SecurityNov 6, 2026, 5:02 AM UTC·2 min read

White House Network Used by Residential Proxies, Researchers Say

Researchers found residential proxy traffic leaving the White House network from six IP addresses, raising security concerns and warnings for smart home owners.

The White House at dusk with glowing network lines symbolizing hijacked internet traffic routed through residential proxies. — Image: CNET

Cybersecurity researchers have detected residential proxy services operating from the White House network, a finding that suggests outsiders could route traffic through official government IP addresses.

The security firm Layer3 Intel found proxy activity on AS2650, a network registered to the Executive Office of the President. Its report shows traffic from six distinct IP addresses exiting the network through at least 28 known residential proxy services between Oct. 5 and Nov. 3, mostly in the evenings between 5 p.m. and midnight EST. Another security firm identified software from Infatica, a proxy company owned by a Russian entrepreneur who ran a server-rental business used by hackers in attacks on election systems in Arizona and Illinois in 2016.

There is no evidence the access was used to attack the White House. Still, experts warn it could give hackers a foothold or an unmonitored back door. Layer3 founder Sergiy Usatyuk said it "gives you all types of potential pathways to exploit." The White House didn't respond to a request for comment.

Researchers at Synthient said several staffers run a Windows 11 machine with InfaticaSDK installed and pointed to Rave, an app for watching streaming services with friends, as the likely source. The pattern suggests an employee connected a personal device carrying a proxy SDK to a Wi-Fi network.

What it means for your smart home

Residential proxies route traffic through consumer devices so activity looks like it comes from a real person. Web scraping is the most common use, but they are also used for malware, identity theft and fake accounts. Developers embed proxy SDKs in free apps, and the terms of service often allow the app to add your IP address to a proxy pool.

A June report from Spur Intelligence found roughly one in three apps on Samsung and LG smart TVs were selling users' IP addresses, while Amazon and Roku ban the practice. Free VPNs carry similar risk, and Synthient found more than 1.3 million MECOOL streaming devices infected with proxy SDKs.

Layer3 and GreyNoise both offer free tools to check whether your IP appears in proxy databases, though they can't identify the responsible device. Experts advise keeping firmware current and installing apps only from trusted stores.

Apps worth a look

SUMO: the number puzzle

Tap the right tiles, add them up, hit the target. Easy to learn, hard to master. Free, for all ages.

Dialo: learn languages by speaking

Talk to an AI conversation partner; every sentence comes back corrected and explained in your language. 9 languages, A1 to C2.

ediviewer: read EDI files like documents

Open EDIFACT and X12 messages, see every segment explained, convert to JSON/XML, export PDF and Excel. Runs locally, no upload.

giftdetect: the right gift in minutes

Pick who it is for, the occasion and their personality. The search engine reads product descriptions from local shops and ranks what fits. Free, no sign-up.

Tags:white houseresidential proxylayer3 intelinfaticasmart homeiot security