Internet infrastructure researchers say commercial residential proxy services were routing paying customers’ web traffic through IP addresses that belong to the White House network, a finding disclosed on November 4 by the threat intelligence firm Layer3 Intel and reported the following day by CyberInsider. The addresses sit on AS2650, an autonomous system registered to the Executive Office of the President, the federal agency that hosts the White House network.
Residential proxy services sell access to everyday devices, letting customers relay requests through them so the traffic appears to originate from that device’s internet connection. According to Layer3 Intel, obtaining that access to the addresses in question required nothing more than signing up for a public proxy service and paying a few dollars.
Six Addresses, 28 Proxy Services in a Month
Layer3 Intel said it spotted the activity in its Residential Proxy Observatory, an interface the company launched earlier in the week and describes as a first-of-its-kind global view of residential proxy and anonymized internet activity. CyberInsider reported that between October 5 and November 3, Layer3’s monitoring pipeline recorded exits through six IP addresses on 26 of the 30 days, involving 28 separate proxy services.
The company said it did not go looking for the Executive Office of the President. “We did not selectively target this network or try to make our probes exit from it,” Layer3 Intel wrote in its disclosure. “We caught this by chance, simply by requesting global rotating access through these services.”
To rule out an error, the researchers checked the addresses against other residential proxy detection services, including Spur and Synthient. Layer3 said the public IP context pages maintained by those firms independently identify the addresses as residential proxy exits.
Evening Traffic Pattern on the White House Network
The timing of the activity was uneven. Layer3 said about half of its observations fell between 5 p.m. and midnight Eastern time, with almost none in the early morning hours. The company said that pattern suggests a person rather than a public guest Wi-Fi network — someone regularly on the White House network late into the evening whose device is running a proxy software development kit.
Layer3 was explicit about the limits of what it can see. “Our data shows the exits, not the device or the person behind them,” the company wrote. CyberInsider likewise noted that the measurements identify network exits rather than individual people or endpoints.
Synthient Links Activity to Infatica Installs
CyberInsider reported that the proxy intelligence firm Synthient separately linked activity on AS2650 to multiple installations of Infatica, a residential proxy service the outlet said is often bundled into free desktop and mobile applications. CyberInsider cited a post on X that read: “Several Whitehouse staffers are running a Windows 11 machine with InfaticaSDK installed.”
Developers can integrate proxy SDKs into their software to earn money by sharing users’ bandwidth. CyberInsider cautioned that the findings do not establish which application introduced the software, whether users knowingly enabled it, or who owned the devices involved.
Why Insecure Proxy SDKs Worry Researchers
Beyond letting strangers generate traffic attributed to a government address, Layer3 said past research has shown that poorly secured proxy SDKs can allow internal network access and lateral movement, and that this is how past botnets have spread.
The company pointed to work by Synthient published under the title A Broken System Fueling Botnets, which documented how the Kimwolf botnet reached at least 2 million devices — mostly Android devices with an exposed Android Debug Bridge service — through residential proxy networks. CyberInsider dated that research to January and said Synthient assessed infections had surpassed two million devices.
“If an SDK on this network has the same kind of flaw, anyone buying proxy access could use it to reach internal systems,” Layer3 Intel wrote. CyberInsider said the findings raise concerns about unauthorized bandwidth sharing on a sensitive government network.
From Saint Helena to McMurdo Station
The Executive Office of the President was not the only unexpected result in the observatory, according to Layer3. The company said it recorded 413 addresses and more than 32,000 observations in Saint Helena, Ascension and Tristan da Cunha, the South Atlantic territory that includes the most remote inhabited island in the world. That activity was split between Starlink and the island’s local internet provider, Sure Saint Helena.
Layer3 also logged three observations from Antarctica, all of them from a Cloudflare WARP address that points to McMurdo Station. “Residential proxies have infected every corner of the world, and it looks like there is no place they cannot reach,” the company wrote.
No Notification, and Addresses Withheld
Layer3 founder Sergiy Usatyuk told CyberInsider that the company had not notified anyone about the findings and would withhold the specific addresses because of their sensitivity. Layer3 noted in its own post that the access it used is publicly available to anyone willing to pay for a rotating proxy subscription.
Neither report included a response from the Executive Office of the President or from Infatica, and neither identified any device owner or user tied to the residential proxy exits on the White House network.
