Researchers Find Residential Proxies on White House Network

Security researchers detected multiple endpoint computers operating directly inside the White House network that functioned as commercial residential proxy exit nodes. Analysis released by cybersecurity threat intelligence firms Layer3 Intel and Synthient revealed that six IP addresses assigned to Autonomous System AS2650, the dedicated network reserved exclusively for the Executive Office of the President, routed web traffic for 28 public residential proxy services between October 5 and November 3. During that four-week observation window, automated enumeration pipelines routed traffic out through the White House perimeter 236 separate times, establishing that commercial proxy networks had active footholds on endpoint hardware inside one of the most protected network zones in the federal government, according to SecurityWeek's report.

This breakdown examines the technical anatomy of the White House residential proxy presence, the corporate supply chains delivering traffic through federal infrastructure, and the specific exposure this poses for enterprise and government defenders. Enterprise security teams, network architects, and threat researchers must track how residential proxy software development kits silently piggyback onto trusted local endpoints, converting legitimate enterprise devices into externally controlled relays for unauthorized traffic.

Researchers Find Residential Proxies on White: what actually changed

Network telemetry recorded between October 5 and November 3 confirmed that six specific IP addresses assigned to AS2650 were operating as active exit relays. The Layer3 Intel enumeration infrastructure exited through AS2650 a total of 236 separate times over that period. Rather than connecting through a single intermediary, 28 distinct public residential proxy services marketed access that ultimately terminated through these federal IP allocations. Anyone purchasing access to these commercial proxy pools could issue outbound requests that exited the internet appearing to originate directly from the Executive Office of the President.

Activity metrics collected during the tracking period established that the vast majority of proxy transactions occurred during the evening window between 5 p.m. and midnight, Eastern Time. The network monitors recorded almost no activity during early morning hours. This persistent timing profile points away from an open guest Wi-Fi connection with revolving public visitors and indicates a recurring individual presence. The analysts concluded that a specific person remained regularly connected to the White House network late into the evening carrying a hardware device infected with a background proxy software development kit.

Researchers Find Residential Proxies on White: how it works

Technical fingerprinting conducted by residential proxy and bot infrastructure specialist Synthient determined that the White House exit traffic originated from Windows 11 endpoint hardware running the InfaticaSDK. The Infatica software development kit operates as a monetization and proxy routing framework integrated into consumer utilities, background programs, or bundled software packages. Once launched on a local machine, the SDK registers the host machine as an available node within a distributed commercial routing pool, silently accepting inbound proxy requests and proxying web traffic out over the local network interface.

Singapore-based proxy provider Infatica manages a global web-data intelligence operation, advertising a network of more than 45 million ethically sourced IP addresses spanning residential, mobile, and datacenter allocations. The corporate background of the proxy operator connects to earlier state-sponsored cyber operations. Infatica founder Vladimir Fomenko also owns web hosting and infrastructure provider King Servers, an entity that investigative journalist Brian Krebs documented as hosting six of the eight internet addresses leveraged by Russian state-sponsored hackers during the 2016 United States election attacks.

Researchers Find Residential Proxies on White: why it matters

When an internal machine runs a commercial proxy SDK, external third parties can route arbitrary HTTP and HTTPS traffic through the organization's dedicated IP space. For AS2650, every request routed through the proxy egressed onto the open internet carrying the authoritative network identifier of the Executive Office of the President. Attackers, scrapers, and commercial proxy subscribers could exploit this routing to disguise scanning activity, bypass IP-based geofences, scrape sensitive external targets, or conduct surveillance under the guise of an executive government agency.

The exposure illustrates how consumer software monetization libraries bypass traditional network boundary controls. Because outbound web traffic generated by residential proxy SDKs mimics regular browsing sessions originating from legitimate local operating systems, standard egress firewalls often fail to flag the connections. When endpoints running Windows 11 connect to trusted federal perimeters, secondary background services running proxy libraries can seamlessly monetize and expose the host network without triggering common intrusion detection signatures.

Researchers Find Residential Proxies on White: who is affected

The primary entity directly affected by this activity is the Executive Office of the President, whose AS2650 network space was leveraged as an exit hub for nearly a month. The exposure demonstrates that high-security government perimeters face persistent risks from unvetted applications running on authenticated hardware. Any internal device connected to the core network that harbors third-party monetization libraries effectively punches a bidirectional hole through enterprise defenses, allowing arbitrary outsiders to execute requests from trusted address blocks.

The issue extends far beyond federal offices, as residential proxy networks now blanket isolated geographic regions and enterprise networks globally. In the remote South Atlantic territory of Saint Helena, Ascension and Tristan da Cunha, Layer3 Intel documented 413 active proxy addresses and logged over 32,000 observations divided between Starlink terminals and local telecom provider Sure Saint Helena. Similar residential proxy exit nodes were actively detected across Antarctica, Svalbard, the Falklands, the Chagos Islands, Norfolk Island, Pitcairn, South Georgia, and Tokelau.

Researchers Find Residential Proxies on White: what to watch

Security teams must monitor endpoint software inventories for embedded proxy code such as InfaticaSDK, particularly on portable Windows 11 hardware traversing remote, home, and on-premises environments. Network operations teams need to deploy continuous egress inspection capable of identifying reverse proxy tunnels and outbound connections bound for known commercial proxy management infrastructure. When devices connect after hours, organizations must correlate active user sessions with unexpected automated outbound data volume across unusual destination ports.

Government agencies and defense organizations must also scrutinize the software supply chains of everyday workplace and personal utilities brought into secure environments. Because commercial proxy providers continue expanding pools that exceed 45 million nodes across residential and datacenter networks, endpoint application control policies must explicitly block unauthorized SDK components. Defending enterprise perimeters requires recognizing that commercial software development kits can turn authorized internal hardware into external gateways without requiring administrative domain compromise.