Residential Proxies Detected on White House Network

The Residential Proxy Observatory, a groundbreaking tool unveiled recently, offers researchers a comprehensive global perspective on residential proxy and anonymized internet activity. During an investigation, the team observed residential proxy exit activity originating from AS2650, an IP address assigned to the Executive Office of the President, the agency responsible for managing the White House network.

To verify the findings, the team cross-referenced these addresses with other residential proxy detection services, such as Spur and Synthient. The public IP context pages confirmed these addresses as residential proxy exits, indicating that anyone can acquire access by signing up for a public residential proxy service, paying a nominal fee, and transmitting requests through it.

The discovery was made unintentionally while the team was testing the Observatory. Most of the activity occurs in the late afternoon to midnight, Eastern time, suggesting a consistent user rather than a public guest Wi-Fi network. The majority of the traffic is attributed to infected devices with proxy SDKs. Historical research has demonstrated that insecure proxy SDKs can facilitate internal network access and lateral movement, similar to how past botnets have proliferated.

Among the unexpected findings, the Observatory also detected residential proxies in remote locations worldwide, including Saint Helena, Ascension, and Tristan da Cunha, as well as Antarctica. All of these instances originate from a Cloudflare WARP address linked to McMurdo Station. The Observatory's tracking of residential proxy and anonymization infrastructure globally reveals that no corner of the world remains secure from potential threats.