Proxy services routed traffic through White House-linked IPs

Threat-intelligence firm Layer3 Intel recorded 236 instances of traffic passing through six internet addresses registered to the Executive Office of the President. The activity occurred across 28 residential proxy services and was observed on 26 of the 30 days in the monitoring period.

Residential proxy services route customers’ online requests through other devices’ internet connections, making the traffic appear to originate from those connections. Layer3 encountered the addresses while requesting rotating global access through public proxy services, rather than selecting the EOP-linked network. Similar access can be purchased for a few dollars, according to the company.

The American Registry for Internet Numbers lists AS2650 under EOP-ASN. That registration identifies the organization associated with the address space, but does not identify the device using a particular address or the person behind the traffic.

About half of the recorded activity occurred between 5 p.m. and midnight Eastern time, with almost no activity during the early morning. Layer3 described the pattern as consistent with an individual device running proxy software rather than public guest Wi-Fi.

One possible explanation identified by the company was a device infected with, or running, a proxy software development kit. The data does not identify the device or its user, and does not establish that the traffic involved an attack or access to internal White House systems.

Layer3 also warned that poorly secured proxy software can expose internal systems in some circumstances. Such access would require a vulnerability of the type documented in earlier proxy research. The company’s findings do not establish that such a vulnerability existed on the EOP-linked network.

Layer3 cross-checked the six addresses with public data from the proxy-detection firms Spur and Synthient. Both services also identified the addresses as residential proxy exits. Layer3 has not published the addresses but reported that it preserved its logs and was prepared to share them with relevant government agencies.

The number of recorded exits does not show how many devices were involved. Repeated observations alone do not establish unauthorized access.