This also puts some of the troubling reports that politicians were bringing phones into SCIFs into context…
On a server that used to get below 1k HTTP requests a day, I've had several cases of mass scraping from these botnets exceeding 100req/s. The web is getting harder and harder to use due to all the anti-bot mechanisms site operators had to put up.
How is DDOSing every site on the web benign?
A compromised device inside the White House network could presumably be doing something _much_ worse than participating in a DDOS against random websites.
If something is on their network, they know about it. They have a bigger budget and more bodies to throw at the problem than you want to believe.
https://techcrunch.com/2025/03/11/doge-axes-cisa-red-team-st...
Perhaps some of them annoyed the President's illegally-appointed mega-donor, if they spoke out against giving root access to all his unvetted junior flunkies.
https://www.npr.org/2025/04/15/nx-s1-5355896/doge-nlrb-elon-...
> Berulis alleged in the affidavit that there attempted logins to NLRB systems from an IP address in Russia in the days after DOGE accessed the systems. He told Reuters Tuesday that the attempted logins apparently included correct username and password combinations but were rejected by location-related conditional access policies.
* https://www.reuters.com/technology/cybersecurity/whistleblow...
* https://www.npr.org/2025/04/15/nx-s1-5355896/doge-nlrb-elon-...
It’s not just the pay, there’s a lot of structural elements that mean that the potential talent pool is less than desired.
Or let me sum it up for you. The government doesn't have the money to employ top security experts and top security experts don't actually want to work for the government.
In fact avoiding therapy at all costs is a good sign of trouble.
Indeed. I recently set up a bot on my local machine that I can interact with via Telegram. I gave it the ability to retrieve the contents of a URL via Playwright (with modifications). Basic things like getting the Readability view and getting the site as Markdown with links.
I was essentially mimicking the feature OpenAI etc offer where it can do a web search for you and get you the answer you seek. I just didn't want to pay a company for that feature.
It's not autonomous. It only acts when I tell it to. The actual search is via the Kagi API, but the URL contents is via Playwright. I also ensured it can't do lots of requests at a time. There's a mandatory (random) sleep of between 1 and 5 seconds between two requests.
In less than a week, I've been flagged. When I do a Google search (as a human), I have to prove I'm human. Many sites have simply blocked me - I can't buy stuff from various vendors[1], I cannot access several news sites, etc.
The thing is, I didn't really access that many sites with the bot! At most it's the equivalent of someone mildly addicted to the web. Yet they caught me quickly.
Obviously, I disabled the bot's capability to get site content. I wonder how long my IP will be in the blacklist.
I know some people will say "Good riddance" to the outcome and to what I did. I'd love to have a real, serious discussion on whether what I did was immoral. But whatever your thoughts on the matter, do ponder over the fact that the system has made it hard for average Joes like you and me to have this "feature", but if you pay a giant tech company a monthly fee, you can have it.
[1] Thankfully, Amazon didn't block me. In the past I'd avoid them, but now I'm in the dilemma where I don't want to buy stuff from sites that make it difficult for me to buy stuff from them!
I mean politicians are so addicted to twitter the nsa makes special phones…
It's always better to protect politicians from someone else
There is no evidence that physically ties this to the WH. It could be in a security lab for all they know. Or a guest network for the news media.
They don't need to be physically inside a specific building to be a networking security problem.
The core issue is whether an outsider has bypassed your firewall and can send+receive traffic from a node which is getting more trust than it deserves. If they've compromised the computer's microphone/camera/wifi-control that's an additional problem.
That seems worse.
https://darknetdiaries.com/episode/172/
There's a transcript if you want to read, not listen. At the start, you'll be "hey! I gotta get me one!" and later you'll be like "burn it with fire!"
Not sure why my IP is listed as a residential proxy.
It should be a balancing act though, somewhere between what you said and my first sentence.
Rate limiting, or additional layers of input sanitisation for IP addresses known to have been malicious in the past.
It's unfortunate that good users will have to endure some difficulties because of bad users on the same network, but if security is the priority, then measures must be taken, you shouldn't just leave to door open to potentially known bad users / traffic.
