Residential proxies detected on White House network
- ID
- 43167
- Status
- summarized
- Published
- 05 Nov 2026, 4:45 AM
- Fetched
- 05 Nov 2026, 6:49 PM
- Provider
- Hacker News
- Category
- dev-community
- Original URL
- https://layer3intel.com/blog/residential-proxies-white-house-network
- Source URL
- https://hnrss.org/best
Summary
- Score
- 6.0
- Created
- 05 Nov 2026, 6:50 PM
- Tags
- Audience
- developersai_agent_userssaas_startup_founders
What happened
Layer3 Intel's Residential Proxy Observatory recorded 236 residential-proxy exits through AS2650—registered to the Executive Office of the President—from 6 addresses on 26 of 30 days between October 5 and November 3, 2026, across 28 separate proxy services. The exits clustered between 5 p.m. and midnight Eastern, were independently flagged by Spur and Synthient, and the article notes that anyone paying a few dollars for rotating residential proxy access could obtain similar traffic. It also cites the Kimwolf botnet reaching at least 2 million mostly Android devices via exposed ADB and reports 413 addresses and 32,000+ observations in Saint Helena, Ascension and Tristan da Cunha.
Why it matters
If you use residential proxies for scraping, price monitoring, or agent browsing, treat the exit IP as an untrusted device: this write-up shows 28 proxy services exiting through a White House network address, and it links proxy SDK flaws to the Kimwolf botnet's 2 million Android devices. Check whether your providers publish exit-node provenance and avoid routing auth tokens or internal API calls through rotating residential pools.
Discussion angle
What due diligence would you require from a residential proxy vendor before letting an agent or scraper use it—and would a 236-exit/30-day detection like this change your mind?