Residential Proxy Exit Nodes Found on White House Network

Security researchers say they found machines on the White House network acting as exit nodes for commercial residential proxy services. Layer3 Intel reports that six IP addresses on AS2650, the network reserved for the Executive Office of the President, were used by 28 residential proxy services between October 5 and November 3.

The firm says its enumeration pipeline exited through the White House network 236 separate times. Anyone who signs up to a public residential proxy service can route requests through those exits.

Most of the traffic showed up between 5 p.m. and midnight, Eastern Time, with almost nothing in the early morning. Layer3 Intel reads that as a person rather than a guest Wi-Fi network: someone regularly on the network late in the evening, with a device carrying a proxy SDK.

Synthient, a startup that tracks proxy and VPN infrastructure, attributes the traffic to Windows 11 machines running the InfaticaSDK. Infatica is a Singapore-based proxy provider. The article also notes that Infatica's founder, Vladimir Fomenko, owns hosting provider King Servers, which Krebs reported hosted addresses used in the 2016 US election attacks. That's background on the vendor, not a finding about this traffic.

The report doesn't say how the SDK got onto the machines, how many devices are involved, or whether anyone has been notified. We'd treat the evening pattern as the useful part: it points at a specific infected endpoint, not a network-wide compromise. Anyone running endpoint inventory on a sensitive network should be able to answer which hosts have proxy SDKs installed.