Researchers Find White House Network IPs Offered Through 28 Residential Proxy Services

Layer3 Intel reported that 28 residential proxy services offered traffic exits through six IP addresses in AS2650, a network registered to the Executive Office of the President and serving the White House. Researchers recorded 236 proxy-exit observations on 26 days between October 5 and November 3, 2026, without specifically targeting the network. Independent listings from Spur and Synthient supported the identification of the addresses as proxy exits. The findings indicate that customers could route traffic through those addresses, but do not establish access to internal White House systems or identify a responsible device or person.

Synthient attributed the activity to Windows 11 installations running Infatica, a residential proxy service that can be bundled into free applications through software development kits. Layer3 Intel suggested that the evening-heavy activity could reflect a personal device running proxy software. Inexpensive access without customer identity verification raises abuse concerns, while previously demonstrated proxy vulnerabilities highlight potential local-network exposure—not a confirmed vulnerability in these installations. Historical links between Infatica’s founder and Russian hosting infrastructure do not establish Russian involvement. Researchers retained raw logs for relevant agencies and recommended checking for unauthorized proxy software and isolating potentially risky devices.