Residential proxies are often used by bad actors to hide the true source of internet traffic — and now one of them appears to have taken up residence in the White House.

The Residential Proxy Observatory, set up by Layer3 Intel to monitor the threat of anonymized network activity, has identified proxy exit activity on one particular network, AS2650, which is registered to the executive office of the US President and operated out of the White House.

Residential proxies — so-called because they typically run on home or personal devices — mask the true source of internet traffic by rerouting it to appear to come from a different IP address. While it may be concerning that this is activity to be found in one of the protected workspaces in the US, this is in line with recent research from Infoblox, which found that residential proxies were widespread throughout enterprises.