Security researchers at Layer3 Intel published telemetry from their newly deployed Residential Proxy Observatory revealing consistent unauthorized commercial proxy exits operating within autonomous system AS2650, assigned to the Executive Office of the President.
Monitoring conducted between October 5 and November 3, 2026 recorded 236 confirmed residential proxy exits originating from six distinct IP addresses within the federal allocation. These connections were captured across 26 of the 30 monitored days, with 28 separate commercial residential proxy vendors facilitating egress.
The researchers confirmed the findings against independent network intelligence databases, including Spur and Synthient, which corroborated that the affected IP addresses functioned as active exit points. Commercial proxy services typically recruit exits by bundling proxyware SDKs into consumer software, freeware utilities, or VPN extensions that monetize host bandwidth without full user awareness.
Temporal analysis of the traffic revealed a distinctive operational profile: more than 50 percent of the proxy activity occurred between 5:00 PM and midnight Eastern Time, with traffic dropping near zero in early morning hours. This pattern strongly indicates an infected endpoint operated by staff during evening hours rather than an open public guest Wi-Fi gateway.
Because commercial proxy networks sell rotating access to anyone with a credit card, malicious third parties could execute scraping, credential testing, or illicit reconnaissance that appears to target destinations from legitimate Executive Office of the President IP addresses. Federal authorities have not yet issued a public comment regarding endpoint remediation.