For about a month, anyone with a few dollars could make their internet traffic look as if it was coming from the White House. Security researchers say 28 residential proxy services were routing customer traffic through six IP addresses on the network reserved for the Executive Office of the President.
The finding comes from Layer3 Intel, a security firm that spotted the activity through its new Residential Proxy Observatory. In a report published on November 4, the firm said it recorded 236 proxy exits from six White House addresses on 26 of the 30 days between October 5 and November 3. Most of the traffic flowed in the evenings, between 5 p.m. and midnight Washington time.
"This is public access," the Layer3 team wrote. "Anybody can obtain it by signing up to a public residential proxy service, paying a few dollars and sending requests through it."
236 exits from six addresses
A residential proxy service routes a customer's internet requests through someone else's connection, so the traffic appears to come from that connection's address. The services are used to hide a user's real location, and also for account takeovers, ad fraud and large-scale AI data scraping.
Layer3 said it caught the activity by chance, while requesting rotating proxy access around the world, and stressed that its data shows the exits, not the device or the person behind them.
The addresses sit on AS2650, the autonomous system registered to the Executive Office of the President. Another security firm, Synthient, independently observed proxy traffic on the same addresses and confirmed the pattern.
How a free app can sell a network
Synthient traced the traffic to multiple Windows 11 installations of Infatica, a proxy program whose software kit is often bundled into free mobile and desktop apps. App developers embed the kit in exchange for payment, and the device quietly becomes an exit node that strangers can rent.
One report suggested the likely source was Rave, a watch-party app said to bundle as many as a dozen proxy kits. The exact device behind the White House exits has not been identified.
The Infatica connection drew extra attention because of its founder. Vladimir Fomenko is a Russian national whose hosting company, King Servers, hosted six of the eight internet addresses that Russian state hackers used against election systems in Arizona and Illinois in 2016, according to Krebs on Security, which first reported the White House findings on November 5.
No sign of a breach, but a warning
Nothing in the findings shows that anyone reached internal White House systems. The researchers were careful to draw that line: the data proves traffic was exiting through the network's addresses, not that attackers had broken in.
But Layer3 warned the risk is real. Past research has shown that poorly secured proxy kits can allow access not only to the public internet but also to private addresses reachable from the device. "If an SDK on this network has the same kind of flaw, anyone buying proxy access could use it to reach internal systems," the firm wrote.
The activity appears to have stopped after the findings went public: the last proxy exit was spotted on Wednesday night, hours after Layer3's blog post went live. Layer3 said it has preserved raw logs of the activity and is willing to share them with the relevant agencies.
