Residential proxies are renting out White House network addresses

What happened and what to do

According to the article by Krebs on Security, Layer3 Intel recorded residential proxy nodes exiting through AS2650, the network reserved for the Executive Office of the President. Between October 5 and November 3, these proxies exited the network 236 times, from six IP addresses, on 26 of 30 days, with most activity between 5pm and midnight. Synthient linked part of this activity to Windows 11 installations of a proxy program often bundled with free apps. Layer3 identified 28 distinct residential proxy services able to exit through this network, and the White House did not immediately respond to a request for comment.

For a company, the case shows that a residential proxy can turn a corporate device into an exit point for third-party traffic, so websites and services see the organization's address as the source of activity it never performed. The practical response starts with an egress diagnosis: inventorying proxy software and SDKs on laptops and phones, checking outbound IPs against residential proxy reputation lists, alerting on unusual off-hours connections, and isolating affected devices. A network and DNS log dashboard with detection rules and a response process can then be built and run on the client's own infrastructure.

How the consultancy can help

Diagnosis of the organization's network egress exposure, identifying devices running residential proxy software and addresses reused by third parties. Then implementation of network and DNS monitoring with alerts, blocking rules and ongoing operation on the client's infrastructure.

Next step

If your organization wants to check whether its outbound addresses are being used by proxy services, send a short description of your case, including the type of network and the devices involved. Wendelmaques replies with an initial diagnosis and a scoped proposal.