Residential proxy exits observed on White House / EOP network AS2650 (236 exits via 28 services)
Executive Office of the President / White House network (AS2650) devices running residential proxy SDKs (Infatica / alleged Rave.io and others)
Sponsored
Brought to you byTinkerer Club
The private club for people who own their servers, run their own AI, and pay $0/month for software.
Layer3 Intel's Residential Proxy Observatory recorded residential-proxy exit traffic through AS2650, the autonomous system registered to the Executive Office of the President that hosts the White House network, 236 times between Oct 5 and Nov 3 2026. Exits came from six addresses on 26 of those 30 days, and 28 separate residential proxy services offered the route. Anyone paying a few dollars for public rotating residential-proxy access could send traffic that appears to originate inside that network. About half of observations fell between 5 p.m. and midnight Eastern time, with almost none in early morning — Layer3 interprets that as a person regularly on the network whose device is running a proxy SDK, while stressing its data shows exits, not the device or person. Synthient separately attributed AS2650 beaconing to Windows 10/11 installs of InfaticaSDK and, with claimed high confidence, to the shared-streaming app Rave.io bundling multiple proxy SDKs. Krebs notes Infatica's founder previously ran King Servers, tied to 2016 election-system compromises. Layer3 warns poorly secured proxy SDKs have enabled local-network probing and lateral movement in past botnets; there is no public confirmation of data theft or internal lateral movement here. As of Krebs's Nov 4 report the White House had not immediately responded; Runtime Wire later reported Layer3's founder said the firm had not notified the White House.
Why this severity: Publicly rentable exit path through the White House/EOP network for weeks; possible path into internal systems if proxy SDKs are flawed, but no confirmed data breach or lateral movement published
- Started
- Oct 5, 2026
Affected
- Devices on AS2650 (EOP / White House network) acting as residential proxy exits between at least 2026-10-05 and 2026-11-03
Fixed in
- No public remediation confirmation from the White House as of Nov 6 2026 coverage; operators typically remove proxy-SDK apps, rotate credentials, and enforce egress / device-policy controls
Timeline7
Help Net Security summarizes Layer3's report and the Synthient Rave.io / Infatica attribution.
Hacker News discussion of the Layer3 / Krebs reporting.
Layer3 Intel publishes "Residential Proxies Detected on White House Network," cross-checking exits with Spur and Synthient and noting the evening-ET activity pattern.
Krebs on Security covers the finding; Synthient links AS2650 activity to Infatica on Windows 11 devices and notes Infatica founder Vladimir Fomenko's King Servers history; White House does not immediately comment.
Synthient posts that several White House staffers appear to run Windows machines with InfaticaSDK and later claims high confidence the app is Rave.io bundling multiple proxy SDKs (per Help Net Security).
End of Layer3's published window: 236 exits from 6 addresses across 26 of 30 days via 28 proxy services.
Start of Layer3's published observation window: residential proxy exits begin appearing from AS2650.
News & write-ups4
- Residential Proxies Detected on White House NetworkLayer3 Intel · Nov 4, 2026 · Write-up
- Want to Rent an Internet Address at the White House?Krebs on Security · Nov 4, 2026
- Residential proxy traffic caught leaving the White House networkHelp Net Security · Nov 6, 2026
- HN discussion of White House residential proxy exitsHacker News · Nov 5, 2026
Notes & caveats
Not a confirmed exfiltration or ransomware event: device-on-network residential proxy SDK exposure. Layer3 states its data shows exits only. Synthient's Rave.io claim is third-party attribution, not White House confirmation.
Get an email when a new major security incident drops. No spam, unsubscribe any time.
