#Eop

October 2026 1

• High◐Partly patched

  Residential proxy exits observed on White House / EOP network AS2650 (236 exits via 28 services)

  Layer3 Intel's Residential Proxy Observatory recorded residential-proxy exit traffic through AS2650, the autonomous system registered to the Executive Office of the President that hosts the White House network, 236 times between Oct 5 and Nov 3 2026. Exits came from six addresses on 26 of those 30 days, and 28 separate residential proxy services offered the route. Anyone paying a few dollars for public rotating residential-proxy access could send traffic that appears to originate inside that network. About half of observations fell between 5 p.m. and midnight Eastern time, with almost none in early morning — Layer3 interprets that as a person regularly on the network whose device is running a proxy SDK, while stressing its data shows exits, not the device or person. Synthient separately attributed AS2650 beaconing to Windows 10/11 installs of InfaticaSDK and, with claimed high confidence, to the shared-streaming app Rave.io bundling multiple proxy SDKs. Krebs notes Infatica's founder previously ran King Servers, tied to 2016 election-system compromises. Layer3 warns poorly secured proxy SDKs have enabled local-network probing and lateral movement in past botnets; there is no public confirmation of data theft or internal lateral movement here. As of Krebs's Nov 4 report the White House had not immediately responded; Runtime Wire later reported Layer3's founder said the firm had not notified the White House.

  Executive Office of the President / White House network (AS2650) devices running residential proxy SDKs (Infatica / alleged Rave.io and others)·Since Oct 5, 2026·updated Nov 6, 2026, 11:31 UTC