Technology1 min read

Residential Proxies Detected on White House Network

By · Published by Everything Blog

In short

The Residential Proxy Observatory identified 236 separate proxy exits originating across six distinct addresses within the Executive Office of the President's network. Commercial providers sell access to consumer devices hosting these proxy kits, allowing outside traffic to route through unwitting hosts. Notably, about half of the detected White House activity occurred between 5 p.m. and midnight Eastern time, pointing to an individual working late on a compromised device.

Key points

  • Compromised software development kits embedded in devices create significant lateral move…: Compromised software development kits embedded in devices create significant lateral movement risks within sensitive federal government networks.
  • Approximately half of the observed proxy activity occurred during late evening hours, ind…: Approximately half of the observed proxy activity occurred during late evening hours, indicating an infection on a specific user device.
  • Commercial residential proxy networks routinely leverage compromised systems across the g…: Commercial residential proxy networks routinely leverage compromised systems across the globe, reaching even remote locations like Antarctica.

Sources checked by our analysis pipeline: 1

Our Residential Proxy Observatory, launched earlier this week, is a first-of-its-kind interface that gives researchers a global view of residential proxy and anonymized internet activity.

While our team was looking through it, we noticed residential proxy exit activity on AS2650. AS2650 is registered to the Executive Office of the President, the federal agency that hosts the White House network. Residential proxy services sell access to everyday devices, letting customers send traffic through them so it appears to come from that device's network.

What we observed

From October 5 to November 3:

- Our residential proxy enumeration pipeline exited through the White House network 236 separate times.

- Those exits came from 6 addresses, on 26 of the 30 days.

- 28 separate residential proxy services were able to exit through this network.

To make sure this was not a fluke, we checked these addresses against other residential proxy detection services, such as Spur and Synthient. Their public IP context pages independently identify these addresses as residential proxy exits.

This is public access. Anybody can obtain it by signing up to…

Technology