"This is public access," the Layer3 Intel team wrote — a blunt diagnosis after security researchers found dozens of residential proxy exit nodes using internet addresses reserved for the Executive Office of the President (AS2650).
Layer3 Intel's findings: AS2650 and the scale of exits
Layer3 Intel reported detecting multiple residential proxy nodes beaconing from AS2650, the internet address block assigned to the White House. The firm said proxy activity was "relatively persistent between October 5 to November 3," and that a review of proxies available from AS2650 showed they exited from the White House network 236 times during that period. Layer3 added that the proxy exit nodes came from six internet addresses, appeared on 26 of the 30 days, and that most of the activity happened in the evening, "between 5 p.m. and midnight." The White House did not immediately respond to a request for comment.
Synthient and Infatica: Windows 11 installations and a named founder
The proxy-tracking firm Synthient attributed the activity it saw coming from AS2650 to multiple Windows 11 installations of a service called Infatica, a proxy program that is "often integrated into 'free' mobile and desktop applications," Synthient said on Twitter/X. The source identifies Infatica’s founder as Vladimir Fomenko and notes that Fomenko is "a Russian man whose hosting firm King Servers was home to six of the eight internet addresses used by Russia’s state security services to compromise databases for election systems in Arizona and Illinois in 2016." Layer3 Intel also reported that it found 28 separate residential proxy services able to exit through AS2650, underlining that Infatica was not the sole reseller involved.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadHow residential proxy services work — and why security teams worry
Residential proxy services rent other people’s internet addresses so customers can anonymize traffic or spoof location; to external websites, the traffic appears to originate from the rented IP, not the customer. The source notes that there are dozens of residential proxy providers with varying degrees of legitimacy, many of them based in China or Russia. Layer3 emphasized the simplicity of access: "Anybody can obtain it by signing up to a public residential proxy service, paying a few dollars and sending requests through it."
Those services are already linked to a range of unwanted or illicit activity, the reporting says, including account takeover, advertising fraud, mass content scraping for AI projects, and other cybercrime. They also introduce technical risks: a vulnerability disclosed in late 2025 allowed cybercriminals to probe each proxy endpoint’s local network for vulnerable systems, and in January 2026 dozens of proxy services were forced to patch their networks after Synthient founder Ben Brundage showed how criminals could seize control over devices inside the local networks of unsuspecting users.
Prior research and the prevalence of proxies in sensitive networks
Independent tracking firms and security vendors have repeatedly found residential proxy presence inside critical and sensitive networks. Spur reported in a January 2026 webinar that it found residential proxies in nearly 300 government-owned and -operated networks, 318 utility companies, 166 healthcare companies or hospitals, and 141 companies in banking and finance. Security firm Infoblox said in a blog post earlier this year that it discovered 65% of its customer base was querying one or more residential proxy–related domains. Those findings underline a broader pattern: proxy SDKs embedded by app developers can monetize software installations and, unintentionally, place exit nodes on workplace networks.
What this means for the White House network, technologists, and the public
- The White House network (the Executive Office of the President, AS2650): faces a clear operational question about devices or applications that are running residential proxy SDKs and making exit nodes available. Layer3 Intel’s count — 236 exits from six addresses over a four-week span — is concrete evidence of traffic patterns that require investigation; the White House did not immediately respond to requests for comment.
- Technologists and security teams: will be watching proxy-exit telemetry closely, the timing of the traffic (primarily evenings, 5 p.m.–midnight), and the list of reseller services (Layer3 identified 28). The January 2026 and late-2025 incidents cited in the reporting show that proxy ecosystems can carry exploitable vulnerabilities and that patching and supply-chain scrutiny have been required before.
- End users and the public: should be aware that proxy resellers can be inexpensive to buy into. As Ben Brundage told KrebsOnSecurity, "Some of these resellers sell bandwidth for as low as 60 cents a Gigabyte, that means for less than a dollar you can gain access into some of the most confidential and trusted networks," and the reseller ecosystem can enable buyers to "skip KYC [Know Your Customer] processes."
Layer3 Intel’s discovery places a technical reality — publicly rentable exit nodes operating from AS2650 — squarely in the open record. The combination of inexpensive reseller bandwidth, widely used SDK monetization models, and prior, demonstrable vulnerabilities in proxy services frames a straightforward policy and operational problem: who on AS2650 is running these endpoints, and what remedial steps will be taken? The public record shows the exits and names the services implicated; it does not yet record a response from the Executive Office of the President.
Source: KrebsOnSecurity — Want to Rent an Internet Address at the White House?
