Investigators Found White House Network Traffic Routing Through 28 Residential Proxy Services

For about a month, strangers on the internet could rent a connection that came out of the White House. Researchers who track residential proxy markets found the network of the Executive Office of the President showing up as an exit point for commercial proxy services, again and again, mostly in the evening.

Layer3 Intel counted 236 residential proxy exits from AS2650, the White House network, between October 5 and November 3, 2026. The traffic came from six different IP addresses and passed through as many as 28 different proxy services.

Residential proxies sell the use of ordinary connections, usually through software quietly bundled into apps on someone's device. Whoever buys the bandwidth gets to look like they are browsing from that address.

The evening pattern

The timing is what stands out. About half of the activity landed between 5 p.m. and midnight Eastern time, and almost none came in the early morning.

Layer3 reads that as a person working late on the network with a device infected by a proxy SDK, rather than a public guest Wi-Fi network where anyone could be connecting at any hour.

Synthient, another research firm, linked beaconing from AS2650 to the proxy provider Infatica on multiple Windows 11 installs. It also tied traffic to Rave.io, a shared streaming app that bundles about 12 proxy SDKs, and saw Windows 10 and 11 devices beaconing to Geonode, Infatica and Mellowtel.

Who is on the other end

Infatica's founder, Vladimir Fomenko, is a Russian citizen. His hosting company, King Servers, was home to six of the eight web addresses the Kremlin used to compromise election system databases in Arizona and Illinois in 2016.

None of that adds up to a confirmed breach. The researchers describe proxy exit traffic and a likely infected device, not an intrusion into government systems. But the risk is real enough. Poorly secured proxy SDKs can open a path into internal networks and let an attacker move laterally, Layer3 warns, and past botnets have spread exactly that way.

Access is also cheap. Synthient has seen proxy resellers selling bandwidth for as little as 30 cents per gigabyte or $4 an hour, with zero KYC checks on who is buying.

Backdoors nobody meant to install

Sensitive networks keep getting exposed by software no one thought of as an entry point. Sometimes it is an aging management console, like the end of life SonicWall GMS installs that will never get a patch. Here it looks like a consumer app on a computer inside the most guarded office in the country.

Rave and the White House did not immediately respond to requests for comment.

Some offers on this page may be paid placements or contain affiliate links.