Reputation Radar #19: Exit Nodes in Places You'd Never Block

Last week the story was Volt Typhoon picking a home router in the US as its final hop, precisely so the traffic wouldn't look foreign. This week two reports took that idea somewhere stranger. One found residential proxy exits on the network of the Executive Office of the President. The other found supermarket freezer controllers sending spam and relaying other people's traffic.

Neither one involves a clever zero-day against the network owner. Both are about an address you'd never think to block quietly working for someone else.

236 exits from the White House

Layer3 Intel runs what it calls a Residential Proxy Observatory: it buys rotating access from public proxy services and records where the traffic comes out. While reviewing that data, the team noticed exits on AS2650, the network of the Executive Office of the President, and published what they saw.

The numbers are small but stubborn: 236 exits between October 5th and November 3rd, from six addresses, on 26 of 30 days, offered through 28 different proxy services. They checked the result against Spur and Synthient before going public. And they're clear they weren't looking for it: "we caught this by chance, simply by requesting global rotating access through these services."

The part we keep thinking about is the timing. About half the activity fell between 5pm and midnight Eastern, and almost none in the early morning. In Layer3's reading, that "suggests a person rather than a public guest Wi-Fi network: someone regularly on the White House network late into the evening, whose device is infected with a proxy SDK." Synthient told Help Net Security it saw Windows machines running a commercial proxy SDK, and pointed at a streaming app that bundles a dozen of them.

To be fair to everyone involved, nothing here says who owns the device or that anyone meant harm. Layer3 is careful to say its data shows "the exits, not the device or the person behind them." It's still a perfect illustration of how the residential proxy market works: anybody with a few dollars could send traffic that arrived looking like it came from the White House.

The freezer that sends mail

SecurityScorecard's write-up, A Dish Served Lukewarm, is about the small Linux boxes that sit above freezer racks in supermarkets and cold stores: Dixell/Copeland XWEB PRO supervisory controllers. The flaw behind it, CVE-2026-25085, is almost funny. When the Lua login function receives a login type it doesn't recognise, it returns an empty result instead of a failure, and the controller treats that as a pass.

What the team found running on these devices was ordinary criminal plumbing. Nine addresses in eight countries, three of them confirmed XWEB controllers, were sending mail and never receiving any: small flows to ports 25, 465 and 587, with heavily overlapping target lists. Two more nodes were doing proxy work. One acted as a tunnel gateway, and another was a residential proxy exit talking to more than 10,000 distinct peers.

The timing makes it land harder. France this week blamed an IRGC unit for sabotaging refrigeration systems in around 700 grocery stores in October, with heavy food losses and at least 15 fires. SecurityScorecard doesn't link the botnet to that campaign, and neither do we. But between the two, the shop fridge has had a bad month.

What the reputation column shows

We ran the addresses from both reports against our own API.

The White House ranges come back as unknown with a high risk level and the investigate verdict, and the geo block reads "Executive Office Of The President". No known-good source lists them, and we wouldn't want one to: a government network is a fact about who owns the address, not about what's running on every laptop behind it, so the ASN name stays in the response as context.

The fridge botnet is harder in a different way. The spam senders sit on ordinary consumer and business ISPs in Argentina, Italy, Russia, Kazakhstan and elsewhere. We return them as unknown with nothing on file, because there's no feed that knows a particular broadband address is a freezer this week. Of the two possible command servers SecurityScorecard flagged, and it calls both a weak signal, one is a DigitalOcean droplet, which we already treat as rentable infrastructure worth a look. The other is the IMAP server of centrum.cz, a large Czech webmail provider, which we return as a legitimate mail server. That's true of the server. It says nothing about the mailbox someone might be logging into on it, and a free mailbox on a trusted provider is an old, cheap way to park instructions.

So for both stories, the useful signal is behaviour, not a list:

• Proxy SDKs on managed endpoints. A desktop serving as somebody's exit keeps a long-lived connection to a proxy provider's servers and then talks to destinations nobody at that desk would visit, at all hours. Check for bundled proxy SDKs in "free" apps, especially streaming and VPN tools.
• Outbound mail with no inbound mail. SecurityScorecard's own indicator is the best one: an exposed XWEB banner plus outbound fan-out on 25/465/587 and nothing coming back. That pattern is wrong for almost any device that isn't a mail server.
• Don't trust the owner's name. An address on a government, university or big-brand network is just as able to carry proxy traffic as one on a home connection.

Also on the radar

• Turla hides inside Exchange. ESET found a new Turla toolset, Cereal, on Exchange servers at government organisations in Kazakhstan and Romania (Help Net Security). It injects into EdgeTransport.exe, wraps the transport agents already loaded, and stages matching emails for collection. Commands arrive dressed as Outlook Web Access and Autodiscover traffic, which is about the most ordinary thing an Exchange server sees all day.
• A vendor's trusted role, used by someone else. Wiz found an attacker using IAM credentials from Qubole's AWS account to assume the integration roles customers had set up to trust it, then harvesting secrets and pulling data from S3 between October 14th and 26th (Wiz). The detail that stings: "Many victim environments had no legitimate vendor traffic during this activity."
• MSP app identities as a way in. Field Effect tracked an operator abusing MSP multi-tenant applications and Partner Center tokens to reach downstream customer tenants from November 1st, all from a single address, 199.19.77.84 (Field Effect). Our API has no history on that address, which is normal for a box stood up for one campaign.
• sshole, exploited within nine hours. CVE-2026-123158 lets attackers log into OpenSSH without a valid password on musl-based systems without PAM, so Alpine, OpenWrt, Buildroot and a lot of Docker images, but not Debian, Ubuntu or Fedora. Previdian saw its first attempt less than nine hours after publication and a root shell on its Alpine honeypot (Help Net Security). Update to 10.6p2 and restart the service.
• N-able pulls N-central offline. After a researcher published 33 zero-days under the name "Able2Shell", N-able took hosted N-central down worldwide on November 9th and told self-hosted customers to do the same; watchTowr and Defused saw probing within hours (The Hacker News). N-central was also on Volt Typhoon's list last week.
• Patch Tuesday. Microsoft fixed an exploited Outlook flaw, CVE-2026-124194, that leaks NTLM hashes when a victim opens a crafted Office file, without the usual external-content warning (CSO). Google shipped an emergency Chrome fix for CVE-2026-125350, its eighth exploited zero-day this year.

If you want the longer read on why a trusted owner in the reputation column is where the question starts, we walked through it in Borrowed reputation: when attackers hide behind trusted infrastructure.

See you next week.

Sources are linked inline, with credit to Layer3 Intel for the Residential Proxy Observatory research, to SecurityScorecard for the XWEB botnet analysis, and to the original researchers and vendors. If we got a detail wrong, tell us and we'll fix it.

About Reputation Radar: This is written by the small team building Reput.io, not a marketing department. It's our weekly read on the infosec landscape, with a bias toward the thing we care most about: how attackers borrow the reputation of legitimate infrastructure so their traffic looks normal. Every item links the original reporting, and any claim about our own API is run against it live and labelled.