Threat-intelligence firm Layer3 Intel has reported that internet addresses registered to the Executive Office of the President were among the exit points for traffic routed through public residential proxy services. The firm recorded 236 instances over a 30-day window but cautioned that its data does not identify a device, a person, or demonstrate access to internal White House systems.
The network in question, AS2650, is listed under the name EOP-ASN. Layer3 said its pipeline encountered the addresses while requesting global rotating access through public residential proxy services, rather than deliberately selecting the network. The firm stated that anyone could obtain similar access for a few dollars.
Layer3 observed activity on 26 of the 30 days between October 5 and November 3. It reported that roughly half the activity occurred between 5 p.m. and midnight Eastern time, with almost nothing in the early morning. The firm interpreted this evening pattern as suggesting a person's device running proxy software rather than a public guest Wi-Fi network.
Layer3 did not disclose the six public addresses it flagged. It said it backed up its activity logs and was willing to share them with relevant agencies. RuntimeWire reported that founder Sergiy Usatyuk told it Layer3 would not disclose the specific addresses because of the sensitivity of the findings and had not notified anyone. The firm warned that poorly secured proxy software could, in some circumstances, expose internal systems, but said an SDK would need to have the kind of flaw documented in earlier proxy research for that route into internal systems to exist. The published observations do not demonstrate access to internal White House systems, and CryptoSlate has not reviewed the raw logs. KrebsOnSecurity reported that the White House did not immediately respond to its request for comment.
Analysis
Why This Matters
- The discovery raises the possibility that adversarial actors could route malicious traffic through a network registered to the executive branch, complicating attribution and defence.
- If the evening timing pattern indicates a personal device, it suggests a broader vulnerability in how government-linked devices interact with commercial services.
- The conditional warning about internal access highlights a specific software supply-chain risk for high-value government networks.
Background
The Executive Office of the President (EOP) operates the AS2650 network, listed as EOP-ASN. Residential proxy services sell access to other devices' internet connections, making traffic appear to come from the proxy's network rather than the buyer's. Threat-intelligence firms monitor these trails to detect potential compromises or misuse of sensitive infrastructure.
What to Watch
- Whether Layer3 provides its logs or the specific addresses to federal law enforcement or cybersecurity agencies, and the outcome of any review.
- The response from commercial residential proxy services about how their networks might route traffic through sensitive government address blocks.
- Any statement or investigation from the White House or the Cybersecurity and Infrastructure Security Agency regarding internal devices or network hygiene.
Checked
12 claims in this story checked against 1 source: 12 supported.
Show each claim
- SupportedLayer3 Intel reported web traffic routed through a White House-linked network.CryptoSlate: “Threat-intelligence firm Layer3 Intel says public online services repeatedly sent its web traffic through a White House-linked network.”
- SupportedLayer3 recorded 236 observations between October 5 and November 3 across six internet addresses.CryptoSlate: “The company recorded 236 observations between Oct. 5 and Nov. 3 across six internet addresses and 28 services”
- SupportedThe observations do not identify the device or person behind any particular connection.CryptoSlate: “The registration does not identify the device or person behind any particular connection.”
- SupportedThe published observations do not demonstrate access to internal White House systems.CryptoSlate: “The published observations do not demonstrate access to internal White House systems.”
- SupportedAS2650 is listed under the name EOP-ASN.CryptoSlate: “AS2650 is listed under the name EOP-ASN in ARIN's registration record .”
- SupportedLayer3's pipeline encountered the network while requesting global rotating access through residential proxy services, rather than deliberately selecting AS2650.CryptoSlate: “Its pipeline encountered the network while requesting global rotating access through residential proxy services, the company said, rather than deliberately selecting AS2650.”
- SupportedLayer3 observed exits on 26 of the 30 days in its monitoring window.CryptoSlate: “Layer3 said it observed exits on 26 of the 30 days in its monitoring window.”
- SupportedRoughly half the activity occurred between 5 p.m. and midnight Eastern time, with almost none in the early morning.CryptoSlate: “Layer3 said about half the activity occurred between 5 p.m. and midnight Eastern, with almost none in the early morning.”
- SupportedLayer3 interpreted the evening pattern as suggesting a person's device running proxy software rather than public guest Wi-Fi.CryptoSlate: “It interpreted that pattern as suggesting a person's device running proxy software, rather than a public guest Wi-Fi network.”
- SupportedLayer3 did not disclose the six public addresses it flagged.CryptoSlate: “The company said those pages also identified the addresses as residential proxy exits, but it has not disclosed the six addresses in its published finding.”
- SupportedLayer3 warned that poorly secured proxy software could expose internal systems in some circumstances, and said that route would require an SDK flaw of the kind documented in earlier proxy research.CryptoSlate: “Layer3 warned that poorly secured proxy software can, in some circumstances, expose internal systems. Its warning about this network was conditional: an SDK would need to have the kind of flaw documented in earlier proxy research for that route into internal systems to exist.”
- SupportedRuntimeWire reported that founder Sergiy Usatyuk told it Layer3 would not disclose the specific addresses because of the findings' sensitivity and had not notified anyone.CryptoSlate: “RuntimeWire reported that founder Sergiy Usatyuk told it Layer3 would not disclose the specific addresses because of the sensitivity of the findings and had not notified anyone.”
