White House Network Detected in Global Residential Proxy Traffic

Ce qui s’est passé

Layer3’s Residential Proxy Observatory recorded 236 connections leaving the Autonomous System AS2650 (registered to the Executive Office of the President) via residential proxy services between 5 Oct and 3 Nov 2026. The traffic originated from six IP addresses, was present on 26 of the 30 days, and involved 28 distinct residential‑proxy providers. The timing (mostly 5 p.m.–midnight ET) points to a device on the White House network running a proxy SDK rather than a public guest Wi‑Fi. No wrongdoing by White House staff was alleged, but the presence of a proxy exit raises concerns about inadvertent exposure of internal systems.

Pourquoi c’est important pour la confiance et la conformité

• The finding demonstrates why continuous outbound‑traffic monitoring and strict egress filtering are essential control objectives for demonstrating trust and control assurance across frameworks.
• Map outbound‑traffic monitoring to the control objective of continuous logging and anomaly detection.
• Use Verisq’s evidence‑collection tools to provide defensible audit artifacts for egress‑filter enforcement.

Who is affected

Recommended actions

1. Audit outbound traffic logs for proxy‑related destinations and block known residential‑proxy IP ranges.
2. Implement real‑time anomaly detection for unusual egress patterns and enforce network segmentation.