Residential Proxies Inside Government and Military Networks

Data as of November 5, 2026. Routing checked against public BGP data on November 6, 2026.

Residential proxies are exiting through government networks around the world. Between February 1 and November 5, 2026, IPGeolocation.io saw 975 IP addresses on 295 government, military, and international-body networks in 82 countries offered as residential proxy exits. An exit is the address a proxy customer's traffic leaves from, so the website on the other end sees that organization's network as the sender.

The White House is one of them. Our collection saw three addresses on the Executive Office of the President's network offered by eight proxy brands on seven days between September 8 and October 28, 2026. None of this shows who installed what, or that any network was breached. It shows that anyone paying one of those services could send traffic out through these organizations' addresses.

TL;DR

Residential proxy exits on government networks are widespread, current, and resold. As of November 5, 2026, IPGeolocation.io's data held 975 exit addresses on 295 government, military, police, legislature, central bank, and international-body networks in 82 countries, each tied to its organization by routing data for every day it was offered or by the registry record of its address block.

• 340 of the 975 addresses were offered in the window's last seven days, October 30 to November 5, and 681 in its last 30.
• The median span from an address's first sighting to its last was 24 days; 46.5% spanned more than 30 days, and 248 addresses were offered on 10 or more separate days.
• 59.5% were offered by two or more proxy brands. One address on the United Nations Office at Nairobi's network was offered by 35.
• Government-run networks that also serve the public, mislabeled ISP address pools, and mobile carrier addresses shared by many customers are left out of the count.
• Network owners can check their own outbound addresses against residential proxy data and look for proxy software calling out from inside. Affected organizations and CERTs can request the address-level data.

The White House exits in our data

IPGeolocation.io's collection saw three addresses in the White House network's 165.119.253.0/24 block offered as residential proxy exits by eight proxy brands on seven days between September 8 and October 28, 2026. That block is announced by AS2650, the network registered to the Executive Office of the President. Our AS2650 network page lists the block among the network's routes, with the holder and the network type GOVERNMENT, and public routing data, such as RIPEstat, shows the same origin.

Each row below is one address offered by one or more brands on one day (UTC). The last octet of every address is masked.

That's nine sightings on seven days, from eight brands, spread over seven weeks. The same address also changed hands: the one offered through anyIP on September 8 turned up again under Geonode on October 28.

The table can't tell us which devices sit behind these addresses, or whose devices those are. Our data has dates but no times of day, so it says nothing about working hours either. And because we collect from a subset of the brands on the market, a quiet stretch in our data doesn't mean the exits stopped.

975 addresses, 295 organizations: what we found

Across IPGeolocation.io's dataset, 975 IP addresses on 295 organizations' networks in 82 countries were offered as residential proxy exits between February 1 and November 5, 2026. They sit on 202 autonomous systems (ASNs), and 58 different proxy brands offered at least one of them.

Ministries and national agencies make up the largest group, followed by police, courts, and the rest of law enforcement and justice.

The research row needs a caveat. Of its 154 addresses, 127 are on one network: the Joint Institute for Nuclear Research in Dubna, Russia, all inside 159.93.0.0/16, which AS2875 announces. They're spread over 45 different /24 blocks, the busiest holding 13, 12, and 9, which looks like many separate users across a large institute network, not one system. The block's only public registry record covers the whole /16, with no public sub-assignments, so we can't see which part of the institute's network these exits come from. One address in 159.93.217.0/24 was offered on 40 days between May 21 and November 3 by 16 brands; 71 of the 127 were offered in the last 30 days. Without this network, the research row drops to 27 addresses on four organizations (INFN, CERN, a prefix announced by NASA's network, and SANSA), and Russia would have 46 addresses, still second behind Thailand and one ahead of the United States.

The 20 countries with the most addresses hold 734 of the 975. Russia and Thailand lead, with the United States third.

Read the table as a map of where exits appeared in our collection, not a ranking of any country's security: one large network can put a country near the top, as the Dubna institute does for Russia, while the Philippines reaches eighth through 26 separate organizations.

These aren't one-day blips. The median span from an address's first sighting to its last was 24 days, 46.5% of addresses spanned more than 30 days, and 248 were offered on 10 or more separate days. Spans that long mean something using these addresses kept relaying proxy traffic for weeks, whether one device or several behind the same address.

They're also resold. Of the 975 addresses, 59.5% were offered by two or more brands; the median address had two, and one had 35. We don't rank the brands, because how many of these addresses a brand offered mostly follows its size and how much of it we collect, and a brand may not know whose network its supply comes from. For a network owner, the resale means a complaint to one seller won't close an exit that others still sell.

Case studies, with ownership you can check

Each case gives the network and its holder, the first and last day an address was offered, on how many days, by how many brands, and how we verified it. You can check who holds each network on IPGeolocation.io's free ASN pages or in public routing data; the sightings come from our data, and the address-level evidence goes to the organizations concerned.

