Six White House Addresses, 28 Proxy Services, No Device Named

Public proxy services routed internet traffic through six addresses assigned to the Executive Office of the President, security firm Layer3 Intel says, potentially giving paying customers a White House network identity. ^[2]

The firm recorded 236 proxy exits across 26 days between October 5 and November 3, 2026. It said 28 separate services could supply connections through those addresses, allowing customers' web requests to appear to originate on the executive office's network. ^[2][4]

Residential proxies sell the use of someone else's internet connection. A website receiving a request sees that connection's address rather than the customer's own. Here, the address could carry an unusually sensitive identity: the network serving the US presidency. ^[1][2]

"Anybody can obtain it by signing up to a public residential proxy service, paying a few dollars and sending requests through it," Layer3 wrote in its November 4 findings. ^[2]

The explanation remains unconfirmed. The firms have not established the specific device, user or software responsible, whether a user knowingly shared the connection, or whether anyone reached internal systems.

Layer3 reported no evidence of an internal compromise. The White House did not immediately respond to a request for comment. ^[1][2][3][4]

A connection for hire

The appearance of an ordinary household or workplace connection is the product. A single address can be useful because it lets a customer approach a website from a different apparent location or network. Legitimate customers use residential proxies to check advertising and test whether services work as intended. Others can use them to bypass location restrictions and defensive filters, or support account takeovers and botnets, networks of hijacked devices that an operator can control remotely. ^[1]

The customer need not own the device supplying the connection. Apps and browser extensions can incorporate third-party software that provides proxy functionality. These components, called software development kits, or SDKs, can turn the device running them into an exit point for someone else's traffic. The Verge says some users may not know that an app or extension includes such software.

For network operators, this creates a problem that can begin with an apparently ordinary software installation. An application supplies a feature its user wants, while an embedded component supplies connectivity to a proxy service. The resulting web traffic carries the network's address, whatever the customer's purpose. ^[1][2]

What the measurements show

Layer3 said it encountered the addresses while using its new Residential Proxy Observatory, requesting ordinary connections from public proxy services. It said it had not targeted the White House network. Its November 4 publication describes a discovery made while sampling the commercial proxy market. ^[2]

According to Layer3, the six addresses sit in AS2650, a group of internet addresses registered to the Executive Office of the President. According to Layer3 and Infosecurity Magazine, the network-intelligence firms Spur and Synthient independently classified those addresses as residential-proxy exits. Those classifications support the traffic finding. ^[2][4]

The activity was persistent within the observation period: it appeared on 26 of 30 days. About half occurred between 5 p.m. and midnight Eastern time, with almost none in the early morning. ^[2][4]

Layer3 interpreted that daily pattern as suggesting a regularly used device rather than public guest Wi-Fi. That is an inference from the hours of activity, not a device identification. An evening pattern can guide an investigation, but it does not supply a name. ^[2][4]

The count of 28 proxy services also needs care. It measures the number of services Layer3 said could route traffic through the addresses. It is not a count of affected White House devices or people. ^[2]

Layer3 is promoting a new monitoring product through the research, which gives it a commercial interest in the finding. Its observations are more persuasive because other firms' classifications support them, while its proposed explanation still requires investigation. ^[2][4]

The software trail

Synthient reported Windows 10 and Windows 11 devices on the network sending signals to known proxy providers, including Geonode, Infatica and Mellowtel. That provides investigators with a software trail to examine. ^[1]

According to The Verge, Synthient suggested a possible connection to Rave, an app for watching video together. Separately, Synthient's provider research documents InfaticaSDK in Rave / WeMesh and says the component has appeared on Windows and other operating systems. That documents an app-SDK relationship, rather than establishing Rave as the cause of this activity. ^[1][5]

The security concern extends beyond borrowed internet identity. Layer3 warned that poorly secured proxy SDKs can provide a route into a device's local network. It cited Synthient's research on the Kimwolf botnet, which Layer3 said reached at least two million devices, mostly Android devices with exposed debugging services.

That history explains the potential risk of proxy software, rather than demonstrating the same weakness here. ^[2][4]

Layer3 said it preserved its raw logs and shared its findings with a US federal agency. Founder Sergiy Usatyuk told Infosecurity Magazine that the latest activity it had recorded occurred on the evening of November 4, after the period covered by its main data summary. ^[4]

Those logs give investigators a concrete starting point: six network addresses, the services that supplied them and the times they carried traffic. The next task is to trace those exits back to the device and software supplying the connection. ^[2][4]