Six White House IPs Acted as Residential Proxy Exits via Infatica SDK

Layer3 Intel enumerated the exits through public proxy services and tied the traffic to Windows 11 hosts running InfaticaSDK. Activity clustered between 5 p.m. and midnight Eastern Time with almost none in early morning hours, consistent with a single compromised personal device rather than guest Wi-Fi or server infrastructure. Synthient independently confirmed the same SDK and platform fingerprint.

Infatica’s founder Vladimir Fomenko also controls King Servers, which hosted six of the eight IPs attributed to Russian state actors in the 2016 election interference. The overlap is not proof of current state use, but it shows the same infrastructure provider has repeatedly appeared at the intersection of proxy services and documented hostile operations. Residential proxy enumeration now reaches isolated territories including Saint Helena and Antarctica, demonstrating how widely these SDKs have spread.

No official statement from the Executive Office of the President or CISA has addressed the findings. Procurement records show the EOP continues to rely on commercial endpoint agents whose update channels can introduce exactly this class of third-party code. The next measurable indicator will be whether internal device inventories flag additional InfaticaSDK instances before the end of the current fiscal quarter.