How we found and verified these networks

We built this dataset at IPGeolocation.io from our residential proxy collection, our IP ownership data, and public routing data:

• Collection. We record residential proxy exits with the brand that offered each one and the date, mainly by connecting through residential proxy services ourselves, the same method behind our residential proxy data. An address counts once per brand per day.
• Ownership. We matched each address against our IP database (40.4 million ranges, exported November 5, 2026) for its ASN, the ASN's holder, and the organization registered for its block.
• Classification. We matched organization names for government, military, police and justice, legislature, central bank, and international bodies, then reviewed every candidate by hand.
• Verification. For Tier A, we checked RIPEstat's public routing data twice. As of November 6, 2026, 167 of 168 prefixes were still announced by the network we attributed them to; the one that wasn't, a prefix registered to a defense ministry but announced by a commercial provider, was removed. Then we checked routing history for every day each address was offered: of 5,935 address-days, 5,930 matched, and the 5 addresses behind the mismatches were removed. For Tier B, the block's registry record had to name the organization.
• History. We traced every address through our daily files from February 1 to November 6, 2026, for its first and last sighting, the days it was offered, and the brands that offered it. The counts use the November 5 build; the case-study histories run to November 6.

The date check changed the result. On current routing alone, three addresses in 205.173.219.0/24 would have counted as US Air Force exits, because AS501, an Air Force network, announced that prefix when we checked. It has done so only since October 16, 2026. On every day those addresses were offered, September 23 to October 14, the prefix was announced by Multnomah County in Oregon, so they were county exits and they're out. Two more addresses, attributed to government networks in Bangladesh and Togo, were announced by other networks on the days they were offered and were removed the same way.

How do devices on government networks become residential proxy exits?

Usually through software on a device connected to the network, which lets a proxy service route other people's traffic through it. The FBI's March 2026 public service announcement and Google's January 2026 report on the IPIDEA proxy network describe the main routes:

• Proxy SDKs in free apps. Proxy services pay app developers, usually per download, to bundle a software development kit (SDK) that turns the device into an exit in the background. Google found such SDKs offered for Android, Windows, iOS, and WebOS, enrolling devices without telling their users.
• Free VPNs with hidden terms. The FBI warns that free VPN apps may enroll devices without consent, with the details buried in the terms of service. Google found free VPN apps that joined devices to the proxy network as exits.
• Apps that pay for bandwidth. "Passive income" apps promise to pay people for their unused connection and resell it to proxy customers.
• Compromised or preloaded devices. TV streaming boxes, digital projectors, picture frames, and similar devices can come with proxy malware installed, or pick it up while downloading apps.
• Malware in pirated content. Free games, films, and paid software offered for nothing can carry malware that does the same.

Every route ends on a device someone carries in or plugs in, and offices are full of them. A personal phone on guest Wi-Fi, a streaming box in a break room, or a free utility on a work laptop all leave through the organization's addresses.

Once a device is enrolled, its exit rarely stays with one brand. Google found heavy overlap between residential proxy networks' exits, likely through reseller and partnership agreements, which matches IPGeolocation.io's data: most addresses here were offered by more than one brand. Our data can't say which route applies to any network in this research.

"It's just guest Wi-Fi," and other objections

Four doubts come up whenever residential proxy exits turn up on an organization's network. Here's what the data says to each.

How to check whether your network is a residential proxy exit

Start with the addresses your network uses to reach the internet, because those are what a proxy customer borrows. For network owners:

1. List every address your organization uses to reach the internet: NAT gateways, guest Wi-Fi, VPN concentrators, and any block your provider assigned.
2. Check those addresses against residential proxy data. IPGeolocation.io's IP Security API returns is_residential_proxy for each address, with the last date it was seen and how many brands offered it in the past 30 days (IP Security API field definitions), and the Residential Proxy Database covers whole ranges offline.
3. Search DNS and firewall logs for devices calling out to proxy SDK services. The domains listed in Google's IPIDEA report are one starting point.
4. Apply the controls the FBI recommends for businesses: device policies that keep unauthorized devices off the network, segmentation that isolates sensitive systems from general traffic, and firewall rules that stop unauthorized applications from communicating.
5. Remove the software from any device you find. The FBI notes that some devices ship with malware that survives a factory reset, so reinstalling the operating system may be the only fix.

Treat a hit as unauthorized software on your network until you know more: find the device, remove the software, and check what else that device could reach. Reporting the exit to the brands that sell it won't close it on its own, because others resell the same exit.

For individuals:

• Open our What is my IP page from your network and read its Residential Proxy check.
• Look for apps that pay you for unused bandwidth, free VPN apps, and streaming boxes that promise free sports, shows, or films. The FBI warns about all three.

If your range shows up in our data and you've removed the cause, email support@ipgeolocation.io with the range and what you changed.

Updates

• First published with data as of November 5, 2026, and routing checked against public BGP data on November 6, 2026.