White House IP addresses exposed via residential proxy software

Security researchers from firms Layer3 Intel and Synthient have discovered residential proxy activity on the White House network. Someone inside the presidential facility appears to be running software that allows outsiders to rent access to the network for just a few dollars.

• Residential proxy activity discovered on the White House network
• Traffic routed through the network from October 5th to November 3rd
• Rave video-sharing app suspected of bundling proxy SDKs
• Windows 10 and Windows 11 devices found beaconing proxy providers

How residential proxies work and why they pose a risk

A residential proxy allows individuals to rent access to a home or office IP address and route their internet traffic through it, concealing the true origin of their activity. Some applications and browser extensions include third-party software development kits (SDKs) that silently install proxy nodes on user devices.

While legitimate businesses use proxies for ad verification and testing, malicious actors exploit them to bypass geolocation filters. Hackers have used residential proxies for credential stuffing, botnet creation, and account takeovers. Layer3 Intel found that 28 proxy services routed traffic out of the White House network between October 5th and November 3rd.

Activity patterns and potential infection vectors

According to the researchers, this suspicious network activity typically occurred between 5 PM ET and midnight. This consistent pattern points to a regular occupant staying late at the White House rather than a public guest Wi-Fi network, suggesting an infected device on the premises.

Synthient notes that the watch party app Rave could be linked to the issue, as the platform allegedly bundles 12 proxy SDKs. Windows 10 and Windows 11 devices on the network were found beaconing to known proxy providers such as Geonode, Infatica, and Mellowtel.

Connections to known proxy providers and security warnings

As reported by Krebs on Security, Infatica was founded by Vladimir Fomenko, whose company King Servers was previously linked to cyberattacks on election systems in Illinois and Arizona back in 2016. Layer3 warns that this public residential proxy access is available to anyone willing to pay a few dollars.

What this means for cybersecurity and government networks

The White House incident highlights how vulnerable modern secure networks are to background software components embedded in consumer apps. Unmanaged devices and third-party SDKs can unintentionally turn high-security environments into public proxy nodes.

For IT and security administrators, this underscores the necessity of strict outbound traffic monitoring and software audits. Ensuring that consumer applications do not run unauthorized proxy services is critical for preventing corporate and government network compromises.