Residential Proxies Route Traffic Through White House Network

Several White House devices have been observed exposing their network addresses to residential proxy services, enabling others to rent or hijack those addresses. Security firm Layer3 Intel detected proxy exits from the Executive Office of the President’s internet address space (AS2650) across six addresses on 26 of 30 days, with proxies exiting the White House network 236 times between 5 October and 3 November 2026.

Synthient, citing observations on X, linked the activity to multiple Windows 11 installations of Infatica, a proxy service often embedded in free applications. Infatica’s founder, Vladimir Fomenko, runs King Servers, a hosting firm previously tied to election-system attacks in Arizona and Illinois in 2016.

Layer3 Intel’s researchers described this as “public access,” noting that anyone can obtain it by signing up to public residential proxy services, paying a small fee, and routing requests through them. They reported six exit addresses within AS2650 producing observable proxy traffic on most days, with the majority of activity occurring in the evening, between 5 p.m. and midnight. In total, Layer3 Intel found 28 separate residential proxy services capable of exiting through the White House network.

KrebsOnSecurity’s coverage also cites Ben Brundage of Synthient, who warned that such proxies can be used to anonymise traffic, impersonate locations, and facilitate criminal activity, including account takeovers and ad fraud.

The article notes prior and ongoing concerns about residential proxies, including a January 2026 demonstration of abuse and subsequent patching across the sector. It attributes broader industry risks to low-cost bandwidth resale and weak Know Your Customer controls, with references to Spur and Infoblox findings on proxy-related traffic across government, healthcare, utilities, and finance sectors. The White House declined to comment.