A security firm has found that internet addresses belonging to the Executive Office of the President were, for most of the past month, available to rent.
Layer3 Intel said it detected multiple residential proxy nodes beaconing out of AS2650, the network reserved for the White House, and that proxies it sampled from that network exited from the building 236 times between October 5 and November 3. The exits came from six addresses on 26 of the 30 days, clustered between 5 p.m. and midnight — a pattern the firm reads as a person, not a guest Wi-Fi network.
Layer3 also found that 28 separate residential proxy services were reselling access to the same network. "This is public access," the firm wrote. "Anybody can obtain it by signing up to a public residential proxy service, paying a few dollars and sending requests through it." The researchers say they were not targeting the White House; they asked proxy services for globally rotating exits and the White House came up.
Residential proxies work by turning ordinary devices into exit nodes, usually through software development kits bundled into free apps and browser extensions, with a small payment to the developer per install. Traffic routed through one appears to a website to come from the device's address. Legitimate uses exist — ad verification, QA testing — but the same infrastructure is standard for account takeover, botnets, scraping and evading geoblocks.
The attribution that will draw attention is Russian. Synthient, which tracks proxy networks, linked part of the AS2650 traffic to multiple Windows 11 installations of Infatica, a proxy product often embedded in free software. Infatica's founder, Vladimir Fomenko, also ran King Servers, the hosting firm that housed six of the eight IP addresses used by Russian state security services to compromise election systems in Arizona and Illinois in 2016. Synthient separately suggested a possible link to Rave.io, a watch-party app it says bundles twelve proxy SDKs — a claim that has not been independently confirmed.
The White House did not immediately respond to a request for comment.
The uncomfortable part is how ordinary this is. In a January 2026 webinar, the proxy-tracking firm Spur reported residential proxies inside nearly 300 government-operated networks, 318 utility companies, 166 healthcare organisations and 141 banks. Infoblox said 65% of its customers were querying residential-proxy domains. And the risk is not only reputational: in late 2025 criminals mass-exploited a flaw in these services to probe the local networks behind each exit node for machines to infect, and in January dozens of services had to patch after Synthient's Ben Brundage demonstrated how attackers could seize control of devices inside a user's home network.
"Some of these resellers sell bandwidth for as low as 60 cents a Gigabyte," Brundage told KrebsOnSecurity. "That means for less than a dollar you can gain access into some of the most confidential and trusted networks."
For the White House the practical fix is dull: find the devices, remove the SDK, and treat a laptop that sells its own network path to strangers as a compromised host.
