Researchers Say Anyone Can Rent Internet Addresses That Exit Through the White House Network
Layer3 Intel and Synthient found residential proxy exit nodes on the Executive Office of the President network, including traffic tied to Infatica. Here is what that means for trusted networks everywhere.
For a few dollars on a public residential proxy service, researchers say, traffic can be made to look like it came from inside one of the most sensitive networks in the United States. Brian Krebs reports that security firms caught proxy exit nodes beaconing from address space reserved for the Executive Office of the President.
The account below follows Krebs on Security, citing Layer3 Intel and proxy tracker Synthient.
What the researchers observed
- Layer3 Intel detected residential proxy nodes on AS2650, the network reserved for the Executive Office of the President.
- Activity was relatively persistent from October 5 to November 3; a review showed proxies exiting that network 236 times in the period.
- Exit nodes appeared on six internet addresses across 26 of 30 days, mostly in the evening between 5 p.m. and midnight.
- Synthient linked activity it saw to multiple Windows 11 installations of Infatica, a proxy program often bundled into “free” mobile and desktop apps.
- Layer3 said 28 separate residential proxy services were able to exit through this network—access anyone can buy by signing up, paying a few dollars and requesting global rotating access.
Why Infatica raised eyebrows
Infatica’s founder, Vladimir Fomenko, previously ran King Servers, the hosting firm Krebs notes was home to six of eight internet addresses used by Russian state security services against election systems in Arizona and Illinois in 2016. The White House did not immediately respond to a request for comment in Krebs’s report.
How residential proxies usually get inside
These services rent someone else’s IP so customers can anonymize traffic or spoof location. From a website’s point of view, the request appears to come from the rented address. App developers often embed proxy SDKs to monetize free software. Employees then bring those devices—or install those apps—onto corporate and government Wi-Fi. Spur previously found residential proxies across nearly 300 government networks, 318 utilities, 166 healthcare organizations and 141 banking and finance firms; Infoblox has said 65% of its customer base queried one or more residential-proxy-related domains. Past abuse has included account takeover, ad fraud, mass scraping, and—after flaws disclosed in late 2025 and patched by many services in January 2026—probing the local networks behind the proxy endpoints.
What this means for your company
If it can happen on the Executive Office network, it can happen on yours. A laptop or phone running a “free” app with a proxy SDK can turn your trusted egress IP into someone else’s anonymity layer—and can expose your local network if the proxy software is buggy. Block known residential-proxy domains and ASN patterns at the firewall where you can, ban consumer VPN/proxy apps on managed devices, watch for odd evening egress from staff devices, and treat any unexplained outbound peer connections as worth a ticket. Trusted IP allowlists at vendors are only as strong as the devices sitting behind those IPs.
Worried that unmanaged apps or BYOD devices are turning your office IP into a rented proxy exit? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