IPv4 is a shared resource, but some ranges have worse reputations than others, and all are owned by organisations that have the ability to monitor and filter for malicious traffic. It gets into a fraught discussion about censorship, but it is possible for network owners to monitor for, and block / restrict traffic detected as 'bad'. It's just a matter of cost and scale, and those that put the effort in should have their users rewarded with fewer 'trust-issues' roadblocks.
If there's anything there, monitor your network to figure out exactly what
<li class="...">
<div class="...">
<div class="..."></div>
</div>
<span class="text-sm">Residential Proxy</span>
<span class="sr-only">Not detected</span>
</li>I was aghast when my partner connected a pet watering bowl to the WiFi.
https://support.frameo.com/hc/en-us/articles/23433637149842-...
https://cloud.google.com/blog/topics/threat-intelligence/goo...
The biggest danger is that said proxies can also allow access to internal networks, and as you might guess from how they are installed, are not usually operated by the most scrupulous of organizations.
Beyond that gross metric you're getting into capturing traffic and decoding it.
Person buys a product, or downloads some software - that unknowing to them, was reaching out to a central server elsewhere to establish a network tunnel. And over that tunnel, the other server routes traffic onto that person's home network. Which can then of course go onto the internet, and it appears like the traffic originated from their home internet connection.
Other people rent access to this network. The goal being, you have surreptitious access to appear as any one of tens of thousands of home network IP addresses on the public internet. Bad guys can use this to rotate through many different IP addresses when their access gets blocked because of malicious (or benign but unwanted) behavior on the internet. Residential IP addresses are more 'valuable' because they don't have the negative connotation that datacentre and commercial IPs can have, and they can be spread geographically or across many ISPs.
A very common way for people being a part of these residential proxy networks is by buying dodgy streaming boxes, and also installing shady apps on TV app marketplaces.
Such as ignoring web scraping countermeasures, and DDoS.
* I initially thought this meant someone in the WH network was using commercial proxies to appear as if they were exiting from a different network (which would align with "some user is firing up a proxy on their phone to exit in a different location")
* But then the description of residential proxies seemed to align more with traffic hitting an endpoint in the White House, and _exiting_ from the network there. But this didn't explain the timing (why isn't it 24/7).
* Finally it sounds like some person, legitimately on the WH network, has a device (cell phone, TV, whatever) that, when activated, is proxying outside traffic into the WH network.
Many questionable TV streaming boxes pretend to deliver you video, but in reality they are also piggy backing on your personal ISP to power those companies.
> Residential proxy services sell access to everyday devices, letting customers send traffic through them so it appears to come from that device's network.
If you click the AS2650 link (1) in the article, you will learn that AS2650 is announcing 65,792 addresses in 5 prefixes. Roughly 40-70% of the IP addresses in a typical corporate ASN are associated with actual computers humans are using. Let's go with 40%. You're looking at 26,317 people. Assume they're all adults (please, dear lord, let them all be adults). 3-8% of the workforce is in IT. Let's go with 3%, that's 789 people. I'm guessing one of those 789 folks has thought this through and has a few VLANs set up to keep VIP and family-of-VIP, pattern of life stuff in a box.
As for the thesis that these are all window-licking low-IQ goons, that's just not how the US government cultivates its workforce. It's no accident that Harvard Business School characterizes themselves as "the West Point of capitalism." West Point isn't someone else's anything. The US Government is in it for the long haul and captures folks young with impossible-to-resist opportunities like the military academies, ROTC, SMART scholars, etc. Let's just stick with the academies: 12,000 people a year who were likely competitive for the Ivies, Division 1 athletics, or both, but chose their parents poorly. Free, top tier education and a job is very attractive for kids from fly-over states. Hell, in big states like California, New York, and Texas, it can actually be even more competitive. Something north of 60% of those graduates stick around for at least 20 years of service (because the high three pension + VA benefits is a pretty nice floor for retirement when your options back home are line supervisor at the cotton mill, the sugar mill, the coal mine, or ramp manager for United), usually addicted to the crazy level of mission. Sort of the opposite of finance where people really struggle mentally if they're not making pallets of money at an accelerating rate. Government service pays dogshit, but the work can super interesting, especially as you gain seniority.
Those folks then often loop back into other agencies and do another 20 years. Are there goombas in the Government? Oh, for sure. Absolutely. But it's roughly the same fraction as any other workforce in the rest of the economy.
