White House IP Addresses Exposed Through Residential Proxy Services

Between October 5 and November 3, researchers identified 236 instances of internet traffic originating from the White House Executive Office of the President’s network via residential proxy services.

These connections utilized six specific IP addresses assigned to the AS2650 network, potentially allowing third parties to mask their online activity.

Proxy traffic from White House network

Layer3 Intel discovered the activity while monitoring the Residential Proxy Observatory, noting that 28 different proxy services were capable of routing traffic through the White House network. The observed traffic occurred primarily during evening hours, specifically between 5:00 p.m. and midnight Eastern Time. According to Layer3 Intel, this consistent timing suggests the involvement of a device used by an individual rather than a public-facing network.

The researchers confirmed the classification of these addresses as proxy nodes after cross-referencing their findings with data from Spur Intelligence and Synthient. While the data identifies the exit points for this traffic, it does not provide the identity of the specific devices or the individuals operating them. The outbound activity ceased shortly after the company published its findings on its corporate blog.

Proxy services trace back to election-linked servers

Analysis by Synthient identified that the traffic originated from Windows 10 and 11 devices running proxy services, including Infatica. This service was founded by Vladimir Fomenko, who also owns King Servers. According to Krebs on Security, King Servers previously hosted infrastructure linked to cyberattacks against Arizona and Illinois election systems in 2016.

Synthient suggested that applications like Rave, which allows users to stream content together, may be responsible for installing proxy software via integrated software development kits (SDKs). These SDKs are often included in free applications as a method of monetization, effectively turning user devices into nodes for a broader proxy network.

Risks of residential proxy exploitation

The use of these proxies allows external clients to route internet requests through the White House network, effectively masking the true origin of the traffic.

Cybercriminals can purchase subscriptions to these services to conduct activities such as data scraping or account takeovers while appearing to act from a trusted government location. While the discovery highlights a security vulnerability, it does not confirm that an attacker successfully breached internal White House systems.

The primary concern involves the potential for lateral movement within a network. If an installed SDK possesses vulnerabilities, it could provide a pathway for attackers to reach local services or internal resources. While there is no evidence that such an intrusion occurred in this instance, the incident shows the risks of "shadow IT," where unauthorized or unvetted software on employee-owned or managed devices creates unintended entry points.

Securing networks against proxy threats

The prevalence of these services indicates a broader systemic issue, as residential proxy networks are increasingly used to bypass “Know Your Customer” protocols. Small and medium-sized organizations are particularly vulnerable to these risks when employees install free software that monetizes network bandwidth.

Beyond removing specific software, administrators are advised to configure firewalls to block outbound traffic to known residential proxy exit nodes.