White House network traffic spotted exiting via residential proxies

White House IP Addresses Spotted as Residential Proxy Exit Nodes

Between October 5 and November 3, security firm Layer3 Intel observed 236 instances of internet traffic exiting directly from the Executive Office of the President’s network, AS2650. This traffic originated from residential proxy services, which allow external users to rent IP addresses to mask their true location or anonymize web activity. These exit nodes were active on 26 of the 30 days monitored, with the majority of connections occurring between 5 p.m. and midnight.

The Tech TL;DR:

• Researchers identified 28 different residential proxy services routing traffic through the White House’s dedicated network, potentially exposing internal systems to external probes.
• One identified service, Infatica, is led by a founder whose previous hosting business was linked to 2016 cyberattacks against U.S. election systems.
• The presence of proxy software on government-affiliated devices highlights a critical risk where employee hardware can inadvertently serve as a gateway for malicious actors.

Infatica Proxy Installations Link to King Servers

Analysis from the proxy tracking company Synthient, as noted on X (formerly Twitter), linked the activity on AS2650 to Windows 11 installations of Infatica. This proxy program is frequently bundled within free mobile and desktop applications as a monetization tool. The founder of Infatica, Vladimir Fomenko, previously operated King Servers, a hosting entity involved in the 2016 breach of election systems in Arizona and Illinois. King Servers provided six of the eight IP addresses used by Russian state security services during those operations.

Security Risks of Residential Proxy SDKs

Residential proxy networks function by turning end-user devices into exit nodes. When an application developer embeds a software development kit (SDK) from a proxy provider, they monetize the user’s bandwidth. However, this creates a significant attack surface. In January 2026, Synthient founder Ben Brundage demonstrated how attackers could exploit vulnerabilities in these services to gain control of devices within a user’s local network.

The danger is not theoretical. In late 2025, cybercriminals were found mass-exploiting proxy endpoints to probe local networks for vulnerable systems. Because these services often lack rigorous “Know Your Customer” (KYC) protocols, bandwidth can be purchased for as little as 60 cents per gigabyte, allowing malicious actors to route traffic through trusted networks with relative anonymity.

To prevent unauthorized proxy nodes from operating on protected infrastructure, IT administrators should audit endpoint configurations and monitor for unusual outbound proxy traffic.

Prevalence Across Trusted Networks

The White House is not an isolated case. Data from the security firm Spur, presented in a January 2026 webinar, revealed residential proxy exit nodes operating within nearly 300 government-owned networks, as well as hundreds of utility, healthcare, and financial institutions. Similarly, Infoblox reported earlier this year that 65% of its customer base queried domains associated with residential proxy networks. Layer3 Intel reported the detection of residential proxy nodes beaconing from the internet address network reserved for the Executive Office of the President. The firm was not specifically targeting the Executive Office of the President; rather, they identified the nodes while requesting global rotating access through public proxy services. The White House did not immediately respond to a request for comment.

Mitigating Unauthorized Network Tunneling

The primary defense involves restricting the installation of unauthorized third-party applications on government-issued hardware and auditing devices for hidden SDKs. Without active monitoring of outbound traffic, devices brought into the workplace by employees can continue to expose sensitive networks to external actors. The persistence of these proxy services on sensitive networks highlights an ongoing challenge in mobile and desktop security: the tension between monetization through SDKs and the integrity of enterprise-grade network infrastructure. The ability to rent access to these IP addresses remains a feature of the residential proxy ecosystem.