A new Residential Proxy Observatory detected 236 proxy exits from the White House network (AS2650) between October 5 and November 3, 2026. The activity originated from 6 addresses across 26 days, linking to 28 residential proxy services. Independent verification by Spur and Synthient confirmed these as proxy exits.
Most traffic occurred in the evening (5 p.m. to midnight), suggesting a compromised personal device rather than public Wi-Fi. Poorly secured proxy SDKs may enable lateral movement, a vulnerability exploited by botnets like Kimwolf. Layer3 Intel is sharing raw logs with relevant agencies.
The observatory also revealed proxy activity in remote locations: Saint Helena (32,000+ observations), Antarctica (McMurdo Station), Pitcairn, Norfolk Island, Svalbard, Falklands, Chagos, Tokelau, and South Georgia. Residential proxies now reach virtually every corner of the globe.
Source: Hacker News · Summarized by HeadlinesBriefing