---
title: Researchers found residential proxy services selling exits through the White House network (AS2650); 28 proxy services, 236 exits in a month | ctxsec
url: https://ctxsec.com/items/krebs-white-house-as2650-residential-proxy-exit-nodes-infatica
description: "KrebsOnSecurity reports that Layer3 Intel saw residential proxy nodes beaconing from the Executive Office of the President's network (AS2650) between Oct 5 and Nov 3: six IP addresses, on 26 of 30 days, mostly 5 p.m. to midnight, reachable through 28 separate proxy services. Synthient tied the activity it saw to several Windows 11 installs of Infatica, a proxy SDK often bundled in 'free' apps, whose founder's earlier hosting firm was used in the 2016 attacks on Arizona and Illinois election systems. Layer3 says anyone could buy this access for a few dollars and that it found the exits by chance."
status: "reported (KrebsOnSecurity, Nov 4, quoting Layer3 Intel and Synthient research); the White House had not commented"
published: 2026-11-04
---

> KrebsOnSecurity reports that Layer3 Intel saw residential proxy nodes beaconing from the Executive Office of the President's network (AS2650) between Oct 5 and Nov 3: six IP addresses, on 26 of 30 days, mostly 5 p.m. to midnight, reachable through 28 separate proxy services. Synthient tied the activity it saw to several Windows 11 installs of Infatica, a proxy SDK often bundled in 'free' apps, whose founder's earlier hosting firm was used in the 2016 attacks on Arizona and Illinois election systems. Layer3 says anyone could buy this access for a few dollars and that it found the exits by chance.

[← Cybersecurity News](/news) · [markdown](/items/krebs-white-house-as2650-residential-proxy-exit-nodes-infatica.md)

reported (KrebsOnSecurity, Nov 4, quoting Layer3 Intel and Synthient research); the White House had not commented

2026-11-04

### Researchers found residential proxy services selling exits through the White House network (AS2650); 28 proxy services, 236 exits in a month

Proxy SDKs ride in on personal devices and free apps, and they let strangers send traffic from inside your network. To check your own:

- Look in DNS and proxy logs for residential-proxy SDK domains (Spur, Synthient and Infoblox publish lists), and in EDR for known SDKs bundled with free VPNs, games and 'earn money' apps.
- Check whether your egress IPs show up in residential proxy datasets.
- Keep personal and BYOD devices on a separate network from managed endpoints and sensitive services.

Sources: [KrebsOnSecurity: Want to Rent an Internet Address at the White House? (Nov 4)](https://krebsonsecurity.com/2026/11/want-to-rent-an-internet-address-at-the-white-house/)