Researchers Discover White House Network IP Available for Rent Through 28 Proxy Services
White House network IPs were found available for rent via 28 residential proxy services.
Researchers discovered that 28 residential proxy services were renting IP addresses belonging to the White House network, allowing anyone to route web traffic through them. This activity, observed between October 5 and November 3, 2026, originated from AS2650, a network block registered to the Executive Office of the President. The findings suggest a personal device on the network may be running proxy software without the owner's knowledge, posing a security risk.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Layer3 Intel?
Get an email when a new story names Layer3 Intel, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA personal device connected to the Executive Office of the President's network appears to have been running proxy software — likely without the user's knowledge — allowing 28 commercial proxy services to rent out White House IP addresses to anonymous third parties. This represents a serious configuration and security awareness failure: an unmanaged or insufficiently monitored endpoint became an unwitting exit node for potentially adversarial traffic. The risk is twofold — sensitive government IP space was commoditized for anonymous browsing, and inbound/outbound traffic patterns associated with the White House network could be manipulated or observed. This incident underscores that even the most sensitive networks can be compromised by a single uninspected personal device, making endpoint visibility and user awareness non-negotiable.
What helps against this
How we list vendors- Cyber asset inventory
You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.
- Device management (MDM and UEM)
Every company laptop and phone is known, encrypted, locked down and up to date.
- Network detection and response (NDR)
Attackers moving between systems inside the network get seen.