Security firm Layer3 Intel reported on November 4, 2026 that it observed residential-proxy exit activity on AS2650, a network it says is registered to the Executive Office of the President and hosts the White House network. The report drew 1,254 points on Hacker News. The firm says its data shows “the exits, not the device or the person behind them,” and the post includes no government response.

What the firm says it saw

  • From October 5 to November 3, 2026: 236 exits from 6 addresses, on 26 of 30 days.
  • 28 residential-proxy services able to exit through the network.
  • About half of the activity between 5 p.m. and midnight Eastern, and almost none in the early morning.

How it was detected

Layer3 says its Residential Proxy Observatory showed the activity while its team was reviewing data. It says it used public residential-proxy services with global rotating access, that it “did not selectively target this network,” and that “We caught this by chance.” It says it checked the addresses against Spur and Synthient, which it says independently identify them as residential-proxy exits.

The firm’s interpretation

Layer3 says the evening pattern “suggests a person rather than a public guest Wi-Fi network,” with a device that may be infected by a proxy software development kit. It cites Synthient’s research on the Kimwolf botnet, which it says reached at least two million devices through residential-proxy networks, and argues that poorly secured proxy SDKs can allow internal-network access and lateral movement. It warns that if this network has such a flaw, “anyone buying proxy access could use it to reach internal systems.” The firm notes that access to residential-proxy services is public and costs “a few dollars,” and says it has backed up raw logs and will share them with “relevant agencies” on request.

Other findings in the report

The post also reports residential-proxy activity in remote territories, including Saint Helena (413 addresses and more than 32,000 observations) and Antarctica, which the firm presents as a broader point about its observatory.

Sources and notes

This post is based on Layer3 Intel’s report (November 4, 2026) and Hacker News counts. It is a single-source report by a security vendor; Lens did not review the underlying logs, the Spur or Synthient data, or the registration of AS2650, and found no response from the White House or other agencies. The firm itself says the data does not identify the device or the person.

Image: the White House and North Lawn under a double rainbow, May 11, 2024, by The White House (Official White House Photo by Katie Ricks) via Wikimedia Commons, public domain (US federal government work); cropped. Illustrative photo; it does not show the events described.