But by the time you get to top tier stuff like the White House staff, the sorting function has been strong. To make the point: you also see top tier folks in other organizations with government stink on them. I can think of at least two directors at Google who are prior military. A fat pile of McKinsey folks. Something like 8% of Fortune 500 CEOs have served in the military, above the national average (6-7% of Americans have served in the military at some point).
And it's hilarious to watch people simultaneously assert the government is a bunch of idiots, and then get all excited about fighter pilots, the CIA, the CDC, ambassadors, the NIH. As though those people just appeared from the head of Zeus fully formed. Where do you think they worked when they were young? They were stamping visas for the Department of State in some embassy in central Asia. They were rolling blankets and digging wells in Gambia for the Peace Corps. Checking corporate filings for mostly unknown companies at SEC. Studying aerospace engineering at Embry Riddle and then flying cleared checks between clearing houses across the state overnight in a Cessna.
Most likely scenario is a 20-something holdover from DOGE who accidentally had his phone p0wned while downloading groyper memes.
https://lieu.house.gov/media-center/in-the-news/what-can-we-...
Let me guess. The SDK being used does properly handle this and this whole article is anti residential proxy FUD.
I buy and use residential proxies, though.
While they have grown a bit too much, they are a natural response to the absurd amount of effort every website is pouring into anti-scraping tech.
Aren't they almost always run unknowingly, by people tricked into running them?
Ethically, if someone just wants to play a free game and doesn't care about it, is it okay? How knowledgable does a user have to be in order to have informed consent?
Betcha that means there was "consent" language on page 55 of some click-through EULA.
Help me understand. As far as I'm aware, these residential proxies are almost always malware.
> and can be used for extra anonymity
Great, so you can conduct illegal transactions and have some unsuspecting grandma take the blame and have her front door kicked in?
Technically correct statement though
They didn't just connect a coffee pot to their WiFi one day.
Residential proxies are in many cases at least shady, both on the side of who uses them and for what and on providers that are often not above using dark pattern to hide them in some innocuous app for a smart-whatever that silently runs a proxy on a unaware user's connection. And in many places in the world if illegal stuff in done using your connection you are liable, regardless if you knew about it.
But getting around it sure is annoying, sometimes I get flagged IP's from Comcast and can't visit sites like costco.com despite not doing any questionable stuff on my network.
So important that we have to trick people into using them. Remember when folks were running SETI@Home? Of course you do, because it was widely thought to be a good thing, and folks willingly signed up.
How many would buy the "box" if the advertising were honest about what's actually in the box?
In fairness to me, I did say "Most tools can be dual-use. Residential proxies are also used by malevolent actors to hack infrastructure or financial institutions and let some other poor soul get investigated for it. This is why we can't have nice things."
So it could be Alice. I know Alice has good intentions. It could be Bob, we know what Bob is up to but I will give him a pass regardless because Bob did nice things in the past. But then there is Mallory ... Mallory Malfoid is up to no good. I need to know which IP's are used by Alice and Bob so I can exclude them from my automated protections. Mallory will automatically get rate limited to 16kb/s, 1 HTTP request every 5 seconds and if they bounce around different residential proxies they get redirected to a bathtub regardless of which residential proxy they use.
In no world does "KYC" mean "expose your customer list to the whole world", let alone undermine the entire purpose of the product you're selling.
"I want to dox all of the customers of a proxy provider" is just an unreasonable ask. We wouldn't expect or want ISPs or VPNs or telecoms to do this.
Maybe some people do not want to provide their entire website as free training material to [insert LLM lab here]?
> Most of the activity happens in the evening, Eastern time: about half of it falls between 5 p.m. and midnight, and almost none happens in the early morning. That pattern suggests a person rather than a public guest Wi-Fi network: someone regularly on the White House network late into the evening, whose device is infected with a proxy SDK. Our data shows the exits, not the device or the person behind them.
There really aren’t very many candidates for who that person might be and it really seems like it would be someone who, I don’t know, maybe lives where the traffic is originating.
If it was someone who lived there it wouldn’t be exclusively that time period. Why wouldn’t it happen overnight or in the morning or any other time of day?