Summary
- Security firm Layer3 Intel detected persistent residential proxy activity originating from AS2650, the network reserved for the Executive Office of the President, across 26 of 30 days between October and November.
- Twenty-eight separate residential proxy services were found capable of routing traffic through the White House network, meaning paying customers could rent an exit node inside one of the world’s most sensitive government environments.
- One of the implicated services, Infatica, was founded by a Russian national whose hosting business hosted IP addresses used to compromise US election systems in Arizona and Illinois in 2016.
- Proxy SDKs are commonly bundled into free applications without user awareness, meaning staff devices are likely infected through ordinary software installation rather than targeted attack.
- A January 2026 Spur survey found residential proxies operating inside nearly 300 government networks, 318 utilities, and 141 banking and finance organisations — confirming this is a sector-wide problem, not an isolated incident.
What was found
Layer3 Intel, a security firm that tracks proxy infrastructure, identified multiple residential proxy nodes beaconing outbound from AS2650 — the internet address block assigned exclusively to the Executive Office of the President. The activity was observed across 26 of 30 days between 5 October and 3 November, with six specific IP addresses involved and most traffic concentrated between 5 pm and midnight. In total, researchers recorded 236 proxy exits from the network during that period.
How anyone could rent a White House IP address
Layer3 Intel confirmed the exposure was not the result of targeted testing. The team discovered it by purchasing routine rotating residential proxy access from commercial providers. “This is public access,” the team wrote. “Anybody can obtain it by signing up to a public residential proxy service, paying a few dollars and sending requests through it. We caught this by chance.” At the time of the report, 28 separate proxy resellers were capable of routing traffic through AS2650, with some resellers pricing bandwidth at less than one US dollar per gigabyte.
The Russian connection
Proxy tracking firm Synthient identified one of the services involved as Infatica, a proxy programme typically distributed inside free desktop and mobile applications via embedded software development kits. Infatica’s founder, Vladimir Fomenko, also ran a Russian web hosting business called King Servers. According to Krebs on Security’s reporting, King Servers hosted six of the eight IP addresses used by Russian state security services to access election system databases in Arizona and Illinois during 2016. The White House did not respond to a request for comment on these findings.
Why residential proxies are a persistent enterprise problem
Residential proxy services operate by installing small software agents on end-user devices — often bundled invisibly inside free applications — and reselling that device’s internet connection to paying customers. From an external website’s perspective, traffic from a proxy customer appears to originate from the device owner’s IP address rather than the customer’s real location. This makes the technology attractive for anonymising web traffic, circumventing geo-restrictions, and evading fraud detection. It also means the device owner’s network becomes an unwitting exit point for third-party activity, with no visibility into what that traffic contains.
The scale across regulated sectors
The White House case is an acute example of a broadly distributed problem. In a January 2026 webinar, proxy tracking service Spur reported finding residential proxy nodes inside nearly 300 government-owned networks globally, as well as 318 utility companies, 166 healthcare organisations, and 141 banking and finance firms. Security firm Infoblox separately found that 65 per cent of its customer base was querying domains associated with residential proxy infrastructure. A known vulnerability class in these proxy services, publicly detailed in January 2026 by Synthient founder Ben Brundage, allows attackers to pivot from a compromised proxy endpoint into the local network of the host device — compounding the exposure significantly. As Brundage noted, the reseller ecosystem allows buyers to acquire access while bypassing Know Your Customer controls entirely.
Why it matters
For CISOs, this incident illustrates a threat vector that is easy to overlook: staff devices carrying legitimate-looking free applications that silently enrol the device — and by extension the corporate or government network — into a commercial proxy pool. The network perimeter becomes a rentable commodity without any deliberate action by the employee. The exposure is not theoretical; researchers confirmed it by purchasing access commercially for a few dollars. The link to a provider with documented ties to nation-state infrastructure compounds the risk calculus. With proxy nodes confirmed across hundreds of government and regulated-sector networks, the question for most security leaders is not whether this exists in their environment, but whether they would detect it if it did.
What to do now
- Audit outbound traffic from your network for connections to known residential proxy provider domains and infrastructure; Infoblox and Spur maintain relevant domain lists.
- Review and enforce application allowlisting or mobile device management policies that restrict installation of unapproved free applications on corporate and government-issued devices.
- Include residential proxy SDK indicators in endpoint detection rules, particularly for Windows environments where Infatica and similar SDKs are commonly embedded in free software installers.
- Assess whether BYOD policies adequately account for proxy SDK risks on personal devices that connect to trusted internal networks.
- Evaluate whether your DNS telemetry would surface queries to residential proxy-related domains, given Infoblox’s finding that 65 per cent of its customers were generating such traffic without awareness.
