Residential proxies: when an office device lends out your connection
Between October and November a research firm saw traffic from 28 residential proxy services exiting through the White House network. The same can happen in any office, firm or clinic: here is how it works, why it is a risk and how to check for it.
The case: the White House network
On 4 November the firm Layer3 Intel published an unusual analysis. From 5 October to 3 November 2026 its monitoring system exited onto the Internet through the network of the Executive Office of the President, the White House, 236 times: from 6 different addresses, on 26 of 30 days, through 28 different residential proxy services (Layer3 Intel).
Half of the traffic fell between 5 p.m. and midnight, Eastern time. According to the researchers this points to a person rather than a guest network: someone who stays on the network in the evening, with a device carrying proxy software. Anyone paying a few dollars to one of these services could route their own traffic through it.
What residential proxies are
A residential proxy routes a customer's traffic through someone else's connection, using an IP address that an ordinary provider assigned to a home or an office (FBI). To the sites being visited, the traffic appears to come from there. The services selling them need millions of devices, and they find them in three ways:
- Devices infected at the factory. The FBI has reported millions of TV boxes, projectors, digital picture frames and car systems, mostly from unknown brands, with the proxy software preinstalled or downloaded at first start-up (FBI).
- Apps that look harmless. In January 2026 Google counted more than 600 Android apps containing code from IPIDEA, one of the largest residential proxy providers (Help Net Security).
- Paid users. Some apps offer a few euros in exchange for unused bandwidth. Anyone who installs one on their phone and then joins the office Wi-Fi brings the proxy into the company.
Why it is a problem for a company
The first risk is that others use your address. In a single week of January 2026 Google saw more than 550 criminal and espionage groups using addresses from the IPIDEA network (Help Net Security). If their traffic leaves through your IP, it is your IP that ends up on blocklists: mail gets rejected, some services lock you out, and your connection shows up in the logs of an attack.
The second risk is more serious: the door into the internal network. The Kimwolf botnet infected more than 2 million Android devices, mostly unofficial smart TVs and set-top boxes, and spread through the local networks of devices running proxy software (The Hacker News). A badly built proxy service can give whoever buys it access to the other devices on the network: printers, NAS units, cameras, sometimes servers (Synthient).
Then there is the rest: bandwidth used up, a slower connection, and a device on your network controlled by someone else.
Where they hide in an office
| Where | Why it is at risk |
|---|---|
| TV boxes and screens in waiting or meeting rooms | Often unknown brands, bought on price, never updated |
| Projectors, digital picture frames, cheap cameras | These are the categories the FBI flagged for BADBOX 2.0 |
| Personal phones on the company Wi-Fi | A free app with proxy code brings strangers' traffic into your network |
| Browsers with free VPNs or extensions | Some free VPNs pay for themselves exactly this way; we cover it in our article on extensions |
What to do
- 01
Check your public addresses
Services such as Spur let you check whether an address shows up as a residential proxy exit; the free account includes 250 lookups a month (Spur). Do it for each site's connection.
- 02
Take an inventory of devices
List everything connected to the network, not just computers: TVs, projectors, cameras, phone systems, devices brought from home.
- 03
Separate the networks
Guests, personal phones and devices such as TVs and cameras go on a separate network that cannot see computers, servers and NAS units.
- 04
Buy trustworthy devices
No "unlocked" TV boxes or ones offering free content, no Android devices without Play Protect certification: these are the warning signs the FBI lists (FBI).
- 05
Watch outbound traffic
A firewall that logs outbound connections quickly reveals a device talking to hundreds of different addresses, even at night.
- 06
If you find something
Disconnect the device, reset or replace it, check the other devices on the same network and, if sensitive data was reachable, change the credentials.
How we work
At Cloudfactory we manage networks, firewalls and workstations for companies, professional firms and multi-site healthcare providers. When we review a network we start from an inventory of everything connected, separate guests and devices from the rest and check how each site's public addresses look from the outside.
If you want to know whether someone is using your office connection, get in touch: the first check takes a few minutes.
How we wrote this article
At Cloudfactory we also use artificial intelligence in our editorial work: it helps us find and cross-check sources, compare data, set up the structure and polish the language. The system we use is configured by us, with instructions, examples and procedures built around the way we write. Our team checked every source, corrected the text and approved the published version. The assessments and choices are Cloudfactory's, and we are accountable for them.
Frequently asked questions
Is a residential proxy a virus?
Not always in the strict sense: sometimes it is a declared component of an app, or a program that pays the user. But it uses your connection on behalf of strangers, and in many cases it is installed without informed consent.
How do I know there is a proxy on my network?
The most common signs are a public address flagged by checking services, outbound traffic to a very large number of different addresses, rejected mail, or sites that keep asking for anti-bot checks.
Is a guest network enough?
It greatly reduces the risk to the internal network, but the traffic still leaves through your public address. You also need to find which device generates it and remove it.
Does this affect medical practices too?
Yes, even more so: waiting rooms with TVs and patient Wi-Fi are typical, and the same network often has computers holding health data. The two networks must stay separate.
Sources
- Layer3 Intel, Residential Proxies Detected on White House Network (November 2026)
- FBI IC3, Alert I-060525-PSA, BADBOX 2.0 (June 2025)
- Help Net Security, Google disrupts proxy network used by 550+ threat groups (January 2026)
- The Hacker News, Kimwolf Android botnet infects over 2 million devices (January 2026)
- Synthient, A Broken System Fueling Botnets
- Spur, Residential proxy detection free IP lookup