KrebsOnSecurity reported on 4 November 2026 that several staffers at the White House are using computers or mobile devices equipped with residential proxy services that make their internet address available for others to rent.

According to KrebsOnSecurity, the security firm Layer3 Intel said it detected multiple residential proxy nodes beaconing from the internet-address network reserved for the Executive Office of the President (AS2650); Layer3 said the proxy activity was relatively persistent between 5 October and 3 November, and that a review of the proxies available from AS2650 showed they exited from the White House network 236 times during that period.

According to KrebsOnSecurity, Layer3 said the proxy exit nodes at the White House came from six internet addresses, on 26 of the 30 days, with most of the activity in the evening between 5 p.m. and midnight, and that it found 28 separate residential proxy services able to exit through this network. "This is public access," the Layer3 Intel team wrote, as quoted by KrebsOnSecurity: "Anybody can obtain it by signing up to a public residential proxy service, paying a few dollars and sending requests through it. We did not selectively target this network or try to make our probes exit from it. We caught this by chance, simply by requesting global rotating access through these services."

KrebsOnSecurity says the White House did not immediately respond to a request for comment. KrebsOnSecurity notes that residential proxy services are a major source of unwanted and often malicious traffic, and that in January 2026 dozens of proxy services were forced to patch after Synthient founder Ben Brundage showed how cybercriminals were abusing a vulnerability in these services to seize control of devices inside users' local networks.

"Some of these resellers sell bandwidth for as low as 60 cents a Gigabyte, that means for less than a dollar you can gain access into some of the most confidential and trusted networks," Brundage told KrebsOnSecurity.

According to KrebsOnSecurity, Spur found residential proxies in nearly 300 government-owned networks in a January 2026 webinar, and Infoblox said earlier in 2026 that 65% of its customer base was querying one or more residential-proxy-related domains. (source: KrebsOnSecurity)

Updated 5 Nov 2026 (Layer3 Intel): Layer3 Intel's own post, dated 4 November 2026, now reads and is the primary source for its findings.

Layer3 says it noticed residential proxy exit activity on AS2650, which is registered to the Executive Office of the President, while looking through its Residential Proxy Observatory, and that from 5 October to 3 November its residential proxy enumeration pipeline exited through the White House network 236 separate times, from 6 addresses on 26 of the 30 days, with 28 separate residential proxy services able to exit through the network.

Layer3 says it checked these addresses against other residential proxy detection services, such as Spur and Synthient, whose public IP context pages independently identify them as residential proxy exits.

It says about half of the activity falls between 5 p.m. and midnight Eastern time and almost none in the early morning, which it says suggests a person rather than a public guest Wi-Fi network, and that its data shows the exits, not the device or the person behind them.

Layer3 says it has backed up the raw logs of the recorded activity and is willing to share them with relevant agencies. (source: Layer3 Intel)