Anyone With a Few Dollars Could Send Web Traffic Out Through the White House Network. Layer3 Intel Counted 236 Exits in a Month, and 28 Proxy Services Could Do It.
If your organization lets employees bring laptops, phones or free apps onto its network, check whether any of them run a residential proxy. That is the lesson from a finding KrebsOnSecurity reported on November 4: staffers at the White House were using devices running proxy software that rents out their network's internet address to strangers. Layer3 Intel counted 236 exits from the Executive Office of the President network (AS2650) between October 5 and November 3.
What was found
A residential proxy service lets a customer send web requests so they appear to come from someone else's home or office address. The owner of that address is usually a person who installed a free app that quietly includes the proxy software and pays them a small amount per install.
Layer3 Intel says it saw multiple proxy nodes beaconing out of AS2650, the network block reserved for the Executive Office of the President. The activity was fairly steady from October 5 to November 3. Exits came from six internet addresses on 26 of those 30 days, mostly between 5 p.m. and midnight, 236 times in all. Layer3 says 28 separate residential proxy services could exit through that network.
Layer3 also says it did not aim at this network. It found it by chance, by asking global rotating proxy services for access and seeing where the requests came out. In its words, "This is public access. Anybody can obtain it by signing up to a public residential proxy service, paying a few dollars and sending requests through it."
Who is in the chain
The proxy tracker Synthient says the activity it saw from AS2650 came from multiple Windows 11 installations of Infatica, a proxy program often built into free mobile and desktop apps. According to Krebs, Infatica's founder, Vladimir Fomenko, ran a hosting firm called King Servers, which was home to six of the eight internet addresses Russia's state security services used to compromise election-system databases in Arizona and Illinois in 2016.
That history is context, not a finding about this case. The report does not say Infatica or its founder directed anything at the White House, or that the exits were used for an attack. What it says is that the exit was available to anyone, including anyone with bad intent.
Why this matters beyond one address
Think about what the exit gives a buyer. Anything sent through it looks like it came from a trusted government network. A site that trusts that address, or a fraud filter that scores it as clean, would treat that traffic well. Krebs names account takeover, advertising fraud and mass scraping for AI projects as common uses of these networks. We are reasoning here, not quoting: a clean-looking address is what a buyer is paying for.
The second risk is on the inside. Krebs recounts that in late 2025 criminals were mass-exploiting a flaw in these services that let them probe the local network behind each proxy endpoint, and in January 2026 dozens of services patched a related flaw. Synthient's Ben Brundage says some resellers sell bandwidth for as little as 60 cents a gigabyte, so for under a dollar a buyer can reach into trusted networks, and criminals can buy access without identity checks. The report does not say anyone reached inside the White House network. It says the door was the kind that has been used that way elsewhere.
This is not a government-only problem
Krebs cites a January 2026 Spur webinar that found residential proxies in nearly 300 government networks, 318 utility companies, 166 healthcare organizations and 141 banking and finance firms. Infoblox, in a blog post earlier this year, reported that 65% of its customers were querying one or more proxy-related domains. These are the figures as reported. We have not checked them.
We covered the criminal side of this earlier, when the FBI issued its residential-proxy advisory and we compared it with our own indicators: https://www.dugganusa.com/post/the-residential-proxy-network-the-fbi-won-t-name-we-have-1-360-iocs
What to do
Ask your DNS and egress logs which devices talk to residential-proxy domains. If you already collect DNS, this is a query, not a project.
Search installed software on managed endpoints for proxy-monetization components. These often arrive inside free utilities and other free apps.
Decide your bring-your-own-device policy on purpose. An unmanaged laptop or phone on the corporate network is where this software usually lives, per Krebs.
Do not treat a clean reputation score on an address as proof the traffic behind it is yours. Rented exits are bought precisely because the address looks trustworthy.
Do not add AS2650 addresses to a blocklist from this story. They belong to a victim network, and the report lists no indicators to block.
Those steps are our reading of the situation. The report gives no formal mitigation.
What is not known
Which devices carried the proxy software, and whether they were personal or government-issued. What traffic went out through the exits and who bought it. Whether anything inside the network was reached. How long the exposure ran before October 5 or after November 3. Whether the White House has removed the software. The White House had not responded to Krebs at publication, and the article carries no statement from Infatica or King Servers. The six addresses are not published in the article, and we have nothing to put in the feed from this story.
Limits
One secondary report, from KrebsOnSecurity. We did not read Layer3 Intel's or Synthient's own write-ups, we did not test any proxy service, and we have no visibility into AS2650. All counts, dates and quotations are as reported. The 2016 King Servers history is Krebs's account and we did not re-verify it.
Five percent of this is wrong somewhere. It always is. The primary reports will likely correct a count or a detail about which software ran where.
Was this useful? Rate this post. The widget is at the bottom of the page, and we read every response.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Comments