Researchers find residential proxies on White House network

Security researchers have found that the White House network was used as residential proxy exit nodes by a dozen third‑party services. Layer3 Intel reports that six IP addresses on AS2650, the Executive Office of the President’s network, were utilised by 28 residential proxy services between 5 October and 3 November.

Layer3 Intel’s residential proxy enumeration pipeline logged 236 exits through the White House network during that period, with most activity occurring in the evening hours between 5 p.m. and midnight Eastern Time and very little in the early morning.

Synthient, a cybersecurity startup that identifies residential proxies, VPNs and bot infrastructure, says the observed traffic originated from Windows 11 machines running the InfaticaSDK. Infatica, a Singapore‑based proxy provider, claims access to over 45 million ethically sourced residential, mobile and datacentre IP addresses.

The report notes that Infatica’s founder Vladimir Fomenko also owns King Servers, which Kaiser Krebs reports hosted several of the internet addresses used by Russian state‑sponsored hackers in the 2016 US election attacks. Layer3 Intel also points to a broader reach of residential proxies, noting addresses observed globally including remote locations such as Saint Helena and Antarctica, among others, with activity split between Starlink and local providers on Saint Helena. The findings are attributed to Layer3 Intel and Synthient, with context provided by Krebs’ reporting on the associated entities.