Back Securityweek Researchers Find Residential Proxies on White House Network
Security researchers have discovered multiple computers on the White House network that are used as residential proxy exit nodes.
According to Layer3 Intel, six IP addresses on AS2650, the network reserved for the Executive Office of the President, were used by 28 residential proxy services between October 5 and November 3.
“Our residential proxy enumeration pipeline exited through the White House network 236 separate times,” Layer3 Intel says.
These exits, the security firm says, can be used by anyone signing up to a public residential proxy service to send requests through them.
Most of the observed activity happens in the evening, between 5 p.m. and midnight, Eastern Time, and almost none in the early morning.
“That pattern suggests a person rather than a public guest Wi-Fi network: someone regularly on the White House network late into the evening, whose device is infected with a proxy SDK,” Layer3 Intel notes.
According to cybersecurity startup Synthient , which specializes in identifying residential proxies, VPNs, and bot infrastructure, the traffic comes from Windows 11 machines running the InfaticaSDK.
Based in Singapore, Infatica is a web-data intelligence and proxy service provider that claims to provide access to more than 45 million ethically sourced residential, mobile, and datacenter IP addresses worldwide.
Infatica’s founder Vladimir Fomenko also owns web hosting and IT infrastructure provider King Servers, which hosted “six of the eight internet addresses” that Russian state- hackers used in the 2016 US election attacks , investigative journalist Brian Krebs reports .
Per Layer3 Intel’s report, residential proxies have reached every corner of the world, even some of the most isolated places, such as the South Atlantic territory Saint Helena, Ascension and Tristan da Cunha.
“We recorded 413 addresses and more than 32,000 observations there, split between Starlink and the island’s local internet provider, Sure Saint Helena,” the company says.
Residential proxy exits were also observed in Antarctica, the Chagos Islands, the Falklands, Norfolk Island, Pitcairn, South Georgia, Svalbard, and Tokelau.
Related: AI-Linked Breaches Mount as WorkOS, Northflank, Trigger.dev Disclose Hacks
Related: AI Agents Got Root on Linux via 948 Kernel Flaws in OpenAI Research
Related: Bank Phishing Sites Show Fake ‘Suspended’ Pages to Evade Takedowns
Related: CISO Conversations: Ryan Davis – The Unknown Is Where Security Meets Reality
Ionut Arghire is an international correspondent for SecurityWeek.
More from Ionut Arghire
Zyxel Switch Hacks Blamed on Patched Flaw Actually Exploited a Zero-Day
Russia-Linked Hackers Hit iOS, Android Devices With Exploit Chains via Watering Holes
Agentic Data Security Firm Sentra Raises $150 Million
AI-Linked Breaches Mount as WorkOS, Northflank, Trigger.dev Disclose Hacks
Malicious cPGuard Updates Served in OpsShield Supply Chain Attack
Chrome 157 Rolls Out With 213 Security Fixes, Seven Rated Critical
Frontline Education Data Breach Impacts Over 1.3 Million
Android’s November 2026 Updates Patch Over 200 Vulnerabilities
Grocery Giant Ahold Delhaize Estimates Financial Toll of October Cyberattack
OpenSSH Rushes Patches for ‘SSHole’ Authentication Bypass
OpenAI Model Wrote Its Own Network Code to Get Around Sandbox Restrictions
3 Charged in Scheme to Use AI to Impersonate CEOs and Attorneys to Steal $129 Million
AI Agents Got Root on Linux via 948 Kernel Flaws in OpenAI Research
Bank Phishing Sites Show Fake ‘Suspended’ Pages to Evade Takedowns
Cyberattack Hits French Blood Bank Site but No Blood Products Are Compromised
Cisco, WatchGuard Release Patches; SonicWall Won’t Fix GMS Flaws
Flipboard Whatsapp Whatsapp Email
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
