Layer3 Intel says it found residential proxy traffic leaving the White House network 236 times over 30 days, through six addresses registered to the Executive Office of the President, as reported by Infosecurity Magazine on November 5. The New York-based proxy detection firm published its research on November 4 and found the traffic by chance while requesting ordinary rotating access through public residential proxy services.
The activity appeared on 26 of the 30 days between October 5 and November 3, and 28 separate residential proxy services could route traffic through the addresses, which belong to AS2650. Two other proxy detection services, Spur and Synthient, independently flagged the same addresses.
About half the activity occurred between 5 p.m. and midnight Eastern Time, with almost none in the early morning. Layer3 suggests that points to one person’s device, regularly on the network in the evenings, with a proxy software development kit installed. It stresses that its data shows the exits, not the device or the person behind them, and that anyone could buy access to such exits for a few dollars.
Layer3 reported no compromise of White House systems and says it backed up its raw logs and shared its findings with a U.S. federal agency. The report did not include a White House response. The firm warns that poorly secured proxy SDKs can give outsiders a route into internal networks, citing research that the Kimwolf botnet reached at least two million mostly Android devices through residential proxy networks.