Cheap online services routed web traffic through a White House-linked network, researchers say

Threat-intelligence firm Layer3 Intel says public online services repeatedly sent its web traffic through a White House-linked network. The company recorded 236 observations between Oct. 5 and Nov. 3 across six internet addresses and 28 services, raising concern about outsiders using government-linked internet connections.

Layer3 identifies the network as hosting White House connectivity. AS2650 is listed under the name EOP-ASN in ARIN's registration record. The registration does not identify the device or person behind any particular connection.

Residential proxy services sell customers access to other devices' internet connections. As Layer3 describes the arrangement, traffic sent through a proxy appears to come from the device's network, rather than the customer buying access.

In its Nov. 4 report, Layer3 said it observed exits on 26 of the 30 days in its monitoring window. Its pipeline encountered the network while requesting global rotating access through residential proxy services, the company said, rather than deliberately selecting AS2650.

Layer3 said anyone could obtain the same type of access by paying a public residential proxy service a few dollars.

Layer3 said it cross-checked the addresses against public IP context pages from proxy-detection firms Spur and Synthient. The company said those pages also identified the addresses as residential proxy exits, but it has not disclosed the six addresses in its published finding.

Those figures describe recorded exits, public addresses and proxy services. They do not establish how many devices were involved or that each observation was an attack.

Layer3 said about half the activity occurred between 5 p.m. and midnight Eastern, with almost none in the early morning. It interpreted that pattern as suggesting a person's device running proxy software, rather than a public guest Wi-Fi network.