Residential proxy exits observed on White House / EOP network AS2650 (236 exits via 28 services) · updates https://pwn.watch/i/white-house-eop-as2650-residential-proxy-exits-nov-2026 Layer3 Intel's Residential Proxy Observatory recorded residential-proxy exit traffic through AS2650, the autonomous system registered to the Executive Office of the President that hosts the White House network, 236 times between Oct 5 and Nov 3 2026. Exits came from six addresses on 26 of those 30 days, and 28 separate residential proxy services offered the route. Anyone paying a few dollars for public rotating residential-proxy access could send traffic that appears to originate inside that network. About half of observations fell between 5 p.m. and midnight Eastern time, with almost none in early morning — Layer3 interprets that as a person regularly on the network whose device is running a proxy SDK, while stressing its data shows exits, not the device or person. Synthient separately attributed AS2650 beaconing to Windows 10/11 installs of InfaticaSDK and, with claimed high confidence, to the shared-streaming app Rave.io bundling multiple proxy SDKs. Krebs notes Infatica's founder previously ran King Servers, tied to 2016 election-system compromises. Layer3 warns poorly secured proxy SDKs have enabled local-network probing and lateral movement in past botnets; there is no public confirmation of data theft or internal lateral movement here. As of Krebs's Nov 4 report the White House had not immediately responded; Runtime Wire later reported Layer3's founder said the firm had not notified the White House. en Fri, 06 Nov 2026 00:00:00 GMT Residential proxy exits observed on White House / EOP network AS2650 (236 exits via 28 services): Help Net Security summarizes Layer3's report and the Synthient Rave.io / Infatica attribution. https://pwn.watch/i/white-house-eop-as2650-residential-proxy-exits-nov-2026 https://pwn.watch/i/white-house-eop-as2650-residential-proxy-exits-nov-2026#2026-11-06-e94c4566 Fri, 06 Nov 2026 00:00:00 GMT high <p><a href="https://www.helpnetsecurity.com/2026/11/06/white-house-residential-proxy-traffic/">Source</a></p> Residential proxy exits observed on White House / EOP network AS2650 (236 exits via 28 services): Hacker News discussion of the Layer3 / Krebs reporting. https://pwn.watch/i/white-house-eop-as2650-residential-proxy-exits-nov-2026 https://pwn.watch/i/white-house-eop-as2650-residential-proxy-exits-nov-2026#2026-11-05-7f5edc19 Thu, 05 Nov 2026 00:00:00 GMT high <p><a href="https://news.ycombinator.com/item?id=50371246">Source</a></p> Residential proxy exits observed on White House / EOP network AS2650 (236 exits via 28 services): Layer3 Intel publishes "Residential Proxies Detected on White House Network," cross-checking exits with Spur and Synthient and noting the evening-ET activity pattern. https://pwn.watch/i/white-house-eop-as2650-residential-proxy-exits-nov-2026 https://pwn.watch/i/white-house-eop-as2650-residential-proxy-exits-nov-2026#2026-11-04-543cfb15 Wed, 04 Nov 2026 00:00:00 GMT high <p><a href="https://layer3intel.com/blog/residential-proxies-white-house-network">Source</a></p> Residential proxy exits observed on White House / EOP network AS2650 (236 exits via 28 services): Krebs on Security covers the finding; Synthient links AS2650 activity to Infatica on Windows 11 devices and notes Infatica founder Vladimir Fomenko's King Servers history; White House does not immediately comment. https://pwn.watch/i/white-house-eop-as2650-residential-proxy-exits-nov-2026 https://pwn.watch/i/white-house-eop-as2650-residential-proxy-exits-nov-2026#2026-11-04-dfbeb7d9 Wed, 04 Nov 2026 00:00:00 GMT high <p><a href="https://krebsonsecurity.com/2026/11/want-to-rent-an-internet-address-at-the-white-house/">Source</a></p> Residential proxy exits observed on White House / EOP network AS2650 (236 exits via 28 services): Synthient posts that several White House staffers appear to run Windows machines with InfaticaSDK and later claims high confidence the app is Rave.io bundling multiple proxy SDKs (per Help Net Security). https://pwn.watch/i/white-house-eop-as2650-residential-proxy-exits-nov-2026 https://pwn.watch/i/white-house-eop-as2650-residential-proxy-exits-nov-2026#2026-11-04-31db16df Wed, 04 Nov 2026 00:00:00 GMT high <p><a href="https://www.helpnetsecurity.com/2026/11/06/white-house-residential-proxy-traffic/">Source</a></p> Residential proxy exits observed on White House / EOP network AS2650 (236 exits via 28 services): End of Layer3's published window: 236 exits from 6 addresses across 26 of 30 days via 28 proxy services. https://pwn.watch/i/white-house-eop-as2650-residential-proxy-exits-nov-2026 https://pwn.watch/i/white-house-eop-as2650-residential-proxy-exits-nov-2026#2026-11-03-d5682094 Tue, 03 Nov 2026 00:00:00 GMT high <p><a href="https://layer3intel.com/blog/residential-proxies-white-house-network">Source</a></p> Residential proxy exits observed on White House / EOP network AS2650 (236 exits via 28 services): Start of Layer3's published observation window: residential proxy exits begin appearing from AS2650. https://pwn.watch/i/white-house-eop-as2650-residential-proxy-exits-nov-2026 https://pwn.watch/i/white-house-eop-as2650-residential-proxy-exits-nov-2026#2026-10-05-5f89b744 Mon, 05 Oct 2026 00:00:00 GMT high <p><a href="https://layer3intel.com/blog/residential-proxies-white-house-network">Source</a></p>