Six internet addresses belonging to the Executive Office of the President were used as exit points for residential proxy traffic 236 times over a month, according to research from New York firm Layer3 Intel. The firm suspects a device on the network was infected with proxy software, which would let outsiders route traffic through one of the most sensitive government networks in the United States.
What Layer3 Intel Observed on AS2650
Layer3 Intel published its findings on Nov. 4. It saw proxy traffic exit through six addresses in AS2650, a network block that belongs to the Executive Office of the President. The activity occurred between Oct. 5 and Nov. 3 and appeared on 26 of the 30 days.
Twenty-eight separate residential proxy services could route traffic through those addresses. Two other firms, Spur and Synthient, independently flagged the addresses as residential proxy exits. Layer3 founder Sergiy Usatyuk said the data came from the firm’s new Residential Proxy Observatory.
Evening Activity Points Away From Guest Wi-Fi
About half of the activity fell between 5 p.m. and midnight Eastern time. Layer3 said that timing suggests a person’s device and not a guest Wi-Fi network, and it suspects a device infected with a proxy software development kit.
Infatica and the Windows 11 Installations
Synthient linked some of the activity to multiple Windows 11 installations running Infatica, a proxy program that is often bundled inside “free” applications. Cybernews separately noted a streaming app that bundles proxy software.
The Infatica Founder’s Hosting Background
Infatica’s founder, Vladimir Fomenko, previously ran King Servers. According to the reporting, that hosting company housed six of the eight IP addresses used by Russian state security services in operations against Arizona and Illinois election systems in 2016. The sources present this as background on the proxy program’s founder and do not allege that the White House traffic is tied to any state operation.
Why Proxy Exits Inside a Government Network Matter
Residential proxies let a customer send traffic through an ordinary-looking address, which hides the true origin. When the address sits inside a government network, outside parties can route traffic, including malicious traffic, through a trusted source. The FBI warned about criminal use of residential proxies in a March bulletin, The Register reported.
What Remains Unconfirmed About the White House Proxy Exits
The sources do not establish how the proxy software reached the devices, whether any data was exposed or whether anyone used the exits for attacks. No White House response is quoted in the coverage reviewed, and the sources do not report any data loss.
Layer3 and the other researchers recommend removing the proxy software from the affected devices. The research does not identify the specific machines or the people who use them.
Layer3 Timeline From October Proxy Exits to November Coverage
The proxy exits were observed from Oct. 5 through Nov. 3. Layer3 published its research on Nov. 4, and independent coverage followed on Nov. 5. The observation window and the 26-of-30-day frequency indicate sustained, repeated use and not a one-off event.
The finding adds to a body of research on the commercial proxy market, where software bundled in free applications turns ordinary computers into relay points without clear user awareness. In this case, the relay points fell inside address space assigned to the White House, a placement that Layer3 described as a potential security exposure for a highly sensitive network.
Layer3’s measurements came from its observatory tracking proxy exits, and the corroboration from Spur and Synthient lends weight to the identification of the addresses. What the sources cannot answer yet is whether the White House has located the device or devices and removed the software, a step that no coverage says has been confirmed.
