# Proxyware at the White House, and on 58% of education networks

Our 90-day proxy list first saw one of the White House network's six exits on August 24. In 30 days, 58% of education networks had an exit too.

On November 4, Layer3 Intel [reported residential proxy exits on AS2650](https://layer3intel.com/blog/residential-proxies-white-house-network), the network of the Executive Office of the President: six addresses, on 26 of the 30 days from October 5 to November 3, sold through 28 proxy services and busiest in the evening, Eastern time. Synthient, as [Ipregistry reported](https://ipregistry.co/blog/white-house-residential-proxy-exits-as2650) the next day, said it traced the activity to Windows machines running a proxy SDK.

Our 30-day residential proxy list, built November 8 from exits seen October 9 to November 7, held six addresses on [AS2650](https://internetdata.io/AS2650), all in one /24. Our 90-day list first saw one of them on August 24, six weeks before Layer3's window opens, and last saw one on November 4. Ipregistry wrote that it ran all 256 addresses of that /24 through its API on the morning of November 5, and none had its residential proxy flag set.

The White House is one network. Of the 4,649 education networks announcing IPv4 on November 7, the universities, schools and research networks, 2,709 (58.3%) had at least one residential proxy exit in the same 30 days.

## How a managed network becomes an exit

Proxyware sells a device's internet connection to a residential proxy network. It comes as a bandwidth-sharing app, or as an SDK bundled into a free app. The proxy network rents the connection to anyone who pays a few dollars, and the buyer's requests leave through whatever network the device sits on. The device dials out, so no firewall rule has to change, and on an office or campus network each request leaves through the network's shared NAT address.

That address is what a list like ours holds. A match says some device behind it relayed proxy traffic; which device, and whose, takes the network's own logs. The risk can reach past the address, too. In January, Synthient showed how the [Kimwolf botnet](https://synthient.com/blog/a-broken-system-fueling-botnets) grew past 2 million devices, mostly Android devices with an exposed debug service, by attacking them through residential proxy networks. Layer3 raises the same possibility for AS2650. Google's [XCPE takedown](https://internetdata.io/blog/badbox-xcpe-residential-proxy-pool), announced November 2, went after the supply side: TV boxes whose own firmware loaded proxy software.

## Exits by network type

Each exit address is placed in the network that announces it with [IP ASN](https://internetdata.io/databases/ip-asn), and the network's [type](https://docs.internetdata.io/database/asn/asn) comes from [ASN](https://internetdata.io/databases/asn):

| Network type | Networks announcing IPv4 | With an exit in 30 days | Share | Exit addresses | Exits per 100,000 announced addresses |
|---|---|---|---|---|---|
| ISP | 36,834 | 26,885 | 73.0% | 33,542,203 | 1,680 |
| Education | 4,649 | 2,709 | 58.3% | 75,156 | 38 |
| Government | 4,446 | 1,297 | 29.2% | 79,881 | 23 |
| Hosting | 8,092 | 2,126 | 26.3% | 284,570 | 62 |
| Business | 25,864 | 2,861 | 11.1% | 122,129 | 90 |

Per address, education networks had 45 times fewer exits than ISPs. Of the 2,709 education networks with an exit, 641 had a single exit address, and 146 had 100 or more.

## Education networks

In the United States, 1,080 of 1,869 education networks (57.8%) had an exit, 17,045 exits between them. The most sat on the state research and education networks that carry many campuses: CENIC with 421, Merit with 316 and MCNC with 309. By country, the US had the most education exits, then South Korea (3,880), China (3,826) and Brazil (3,340).

Worldwide, the ten education networks with the most exits were all national research networks:

| Network | Country | Exit addresses |
|---|---|---|
| CERNET | China | 3,768 |
| KISTI | South Korea | 2,036 |
| TANet | Taiwan | 1,995 |
| Jisc | United Kingdom | 1,613 |
| DFN | Germany | 1,098 |
| ULAKBIM | Turkey | 1,055 |
| SURF | Netherlands | 858 |
| RNP | Brazil | 746 |
| GARR | Italy | 739 |
| KIFU | Hungary | 659 |

## Government

Our ASN database types a network as government when a government body, agency or armed service runs it, and in many countries the state runs the telephone company. The four government networks with the most exits sell home broadband: Ecuador's CNT (23,545), Costa Rica's ICE (11,969), Cali's municipal utility EMCALI (9,178) and Lebanon's OGERO (4,517). Together they held 62% of the government row, and exits are expected there, as on any ISP. US cities that sell power and fiber add more, such as Clarksville's electric department with 616.

The 54 government networks with an exit whose names mark them as telecom, power or broadband operators held 63,834 of the row's exits, 80%. The other 1,243 held 16,047, a rough ceiling for agency networks: a city that sells broadband under its own name stays in that count, and a name match can't sort every network. Among the agency and ministry networks are Thailand's Ministry of Education (2,199), New York City's Board of Education (225), the State of North Dakota's IT department (46), the State of Arkansas's Division of Information Systems (38) and AS2650 (6).

## Check your own network

- Take every range your networks announce from IP ASN, which lists each route by its origin AS, and look up which addresses in [Residential Proxy IP](https://internetdata.io/databases/residential-proxy-ip) fall inside them.
- Use a long window. AS2650's six addresses were each seen on 1 to 4 of the 30 days, so a [30-day](https://docs.internetdata.io/database/resproxy-ip/resproxy-ip-30d) or [90-day](https://docs.internetdata.io/database/resproxy-ip/resproxy-ip-90d) list holds what a one-day list misses on most days.
- A match is a device to find, not proof of a breach. Each address comes with the dates it was first and last seen in the window, which tell you which days of NAT logs to search for the device, and then for the app or SDK on it.

## For fraud and risk teams

A rule that trusts a network because of its type, such as a student discount checked by campus network or an exemption for government traffic, lets these exits through. Ipregistry made the same point: a network's type says who holds the block, and nothing about whose traffic one address carries. Check the address itself against a proxy list on every network type, and match the exact address, since one exit doesn't make its /24 a proxy, as our [false-positive count](https://internetdata.io/blog/residential-proxy-false-positives) showed. When a [residential proxy attack](https://internetdata.io/blog/residential-proxy-attack) scraped us, our 90-day list, as it stood the day before, already held 90.9% of its addresses.

## How we counted

- Every IPv4 address in Residential Proxy IP's 30-day list built November 8, 2026, from exits seen October 9 to November 7: 34,105,126 addresses. IPv6 isn't included.
- Networks and their routes are from IP ASN's November 7 build, and their types from ASN's. 1,187 addresses sat in no announced route and are left out.
- A network counts when it announces IPv4 and has a type in ASN: 79,885 did, and 35,878 had at least one exit. Exits per 100,000 announced addresses divides a type's exits by the IPv4 its networks announce.
- The government operators are a match on network names, checked by hand for the networks with the most exits.

## Getting access

[Residential Proxy IP](https://internetdata.io/databases/residential-proxy-ip) ships each address with when it was first and last seen and on what share of days, rebuilt daily in windows from 1 day to 90. It has no sample: [talk to us](https://internetdata.io/contact) to evaluate it, and see [pricing](https://internetdata.io/pricing). [IP ASN](https://docs.internetdata.io/database/ip-asn) and ASN are free with an account.