# Residential proxy exits observed on White House / EOP network AS2650 (236 exits via 28 services) · pwn.watch > Layer3 Intel's Residential Proxy Observatory recorded residential-proxy exit traffic through AS2650, the autonomous system registered to the Executive Office of the President that hosts the White House network, 236 times between Oct 5 and Nov 3 2026. Exits came from six addresses on 26 of those 30 days, and 28 separate residential proxy services offered the route. Anyone paying a few dollars for public rotating residential-proxy access could send traffic that appears to originate inside that network. About half of observations fell between 5 p.m. and midnight Eastern time, with almost none in early morning — Layer3 interprets that as a person regularly on the network whose device is running a proxy SDK, while stressing its data shows exits, not the device or person. Synthient separately attributed AS2650 beaconing to Windows 10/11 installs of InfaticaSDK and, with claimed high confidence, to the shared-streaming app Rave.io bundling multiple proxy SDKs. Krebs notes Infatica's founder previously ran King Servers, tied to 2016 election-system compromises. Layer3 warns poorly secured proxy SDKs have enabled local-network probing and lateral movement in past botnets; there is no public confirmation of data theft or internal lateral movement here. As of Krebs's Nov 4 report the White House had not immediately responded; Runtime Wire later reported Layer3's founder said the firm had not notified the White House. Page: https://pwn.watch/i/white-house-eop-as2650-residential-proxy-exits-nov-2026 · generated 2026-11-06T14:36:23.099Z ## Status - Severity: high · status: live · patch: partial - Product: Executive Office of the President / White House network (AS2650) devices running residential proxy SDKs (Infatica / alleged Rave.io and others) - Started: 2026-10-05 - Affected: Devices on AS2650 (EOP / White House network) acting as residential proxy exits between at least 2026-10-05 and 2026-11-03 - Fixed in: No public remediation confirmation from the White House as of Nov 6 2026 coverage; operators typically remove proxy-SDK apps, rotate credentials, and enforce egress / device-policy controls ## Follow this incident - RSS (one item per update): https://pwn.watch/i/white-house-eop-as2650-residential-proxy-exits-nov-2026/feed.xml - JSON Feed: https://pwn.watch/i/white-house-eop-as2650-residential-proxy-exits-nov-2026/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/white-house-eop-as2650-residential-proxy-exits-nov-2026.json - This file: https://pwn.watch/i/white-house-eop-as2650-residential-proxy-exits-nov-2026/llms.txt ## Updates (newest first) - 2026-11-06: Help Net Security summarizes Layer3's report and the Synthient Rave.io / Infatica attribution. (https://www.helpnetsecurity.com/2026/11/06/white-house-residential-proxy-traffic/) - 2026-11-05: Hacker News discussion of the Layer3 / Krebs reporting. (https://news.ycombinator.com/item?id=50371246) - 2026-11-04: Layer3 Intel publishes "Residential Proxies Detected on White House Network," cross-checking exits with Spur and Synthient and noting the evening-ET activity pattern. (https://layer3intel.com/blog/residential-proxies-white-house-network) - 2026-11-04: Krebs on Security covers the finding; Synthient links AS2650 activity to Infatica on Windows 11 devices and notes Infatica founder Vladimir Fomenko's King Servers history; White House does not immediately comment. (https://krebsonsecurity.com/2026/11/want-to-rent-an-internet-address-at-the-white-house/) - 2026-11-04: Synthient posts that several White House staffers appear to run Windows machines with InfaticaSDK and later claims high confidence the app is Rave.io bundling multiple proxy SDKs (per Help Net Security). (https://www.helpnetsecurity.com/2026/11/06/white-house-residential-proxy-traffic/) - 2026-11-03: End of Layer3's published window: 236 exits from 6 addresses across 26 of 30 days via 28 proxy services. (https://layer3intel.com/blog/residential-proxies-white-house-network) - 2026-10-05: Start of Layer3's published observation window: residential proxy exits begin appearing from AS2650. (https://layer3intel.com/blog/residential-proxies-white-house-network) ## Fix brief # Security brief: Residential proxy exits observed on White House / EOP network AS2650 (236 exits via 28 services) Source: https://pwn.watch/i/white-house-eop-as2650-residential-proxy-exits-nov-2026 · status: live · severity: high · updated Nov 6, 2026, 11:31 UTC ## Patch status **PARTIALLY PATCHED: some fixes exist, but not every affected branch/product is covered. Check carefully and apply mitigations where no fix exists.