Cybersecurity researchers detect residential proxy traffic routing through the White House network

Cybersecurity researchers at Layer3 Intel reported that 28 distinct residential proxy services routed traffic through the White House IT network, logging 236 exit instances between October 5 and November 3, 2026. The activity traced back to autonomous system AS2650, which is registered to the Executive Office of the President, and occurred in 26 of the 30 monitored days. The firm uncovered the traffic using its Residential Proxy Observatory, with detection companies Spur and Synthient independently confirming the IP addresses as proxy exit nodes. [2][3]

Layer3 Intel noted that about half of the traffic surfaced between 5 pm and midnight Eastern time, suggesting an infected device belonging to an individual rather than temporary visitors on a public guest network. Security firm Synthient stated on X that it believes multiple Windows 10 and 11 systems on the network likely host the Infatica SDK, a software toolkit developers embed in apps to monetize connections by converting user machines into proxy exits. Layer3 warned that flaws in poorly secured proxy kits could allow paying proxy customers to access internal government systems and move laterally across the network. [2][3]

Residential proxies let paying users route online activity through external IP addresses, a tool often leveraged by cybercriminals to obscure attacks, run phishing campaigns, and disguise malicious infrastructure. Layer3 founder Sergiy Usatyuk said the White House connections halted on Wednesday night shortly after his firm published its findings. The US State Department requested and received a copy of the activity logs on Thursday morning, while the White House did not provide a comment. [2]