Cheap online services routed web traffic through a White House-linked network, researchers say

Threat-intelligence firm Layer3 Intel says public online services repeatedly sent its web traffic through a White House-linked network. The company recorded 236 observations between Oct. 5 and Nov. 3 across six internet addresses and 28 services, raising concern about outsiders using government-linked internet connections.

Layer3 identifies the network as hosting White House connectivity. AS2650 is listed under the name EOP-ASN in ARIN's registration record. The registration does not identify the device or person behind any particular connection.

Residential proxy services sell customers access to other devices' internet connections. As Layer3 describes the arrangement, traffic sent through a proxy appears to come from the device's network, rather than the customer buying access.

White House proxy traffic and the evening pattern

In its Nov. 4 report, Layer3 said it observed exits on 26 of the 30 days in its monitoring window. Its pipeline encountered the network while requesting global rotating access through residential proxy services, the company said, rather than deliberately selecting AS2650.

Layer3 said anyone could obtain the same type of access by paying a public residential proxy service a few dollars.

Layer3 said it cross-checked the addresses against public IP context pages from proxy-detection firms Spur and Synthient. The company said those pages also identified the addresses as residential proxy exits, but it has not disclosed the six addresses in its published finding.

Those figures describe recorded exits, public addresses and proxy services. They do not establish how many devices were involved or that each observation was an attack.

Services, public addresses and exit observations measure different parts of Layer3's finding.

The raw logs were not independently examined. Public-address counts are not device counts; internal access is not demonstrated.

Sources and evidence

Sources

1. Layer3 Intel report, archived Nov. 5 at 02:40 UTC
2. ARIN registration for AS2650

Supporting facts

• Layer3 Intel says its residential proxy enumeration pipeline exited through the network it identifies as the White House network 236 times between October 5 and November 3, 2026. [1]
• Layer3 Intel says its October 5 to November 3 observations came from six addresses on 26 of the 30 days, with 28 separate residential proxy services able to exit through the network it identifies as the White House network. [1]
• ARIN's AS2650 registration lists the name EOP-ASN and organization Executive Office Of The President (EXOP). [2]
• Layer3 Intel says it found the activity by chance while requesting global rotating access from public residential proxy services, without selectively targeting AS2650. [1]
• Layer3 Intel describes residential proxies as services that let customers send traffic through everyday devices so that traffic appears to originate from those devices' networks. [1]
• Layer3 Intel says about half of the activity fell between 5 p.m. and midnight Eastern and almost none in the early morning; it interprets this as suggesting a person's device with a proxy SDK rather than public guest Wi-Fi, while saying its data identifies neither the device nor the person. [1]
• Layer3 Intel warns conditionally that a poorly secured proxy SDK could allow access to internal systems if it had the kind of flaw documented in past proxy research; its published finding does not demonstrate such internal access here. [1]

Method

Source-bound schematic using reported counts and independent ARIN registration. Dots represent 28 services and six public addresses; connectors show conceptual stages, not measured per-service mappings, traffic volumes or internal topology. No derived arithmetic or per-day chart reconstruction.

Scope

The raw logs were not independently examined. Public-address counts are not device counts; internal access is not demonstrated.

Infographic by CryptoSlate

Layer3 said about half the activity occurred between 5 p.m. and midnight Eastern, with almost none in the early morning. It interpreted that pattern as suggesting a person's device running proxy software, rather than a public guest Wi-Fi network.

The company described an infected device with a proxy software development kit (SDK) as its explanation for the pattern, while acknowledging that its data shows neither the device nor the person behind the exits.

The distinction also matters for the security implications. Layer3 warned that poorly secured proxy software can, in some circumstances, expose internal systems. Its warning about this network was conditional: an SDK would need to have the kind of flaw documented in earlier proxy research for that route into internal systems to exist.

The published observations do not demonstrate access to internal White House systems. CryptoSlate has not reviewed the raw logs.

Logs and agency notification

Layer3 said it had backed up its activity logs and was willing to share them with relevant agencies through its contact page.

RuntimeWire reported that founder Sergiy Usatyuk told it Layer3 would not disclose the specific addresses because of the sensitivity of the findings and had not notified anyone.

KrebsOnSecurity reported on Nov. 4 that the White House did not immediately respond to its request for comment.