Privacy · Networking
White House network IP addresses found for sale on proxy services
Researchers found that six White House IP addresses were being used as exit nodes by 28 residential proxy services, raising concerns about internal network exposure. The White House has not commented.
Ross GrantUpdated 2 min read
The short version
Security researchers found that several White House computers were being used as part of commercial proxy networks. This means outsiders could make their internet traffic look like it came from inside the White House. The likely cause was staff installing a popular app that included hidden proxy software. The White House has not responded to the reports.
By the numbers
- 6White House IP addresses used as proxy exitsBankInfoSecurity
- 28Residential proxy services offering White House IPsBankInfoSecurity
- 236Times proxy traffic exited the White House network in 30 daysHelp Net Security
What happened?
Researchers found that six IP addresses belonging to the White House network were being used as exit nodes by 28 residential proxy services between 5 October and 3 November 2026. This allowed anyone to route their internet traffic through the White House network for a small fee. The likely cause was staff devices infected with proxy SDKs, possibly via a streaming app. The White House has not commented.
How the flaw works
Security firm Layer3 Intel discovered that six IP addresses belonging to the White House network were being used as exit points by 28 different residential proxy services between 5 October and 3 November 2026. This means that anyone paying a few dollars to these proxy services could route their internet traffic through the White House network, making it appear as if their activity originated from inside one of the most secure buildings in the world [BankInfoSecurity (opens in a new tab)][Help Net Security (opens in a new tab)][CNET (opens in a new tab)].
Residential proxies work by installing software on consumer devices, often through free apps or software development kits (SDKs). When installed, these SDKs allow the device to act as a "proxy node," letting outsiders rent its internet connection. In this case, the SDK in question was Infatica, which has previously been linked to large-scale botnet operations and is run by a Russian entrepreneur whose infrastructure was reportedly used in past election-related attacks [BankInfoSecurity (opens in a new tab)].
Who is affected
The affected network is AS2650, registered to the Executive Office of the President. Researchers from Layer3 Intel and Synthient found that several White House staffers were running Windows 11 machines with the Infatica SDK installed. The likely source was a popular streaming app, Rave, which bundles multiple proxy SDKs into its platform. Activity patterns suggest the devices were used by staff working late, not by public Wi-Fi guests [Help Net Security (opens in a new tab)][CNET (opens in a new tab)].
The response
Layer3 Intel, Synthient, and Spur Intelligence all independently confirmed the proxy activity. The researchers did not intentionally target the White House network; they discovered it while scanning for global proxy exits. The White House has not responded to requests for comment from multiple outlets. Security experts warn that such proxy infections can expose internal networks to attackers, allowing them to move laterally and potentially spread malware or probe for further vulnerabilities [BankInfoSecurity (opens in a new tab)][Help Net Security (opens in a new tab)].
What you should do
For organisations and individuals, this incident highlights the risks of installing free apps or SDKs that may include proxy services. Experts recommend regularly updating device firmware, installing software only from trusted sources, and using proxy-checking tools to see if your IP address is listed in public proxy networks. Free VPNs and third-party apps are common sources of such risks. If a device is found to be acting as a proxy node, removing the offending app or SDK and changing network credentials is advised [CNET (opens in a new tab)].
Claimed vs confirmed
- Unconfirmed
Several White House staffers are running Windows 11 machines with Infatica SDK installed.
Synthient claimed this based on proxy detection, but the White House has not confirmed.
- Unconfirmed
The Rave streaming app was the likely source of the proxy SDK infection.
Synthient attributed the infection to Rave, but this has not been independently verified.
Why it matters
If attackers can route traffic through sensitive networks like the White House, they may be able to probe internal systems or hide the true origin of their activity. The same risk applies to any organisation or home where devices run apps with embedded proxy SDKs.
Key points
- Six White House IP addresses were used by 28 proxy services as exit nodes.
- Anyone could pay to route traffic through the White House network.
- Staff devices were likely infected by a proxy SDK bundled with a streaming app.
- Residential proxies can expose internal networks to attackers.
- The White House has not commented on the incident.
Sources
BankInfoSecurity
Reference
- White House IP Addresses Sold Through Proxy Services (opens in a new tab)
bankinfosecurity.com
- White House IP Addresses Sold Through Proxy Services (opens in a new tab)
CNET
Reference
Help Net Security
Reference
CSO Online
Reference
Security Affairs
Reference
