What was actually found
Security firm Layer3 Intel said it detected multiple residential proxy nodes beaconing out from the internet address network reserved for the Executive Office of the President (AS2650). Between October 5 and November 3, proxies exited from the White House network 236 times, using six internet addresses on 26 of the 30 days. Layer3 also found that 28 separate residential proxy services were able to exit through the network.
Layer3 says it cross-checked the addresses against Spur and Synthient. Their public IP context pages also classify the addresses as residential proxy exits.
This was not a targeted probe. Layer3 describes the discovery as accidental. Its researchers were requesting global rotating access through proxy services when the addresses showed up. In its words, anybody can get this access by signing up with a public service and paying a few dollars.
What a residential proxy does
A residential proxy lets a paying customer send web traffic through someone else's connection. From a website's perspective, the traffic appears to come from the rented IP address, not from the proxy customer. Users of these services can hide their location or identity. Abuses include account takeover, ad fraud and content scraping.
Many of these nodes are not set up on purpose. App developers can embed proxy networks' SDKs to monetize their software, and they earn a small payment per installation. A user can end up renting out their connection without clearly understanding it.
The Windows 11 and Infatica angle
Synthient said the activity beaconing out of AS2650 was related to multiple Windows 11 installations of a service called Infatica. KrebsOnSecurity describes Infatica as a proxy program often built into "free" mobile and desktop apps.
Synthient also pointed to a second possible source. Cybernews reports that Synthient believes some of the activity could be traced to Rave.io, a shared streaming app that bundles 12 proxy SDKs. These are Synthient's attributions. They do not identify the specific devices, and they do not explain how the software got onto the network.
The Russian connection, kept in proportion
Infatica's founder, Vladimir Fomenko, previously ran the hosting firm King Servers. Krebs reports that King Servers hosted six of the eight internet addresses Russia's state security services used to compromise election databases in Arizona and Illinois in 2016.
That is history about a founder's earlier business. It does not show that Infatica took part in those attacks. It does not show that the current activity was illicit or directed by any government. Techlicious notes that neither Layer3 nor Krebs makes either claim. Treat the Russian link as context, not as evidence of an operation.
What nobody knows yet
- Who owns the device. Layer3 says its data shows the exits, not the device or the person behind them.
- Whether anyone knew. Nothing shows that anyone at the White House knowingly installed proxy software.
- Whether internal systems were reached. No evidence shows that proxy customers reached or probed internal systems.
- The evening timing. About half the activity fell between 5 p.m. and midnight Eastern, with almost none in the early morning. Layer3 reads that as a person who is regularly on the network, not public guest Wi-Fi. That is an inference, not proof.
- How many devices. Six public addresses sit behind network address translation. One device could be enrolled in several services, or there could be several devices. Outside observation cannot tell these apart.
- Official response. The White House did not immediately respond to a request for comment.
Only the network operator can settle the open questions. Mapping the public addresses to internal hosts takes DHCP and NAT records, Wi-Fi association logs, device inventories and endpoint telemetry. Layer3 says it has backed up its raw logs and will share them with relevant agencies. Its founder told RuntimeWire that the company will not disclose the specific addresses and had not notified anyone as of that interview.
Two risks that shouldn't be confused
- Attribution and reputation. Outside services see traffic that appears to come from a sensitive government address range. That is true even when a stranger who bought proxy access generated the traffic.
- Internal reach. This risk is conditional. Layer3 points to Synthient's Kimwolf research. Kimwolf reached at least 2 million devices, mostly Android devices with an exposed ADB service, through residential proxy networks. If an SDK on this network had a similar flaw, a proxy customer could reach internal systems. No evidence shows that happened here.
The conditional risk has a track record. In January 2026, dozens of proxy services were forced to patch after Synthient's Ben Brundage showed how criminals were abusing a vulnerability to take over devices inside users' local networks. Spur's published research tested 11 providers and found that most allowed LAN access. That describes the providers Spur tested. It does not apply automatically to any one product, and it does not mean every provider had the same flaw.
Not just a White House problem
Krebs reports that Spur found residential proxies on nearly 300 government-run networks, 318 utility companies, 166 healthcare companies or hospitals, and 141 banking and finance companies. Krebs also cites an Infoblox finding that 65% of its customer base was querying at least one residential-proxy-related domain.
Those are vendor-reported counts. They are not proof of compromise at each organization. They do suggest that bring-your-own-device policies and unmanaged consumer software are a real gap.
What Windows admins and home users can do
For IT administrators:
- Review DNS and egress logs for residential proxy domains. Infoblox's finding shows that many organizations will see hits.
- Inventory what is installed on Windows 11 endpoints, including free utilities, streaming and "shared viewing" apps, and free VPN clients.
- Check whether BYOD and guest devices are segmented from internal resources. A proxy SDK on an unmanaged device is much less dangerous if its local network reach is limited.
- Keep logs that let you map public IPs to internal hosts at a given time. Without DHCP and NAT history, an outside report like this one cannot be traced to a machine.
For home users:
- If you can't tell how a free app makes money, skip it.
- Choose a reputable paid VPN instead of a free one of unknown origin.
- Remove browser extensions and apps you don't recognize or no longer use. Legitimate extensions have also been sold to malicious operators and then updated with harmful code.
- Even apps that openly pay you to share bandwidth have been found routing criminal traffic, Techlicious notes.
- Spur offers a free IP checker that shows whether your public IP has been associated with proxy or VPN activity. A positive result is a reason to audit your apps and devices. A clean result is not a guarantee, because the tool only reports what Spur has detected. Neither result tells you which device is responsible.
Bottom line
The established finding is narrow but notable. Proxy exit traffic from 28 services left through six addresses in the White House network, and some of it has been linked to Windows 11 installations of consumer-grade proxy software. Who installed it, whether they knew, and whether anything inside was exposed all remain unanswered. The same kind of software is probably on many other networks, from small offices to utilities and hospitals.
Update: Proxy activity stopped after State Department requested logs (November 5, 2026)
The Register reports that the latest observed proxy activity on the White House network occurred Wednesday night, November 4, and has since stopped. Layer3 Intel founder Sergiy Usatyuk told the outlet that the activity continued for hours after the firm published its findings. A halt in observed traffic does not establish why it stopped or whether the underlying software was removed.
According to The Register, the State Department contacted Layer3 on Thursday morning, November 5, to request its logs. Usatyuk said he had sent them. The report did not say what the department would do with the data or whether an investigation had identified any devices.
The Register also reports that Layer3’s retained data goes back to July 10 and that Usatyuk described continuous activity over a period of months. Synthient believes multiple Windows 10 and Windows 11 devices on the network likely have the Infatica SDK installed, according to the outlet. That attribution remains an assessment, not identification of specific machines.