Residential proxy traffic exited the White House network 236 times in 30 days, researchers say

Matt Johansen (@mattjay) put the claim bluntly in a post on X on November 4th: someone at the White House between 5 p.m. and midnight has compromised devices, or devices providing residential proxy access to botnets. The underlying research is more precise, and more limited, than that summary. It shows proxy traffic exiting through White House network addresses repeatedly over a month. It does not identify a device, a person, or a botnet operator.

Johansen is a Reddit security leader whose own site says he has worked in security for two decades and currently serves as a Reddit security architect. A Tines profile also describes his day job as Head of Software Security at Reddit and his earlier work running a threat research center at WhiteHat Security. That background makes the post worth checking. It does not turn the screenshot he shared into proof of who owns the device behind the traffic.

What Layer3 Intel actually measured

The post links to research from Layer3 Intel, a company that maps residential proxy and anonymization infrastructure. In its November 4th report, Layer3 Intel says it noticed residential proxy exit activity on AS2650 while reviewing its Residential Proxy Observatory. The company says AS2650 is registered to the Executive Office of the President, the federal agency that hosts the White House network.

From October 5th to November 3rd, Layer3 Intel says its enumeration pipeline exited through the White House network 236 separate times. Those exits came from six addresses on 26 of the 30 days in the observation window. Twenty eight separate residential proxy services were able to exit through the network, according to the report.

Residential proxy services sell access to everyday devices, letting customers send traffic through them so it appears to come from that device's network. Layer3 Intel says anybody could obtain the same kind of access by signing up for a public residential proxy service, paying a few dollars, and sending requests through it. The company says it did not selectively target the White House network and caught the exits by chance while requesting global rotating access through proxy services.

Layer3 Intel also says it checked the addresses against other residential proxy detection services, including Spur and Synthient, and that their public IP context pages independently identify the addresses as residential proxy exits. That cross-check supports the classification of the public addresses as proxy exits. It still leaves the harder questions open: which device sat behind the address, how proxy software got onto it, whether the owner knew, and whether the device belonged to a White House employee, a contractor, a guest, or another authorized network user.

Layer3 Intel founder Sergiy Usatyuk told RuntimeWire the company finds these exits by signing up to residential proxy services, sending requests through them to its own servers and recording which IP addresses each service exits from. He said Layer3 will not disclose the specific IP addresses because of the sensitive nature of the findings, and that it has not notified anyone about them.

The evening pattern is the sharpest clue, and the weakest proof

The timing is what pushed Johansen toward the compromised-device reading. Layer3 Intel says most of the activity happens in the evening Eastern time, with about half falling between 5 p.m. and midnight and almost none in the early morning. The company says that pattern suggests a person rather than a public guest Wi-Fi network: someone regularly on the White House network late into the evening whose device is infected with a proxy SDK.

Then Layer3 Intel states the limit in plain language: "Our data shows the exits, not the device or the person behind them." That sentence should govern how the claim travels. An autonomous system number identifies the network announcing the public addresses. It does not, by itself, name the handset, laptop, television box, router, or other endpoint behind network address translation. Six public addresses can represent many devices over time, and one active proxy exit can be enough for outside traffic to appear to originate from the White House network.

The report also avoids saying the device was enrolled without consent. Residential proxy software reaches devices through more than one route. Some users install apps that disclose proxy participation poorly, some install software that hides it, and some devices are compromised outright. Johansen used "compromised devices" first and then softened the claim to devices "providing residential proxy access to botnets." Layer3 Intel's own wording is narrower: residential proxy exit activity, plus an inference that a proxy SDK is present.

Why security teams care about an exit node on a sensitive network

A proxy exit on a sensitive network creates two separate risks. The first is reputation and attribution. Outside services see traffic coming from an Executive Office of the President address range, even when the person generating the traffic bought access from a proxy service elsewhere. The second risk is internal reach. Layer3 Intel notes that past research has shown poorly secured proxy SDKs can allow internal network access and lateral movement. The company points to Synthient research on Kimwolf, which it says reached at least 2 million devices, mostly Android devices with an exposed Android Debug Bridge service, through residential proxy networks. Synthient itself assesses with high confidence that Kimwolf surpassed 2 million infected devices, primarily targeting Android devices running an exposed ADB service via residential proxies.

That precedent explains the concern without proving the White House device has the same flaw. Layer3 Intel frames the danger conditionally: if an SDK on this network has the same kind of flaw, anyone buying proxy access could use it to reach internal systems. No evidence in the report shows that proxy customers reached internal White House systems, scanned internal addresses, or moved laterally. The observed fact is outbound exit activity through the network's public addresses.

The broader proxy market gives investigators reason to take undisclosed SDK enrollment seriously. Google said it disrupted IPIDEA in January 2026 after finding a network that let bad actors hijack access to people's home internet connections to conduct criminal activity that could not be traced to them. Google also said Play Protect would warn users if an app contains bad IPIDEA code and remove it from a device or block installation. The FBI's 911 S5 guidance described a residential proxy service and botnet with more than 19 million compromised IP addresses in more than 190 countries. The FBI said 911 S5 distributed malicious proxy backdoors built into VPN applications, with free illegitimate VPNs packaged inside pirated games and software.

Those cases establish how proxy networks can be built from devices whose owners did not knowingly agree to rent out their connection. They do not establish that the White House activity came from malware, a free VPN, a pirated app, or a botnet in the 911 S5 mold. Layer3 Intel found 28 services able to exit through the network, which could reflect one device enrolled through an SDK resold across services, several devices, or a mix that outside observation cannot separate.

Layer3 Intel says it has backed up the raw logs and is willing to share them with relevant agencies through its contact page. That is the right next step, because the identification work has to happen inside the network: DHCP and NAT records, device inventory, Wi-Fi association logs, endpoint telemetry, and the times each public address mapped to an internal host. Outside researchers can keep proving that proxy customers exited through AS2650. Only the network operator can tie those exits to a device and determine whether an app, an SDK, or malware put it there.