White House network IPs rented through residential proxy services, researchers say

Layer3 Intel said it detected residential proxy nodes beaconing from AS2650, the autonomous system number assigned to the Executive Office of the President, between Oct. 5 and Nov. 3. The firm said proxy traffic exited from six White House internet addresses on 26 of 30 days, and that the exits occurred 236 times. Layer3 said it found 28 separate residential proxy services able to route through the network.

Synthient said the activity it observed from AS2650 was tied to multiple Windows 11 installations of Infatica, a proxy program often bundled into free mobile and desktop applications. Infatica founder Vladimir Fomenko is Russian, and his hosting firm King Servers was linked to six of eight IP addresses used by Russian state security services in the 2016 Arizona and Illinois election-system intrusions. That historical link does not attribute the current proxy activity to Russia.

Residential proxy services route customer web requests through ordinary consumer devices, making traffic look like it comes from those devices rather than the proxy buyer. Layer3 said the White House exits were public access: anyone could sign up to a commercial proxy service, pay a few dollars and send requests through the rented address. The White House did not immediately respond to a request for comment, leaving no public explanation for how the proxy clients were installed or used.

The exposure matters because a trusted government network identifier can be rented as a commodity, letting anyone make web traffic appear to originate from the White House network. Residential proxy clients have also been abused through local-network vulnerabilities, allowing attackers to probe or seize control of devices near the endpoint. For the Executive Office, the risk is not just spoofed traffic but potential compromise of the devices and adjacent networks that carry the proxy.