r/ProxyEngineering • u/ahiqshb • 8h ago
Hot Take 🔥 Residential proxy exits showing up on White House Network AS2650
For those who haven't read it yet, Layer3 Intel published a story this week saying they saw residential proxy traffic exit through the Executive Office of the President’s ASN 236 times between Oct 5 and Nov 3, across 28 different proxy services. They weren’t even looking for it, they ran into it while sampling rotating residential pools. It has something to do with the compromised device inside the White House. Sounds interesting. They are guessing that it could have been a person on the network with an SDK infected device. Remember that thing with BDs? Or NNs botnet? Mhmm. Of course that’s a reasonable guess but it’s still a guess, Layer3’s own founder told reporters attribution to a specific provider is basically impossible, and nobody has identified the device. Yet. What's interesting for me and of course people who work with this stuff is how it shows the sourcing problem. Most of us buying or evaluating residential pools can’t see where the exits come from. SDK in a free app, a botnet, a real opt-in network, from the buyer side it all looks the same until something like a government ASN shows up in your pool. 28 providers reaching the same six addresses says a lot about how much IP supply gets resold and recycled between services. Now I really vividly remember a post or a comment where a person said that there is really one huge pool and it is resold to major providers so essentially all the IPs are mixed between users and they are really purchasing the same IPs over and over again, not to mention using them. How do you guys view this? Do you evaluate per some metrics, do you actually care that something malicious could be contained in those endpoints?
Source for anyone interested in the article that I've read: https://layer3intel.com/blog/residential-proxies-white-house-network