Layer3 Intel detects 236 proxy exits from White House network

Layer3 Intel detected 236 residential proxy exits tied to AS2650 from Oct. 5 to Nov. 3, 2026.

The Executive Office of the President owns AS2650. It operates as the federal agency behind the White House network. The exits used six different IP addresses on 26 of the 30 observation days. Twenty-eight separate residential proxy services offered routes through the White House network addresses.

Layer3 Intel is a New York-based residential proxy detection firm. The firm said it was not targeting the White House network, and the discovery was accidental. It was made while the company requested global rotating access through proxy services. Its newly launched Residential Proxy Observatory made the detections, and it published the research on Nov. 4.

Early morning brought almost no activity. About half of the connections took place between 5 p.m. and midnight Eastern time. Layer3 Intel said the timing indicates a person using the White House network in the evening. That person’s device carries a proxy SDK, software that embeds proxy functions inside an application.

Layer3 Intel said its data shows only the exit points. It does not name the device or the person behind it. According to Layer3 Intel, no one reported a compromise of White House systems. “The most recent activity was recorded in the evening of November 4; hopefully, it stops soon!” founder Sergiy Usatyuk told Infosecurity Magazine.

Synthient found that machines running Windows 10 and Windows 11 communicated with Geonode, Infatica and Mellowtel. Layer3 Intel checked the addresses against Spur and Synthient, and both services flagged the addresses as residential proxy exits. The service stated with high confidence that the app is Rave[.]io, a shared streaming service that bundles twelve proxy SDKs. Synthient said on Nov. 4 that multiple employees at the White House used a Windows 11 machine containing InfaticaSDK, and that “several Whitehouse staffers are running a Windows 11 machine with InfaticaSDK installed.”

Customers can route traffic through everyday devices using residential proxy services, and Layer3 Intel said anyone can join a public residential proxy service and spend a few dollars to route requests through it. The company warned that a buyer of proxy access might exploit an identical SDK flaw to reach systems inside the network. Earlier research cited by Layer3 Intel shows that weakly secured proxy SDKs allow outside actors to reach internal networks. From there, those actors can move sideways inside them.

Layer3 Intel pointed to Synthient research showing the Kimwolf botnet reached at least 2 million devices through residential proxy networks. Kimwolf is the Android variant of the Aisuru DDoS Botnet.

A request for comment went unanswered by White House officials. Layer3 Intel preserved the raw activity logs and provided its findings to a US federal agency.

The discovery fits a wider pattern. Spur research from January found residential proxies in almost 300 government networks, and those networks covered large IP address blocks. Infoblox research found residential proxies were widespread throughout enterprises. Residential proxies are not illegal per se but enable denial-of-service operations or malware distribution.

Attackers use residential proxies to hide their communications, bypass rate limits or launch brute-force attacks. The networks can additionally serve testing purposes. According to Layer3 researchers, employees at the White House might serve as launch points for intrusions targeting internal systems. Developers often put residential proxy SDKs into free apps to earn money from installs, and those apps can beacon from employee devices brought to work.

Google’s Threat Intelligence Group took down the XCPE backdoor. The backdoor had enrolled more than 1.3 million set-top boxes into a botnet. Google assesses with high confidence that Videostrong Technology Co. developed and operated the botnet to make money.

Researchers saw attackers install residential proxy software through a Plex Media Server flaw after Plex2Shell’s disclosure. In January, many proxy services patched after Ben Brundage showed flaws could seize control of devices on local networks.

IT experts on Reddit said senior leadership often sacrifices security for convenience. They pointed to missing multifactor authentication as an example. A reader guessed that someone inside the White House likely installed a suspicious free application on a mobile phone.

Resellers make the access cheap. Ben Brundage said some resellers offer bandwidth for as little as 60 cents per gigabyte. “sell bandwidth for as low as 60 cents a Gigabyte,” Brundage said. He said the reseller ecosystem lets criminals buy access while skipping KYC processes.

Vladimir Fomenko founded Infatica, one of the services involved. Fomenko, a Russian man, also founded King Servers. According to Krebs, King Servers housed six addresses tied to Russian state security operations against elections in Arizona and Illinois in 2016. Those addresses were among eight linked to those operations. Fomenko advertised on LinkedIn that Infatica expanded to providing “clean, structured data” without fighting anti-bot systems like Cloudflare and Akamai.

Layer3 Intel’s observatory has seen the technology everywhere. Its findings covered 413 addresses and more than 32,000 observations. Those locations included Saint Helena, Ascension and Tristan da Cunha. All three Antarctic observations came from a Cloudflare WARP address associated with McMurdo Station, and Layer3 also reported residential proxy activity in the Falkland Islands, Chagos Islands, Tokelau, South Georgia, Pitcairn and Svalbard.

Proxy traffic there rode on Elon Musk’s Starlink internet service and the Sure Saint Helena local ISP. No researcher has characterized the White House activity as spyware planted against the White House.

Unsecured proxy SDKs might expose private IP addresses. That would let attackers probe local networks and install malicious payloads. Matt Johansen posted on X that someone at the White House has compromised devices. He tied the activity to the window between 5 p.m. and midnight.