Threat‑intelligence firm Layer3 Intel reported that its monitoring identified 236 instances of web traffic exiting through IP addresses linked to the White House’s Executive Office of the President (EOP). The observations span from Oct. 5 to Nov. 3, 2026, and involve 28 residential‑proxy services across six distinct IP addresses. According to the firm, the traffic was detected while requesting rotating access from public proxy providers, not by deliberately targeting the White House‑registered network.

White House‑Linked Address Block

The IP range in question is registered to AS2650, listed in ARIN’s database as EOP‑ASN. While the registration confirms the block’s affiliation with the Executive Office, it does not reveal the specific devices or users behind each connection. Layer3 cross‑checked the addresses with proxy‑detection services Spur and Synthient, which also flagged them as residential‑proxy exits. The firm chose not to disclose the exact IPs, citing sensitivity of the findings.

Traffic Patterns and Potential Risks

Layer3’s analysis shows that roughly half of the observed exits occurred between 5 p.m. and midnight Eastern time, with minimal activity in the early morning hours. The company interprets this pattern as indicative of individual devices running proxy software, rather than a public guest‑Wi‑Fi environment. It warns that insecure proxy SDKs could, in certain scenarios, expose internal systems, though the current data does not demonstrate any breach of White House networks.

Response and Next Steps

The White House has not responded to inquiries from CryptoSlate or KrebsOnSecurity regarding the report. Layer3 Intel indicated it has retained the raw logs and is prepared to share them with relevant authorities upon request. The firm also noted that anyone could obtain similar access by paying a few dollars to a residential‑proxy service, underscoring the broader security implications of widely available proxy infrastructure.

What to Watch Next

Regulators may scrutinize the security practices of residential‑proxy providers following these findings. Observers will be looking for any official comment from the Executive Office or a formal investigation into whether the proxy traffic poses a tangible threat to government networks. Additional research from threat‑intel firms could clarify whether the observed exits are isolated incidents or part of a larger pattern affecting other government‑affiliated address blocks.