned that unauthorized residential proxy nodes can transform poorly secured internal hardware into covert digital pathways for outside actors. Previous research by Synthient highlighted this operational risk through the Kimwolf botnet, which compromised more than two million internet-connected systems, primarily Android-based television boxes running exposed debugging tools. The botnet leveraged residential proxy infrastructure to reach internal hardware that would typically remain protected behind corporate or residential firewalls.
Earlier investigations have uncovered similar threats where ordinary workplace applications and bandwidth-sharing tools secretly turned enterprise hardware into active proxy relay points. In one documented instance, an enrolled employee device permitted outside parties to access an organization’s internal router administration interface. Such exposures demonstrate how single unmanaged endpoints can become operational gateways, enabling third parties to bypass boundary protections and gain access to wider enterprise systems.
Global Sweep Identifies Exits in Antarctica and Remote Islands
The White House was not the only unusual location identified during the global survey. Analysts at Layer3 Intel uncovered significant proxy infrastructure operating across remote territories, logging over 32,000 observations tied to 413 network addresses throughout Saint Helena, Ascension Island, and Tristan da Cunha. Three observations were traced to a Cloudflare WARP address operating out of McMurdo Station in Antarctica, alongside smaller concentrations in Norfolk Island, Pitcairn, Tokelau, Svalbard, South Georgia, the Chagos Islands, and the Falkland Islands.
Researchers confirmed that raw logs from the investigation have been preserved for transfer to relevant government agencies. To mitigate future exposure, analysts urged systems administrators to inspect domain name service logs for known proxy destinations, audit applications and extensions running on official equipment, and bar inexpensive Android media boxes from sensitive environments. Technical teams were also advised to disable Android debugging tools where unnecessary, cutting off avenues that outside operators use to establish unauthorized relays within sensitive organizational networks.
