Researchers Say 28 Proxy Services Could Route Traffic Through White House Network Addresses

Anyone willing to pay a few dollars could have sent web traffic out through White House internet addresses over the past month, according to researchers at two security firms.

Layer3 Intel says it detected residential proxy nodes beaconing from AS2650, the network block registered to the Executive Office of the President. The activity ran from Oct. 5 to Nov. 3, 2026.

The White House did not immediately respond to a request for comment from Krebs on Security, which first detailed the findings. As of today, Nov. 6, it has not publicly explained the activity.

What the researchers found

Layer3 says its tools exited through the White House network 236 times in the 30-day window. The exits came from six IP addresses on 26 of the 30 days.

In all, 28 separate residential proxy services were able to route traffic out through the network, Layer3 reported.

The firm says it did not go looking. "We did not selectively target this network or try to make our probes exit from it," Layer3 wrote. "We caught this by chance, simply by requesting global rotating access through these services."

Two other proxy-tracking firms, Spur and Synthient, also identify the addresses as proxy exits.

Layer3 describes the access as open to the public. "Anybody can obtain it by signing up to a public residential proxy service, paying a few dollars and sending requests through it," the firm wrote.

A person, not a guest network

About half of the activity fell between 5 p.m. and midnight Eastern, with almost none in the early morning. Layer3 says that pattern points to a person rather than a public guest Wi-Fi network.

"Someone regularly on the White House network late into the evening, whose device is infected with a proxy SDK," Layer3 wrote. An SDK is a software development kit, a bundle of third-party code that app makers can embed.

Synthient said on X that it saw Windows 10 and Windows 11 devices on the network beaconing to known proxy providers, including Geonode, Infatica and Mellowtel. It described several White House staffers as running a Windows 11 machine with the Infatica SDK installed.

Synthient also suggested a link to Rave, a watch-party app that it says bundles 12 proxy SDKs. That is a suggestion, not a confirmed match to any device on the network.

The Infatica connection

Infatica was founded by Vladimir Fomenko, a Russian national, according to Krebs on Security. Fomenko owns the hosting company King Servers.

Krebs reports that King Servers hosted six of the eight internet addresses Russia's state security services used in 2016 to compromise election-system databases in Arizona and Illinois.

That history describes the company behind one of the proxy products. No source has said Infatica or Fomenko did anything to the White House network.

What is and is not known

Residential proxies route traffic through an ordinary user's device so it appears to come from a home or office connection. Spur notes they have legitimate uses, such as ad verification and quality-assurance testing. Criminals also use them for account takeovers, botnets and bypassing geolocation controls.

Many device owners never knowingly agree to it. Some apps bury the proxy code in their terms or hide it entirely.

Layer3's data has limits. It shows only the exit points, not which device or person is behind them, according to Cybersecurity News's account of the research. CNET reports there is no evidence the proxy access was used to attack the White House.

The researchers' concern is about exposure. Layer3 founder Sergiy Usatyuk told CNET the access "basically gives them a foothold on a network where previously nobody was getting into the White House network." He added: "From a security policy perspective, it gives you all types of potential pathways to exploit."

Usatyuk pleaded guilty in 2019 to federal charges tied to running websites that launched denial-of-service attacks, CNET reported.

The risk is not hypothetical in other settings. Synthient's earlier research on the Kimwolf botnet found it reached more than 2 million devices, mostly Android boxes with an open debug service, by moving through residential proxy networks. Attackers in that case reached devices on private home networks that should have been out of reach.

The policy question

The likeliest explanation, per Layer3 and CNET, is a personal device on White House Wi-Fi running an app with a proxy SDK. That is a hygiene problem, not necessarily a breach. It is still a problem on the network of the Executive Office of the President.

A network that carries sensitive government work should not be selling its exit addresses to strangers, whatever the device. Egress filtering and device controls are standard tools for blocking this kind of traffic. Whether they were in place is unanswered.

The White House has not said which devices were involved, whether they were government-issued or personal, or whether the software has been removed. It has also not said whether anyone has reviewed what traffic passed through the six addresses. Layer3's monitoring window ended Nov. 3, and whether the exits have continued since is not established.

What the White House tells the public next, and whether it explains who runs the devices, will show how seriously the problem is being treated.