White House IP Addresses Are for Rent on Proxy Networks

For about a month this fall, anyone with a credit card and a residential proxy account could have made their web traffic appear to come from the White House. Security firm Layer3 Intel stumbled on it while testing proxy services. "This is public access," its team wrote. "We caught this by chance, simply by requesting global rotating access through these services."

The White House did not immediately respond to a request for comment, Brian Krebs reported on November 4. Here is how a government computer ends up renting out its connection, and how to check your own.

Key Takeaways

• Layer3 Intel saw residential proxies exit through AS2650, the Executive Office of the President's network, 236 times from six internet addresses on 26 of the 30 days between October 5 and November 3, 2026.
• Layer3 Intel says 28 separate residential proxy services could route traffic out through that network, and anyone could buy access.
• Synthient attributed the activity to multiple Windows 11 installations of Infatica, a proxy program often bundled into free apps.
• The White House had not commented when the story ran, and nobody has said whether the devices were personal or government issued.

What Did Researchers Find on the White House Network?

They found that strangers could rent White House internet addresses by the gigabyte. According to KrebsOnSecurity, Layer3 Intel logged this on AS2650, the network registered to the Executive Office of the President:

• 236 exits through the White House network between October 5 and November 3.
• Six internet addresses doing the exiting, active on 26 of the 30 days.
• Mostly evenings, between 5 p.m. and midnight.
• 28 proxy services able to route traffic out through the network.

That is about eight rentals a day. IPinfo's record for AS2650 lists 65,792 IPv4 addresses under eop.gov. Six of them were enough to put the whole network on 28 services' menus.

How Did White House Computers Become Proxy Exit Nodes?

Most likely through software someone installed, not through a break in. Proxy tracking firm Synthient posted on November 4 that "Several Whitehouse staffers are running a Windows 11 machine with InfaticaSDK installed." Infatica pays app makers to bundle its SDK into free programs, and every installed copy lends its connection to Infatica's customers.

Infatica is not new. In 2021, Krebs reported that the company courted browser extension developers with offers of $15 to $45 each month for every 1,000 active users. One developer who took the deal was ModHeader's author, and that extension was later found hiding a browsing collector from 1.6M users. Infatica's founder, Vladimir Fomenko, is Russian; his hosting firm King Servers hosted six of the eight addresses used to breach Arizona and Illinois election databases in 2016. Fomenko denied any ties to that hacking. Nobody has said which app carried the SDK, or whether the machines were personal or government issued.

What Is a Residential Proxy?

A residential proxy is a paid service that routes a customer's traffic through someone else's home or office connection, so websites see that person's address instead. Google's Threat Intelligence Group describes the mechanism in its January 2026 IPIDEA takedown report: "Once the SDK is embedded into an application, it will turn the device it is running on into an exit node for the proxy network."

Devices get enrolled three main ways:

• Free apps with a bundled SDK, like the Infatica installs Synthient flagged.
• Cheap TV boxes shipped with proxy code. This week Google dismantled XCPE, a botnet of more than 1.3 million Android TV boxes; earlier the Popa botnet turned smart TVs into proxy nodes.
• Browser extensions, such as the 737 fake VPN extensions that piped Chrome through a proxy.

The resale market is cheap. Synthient founder Ben Brundage told Krebs some resellers sell bandwidth "for as low as 60 cents a Gigabyte," often without checking who the buyer is.

Why Does a Trusted IP Address Matter?

Because fraud filters and login systems judge a request partly by where it comes from. A login from a data center gets challenged; the same login from a residential or government address looks like a person at a desk. Google says that in a single seven day period in January 2026, over 550 threat groups it tracks used IPIDEA exit nodes, for "access to victim SaaS environments, on-premises infrastructure, and password spray attacks."

The White House is far from alone. In a January 2026 webinar, Spur found residential proxies in nearly 300 government networks, 318 utility companies, 166 healthcare companies or hospitals and 141 banking and finance firms. Infoblox now says 65% of its customer base has queried residential proxy related domains. In January, Infoblox put the share of corporate customers querying Kimwolf botnet domains alone at nearly 25%. Different measures, same direction: this lives inside managed networks, not just living rooms.

Most coverage will focus on who could pose as the White House. The bigger risk runs inward. Google found IPIDEA's software "also sent traffic to the device, in order to compromise it," and in January Brundage showed attackers abusing a proxy flaw to seize other devices on users' local networks. An exit node is a door, not just a costume.

What This Means for Your Inbox

Email accounts are prime targets for the password spray attacks Google described, and residential proxies make those attempts look like ordinary home users. A sign in from a normal looking home connection is no longer proof the login was yours. Check the device and time in Google's Security Checkup, and keep two step verification on so a correct password alone is not enough.

There is a second cost if your own device is an exit node. Google warns that owners can end up "flagged as suspicious or blocked by providers," because someone else's attacks come from their address. Constant CAPTCHAs can be the first visible sign.

How Can You Tell If a Device on Your Network Is a Proxy Exit Node?

Start with your public address, then work through the devices behind it:

• Check your IP. Layer3 Intel runs a free "is my network a residential proxy" lookup that checks your address against live proxy pools. A hit means something behind your router is renting it out.
• Remove bandwidth sharing apps. Google's advice is blunt: be "extremely wary of applications that offer payment in exchange for unused bandwidth." Uninstall any app that pays you for your connection, any free VPN you cannot vouch for, and on Windows 11 (Settings, Apps, Installed apps) any free utility you no longer use.
• Review your router. Match every connected device to something you own, and watch for steady upload traffic when nobody is home.
• Replace off brand TV boxes. Uncertified Android TV boxes are a known source of proxy malware. Buy streaming devices from reputable manufacturers and keep Google Play Protect switched on.

Journalists who protect sources should run the same audit on work laptops: an exit node is also a path into your network.

What Happens Next?

Watch for a White House statement and for the app that carried the SDK. The pattern is the one Google's GTIG keeps flagging: one free app installed on one machine can put a whole network up for rent. If it can happen on the President's network, it can happen on yours.