** ## What it is Layer3 Intel's Residential Proxy Observatory recorded residential-proxy exit traffic through AS2650, the autonomous system registered to the Executive Office of the President that hosts the White House network, 236 times between Oct 5 and Nov 3 2026. Exits came from six addresses on 26 of those 30 days, and 28 separate residential proxy services offered the route. Anyone paying a few dollars for public rotating residential-proxy access could send traffic that appears to originate inside that network. About half of observations fell between 5 p.m. and midnight Eastern time, with almost none in early morning — Layer3 interprets that as a person regularly on the network whose device is running a proxy SDK, while stressing its data shows exits, not the device or person. Synthient separately attributed AS2650 beaconing to Windows 10/11 installs of InfaticaSDK and, with claimed high confidence, to the shared-streaming app Rave.io bundling multiple proxy SDKs. Krebs notes Infatica's founder previously ran King Servers, tied to 2016 election-system compromises. Layer3 warns poorly secured proxy SDKs have enabled local-network probing and lateral movement in past botnets; there is no public confirmation of data theft or internal lateral movement here. As of Krebs's Nov 4 report the White House had not immediately responded; Runtime Wire later reported Layer3's founder said the firm had not notified the White House. Severity detail: Publicly rentable exit path through the White House/EOP network for weeks; possible path into internal systems if proxy SDKs are flawed, but no confirmed data breach or lateral movement published - Product: Executive Office of the President / White House network (AS2650) devices running residential proxy SDKs (Infatica / alleged Rave.io and others) ## Affected versions - Devices on AS2650 (EOP / White House network) acting as residential proxy exits between at least 2026-10-05 and 2026-11-03 ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix Upgrade to one of these fixed versions (or later on the same branch): - No public remediation confirmation from the White House as of Nov 6 2026 coverage; operators typically remove proxy-SDK apps, rotate credentials, and enforce egress / device-policy controls After upgrading, re-run the checks above and redeploy/restart the affected services. ## Mitigations The data marks this as partial. Until every affected component is fixed, apply the vendor mitigations from the advisories below (restrict network exposure of the affected service, disable the vulnerable feature if the advisory allows). ## Secrets to rotate This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs. ## Specific notes Postable breach under Oct 26 Kitze approval for breach tweets; not a sponsor hold. ## Latest updates - Nov 6, 2026: Help Net Security summarizes Layer3's report and the Synthient Rave.io / Infatica attribution. - Nov 5, 2026: Hacker News discussion of the Layer3 / Krebs reporting. - Nov 4, 2026: Layer3 Intel publishes "Residential Proxies Detected on White House Network," cross-checking exits with Spur and Synthient and noting the evening-ET activity pattern. - Nov 4, 2026: Krebs on Security covers the finding; Synthient links AS2650 activity to Infatica on Windows 11 devices and notes Infatica founder Vladimir Fomenko's King Servers history; White House does not immediately comment. - Nov 4, 2026: Synthient posts that several White House staffers appear to run Windows machines with InfaticaSDK and later claims high confidence the app is Rave.io bundling multiple proxy SDKs (per Help Net Security). - Nov 3, 2026: End of Layer3's published window: 236 exits from 6 addresses across 26 of 30 days via 28 proxy services. - Oct 5, 2026: Start of Layer3's published observation window: residential proxy exits begin appearing from AS2650. ## Write-ups & news - [Residential Proxies Detected on White House Network](https://layer3intel.com/blog/residential-proxies-white-house-network) - [Want to Rent an Internet Address at the White House?](https://krebsonsecurity.com/2026/11/want-to-rent-an-internet-address-at-the-white-house/) - [Residential proxy traffic caught leaving the White House network](https://www.helpnetsecurity.com/2026/11/06/white-house-residential-proxy-traffic/) - [HN discussion of White House residential proxy exits](https://news.ycombinator.com/item?id=50371246) ## Caveats Not a confirmed exfiltration or ransomware event: device-on-network residential proxy SDK exposure. Layer3 states its data shows exits only. Synthient's Rave.io claim is third-party attribution, not White House confirmation. --- Machine-readable: https://pwn.watch/i/white-house-eop-as2650-residential-proxy-exits-nov-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.