Threat intel

Between October 5 and November 3, 2026, anyone who paid a residential proxy service could have had their traffic leave the internet from a White House address. Layer3 Intel saw six IP addresses on AS2650, the autonomous system registered to the Executive Office of the President, used as exits by 28 different proxy services. Its pipeline exited through them 236 times, on 26 of those 30 days. A second firm, Synthient, traced the traffic to Windows 11 machines running a proxy software development kit (SDK) from Infatica.

Nobody has shown that a government system was compromised, and the White House did not respond to requests for comment from GovInfoSecurity or Krebs on Security. The finding still matters to every organisation with a corporate network: if one laptop runs an app with a bundled proxy SDK, strangers can rent your public IP address, and your firewall logs will show the traffic as yours.

How a proxy SDK turns a laptop into an exit

A residential proxy service sells access to IP addresses that belong to homes and offices rather than data centres. Websites trust those addresses more, so they are used for scraping, ad fraud, account creation and credential stuffing. The providers get the addresses by paying app developers to embed an SDK. Infatica, which has registered entities in Singapore and the UK, advertises more than 45 million proxies and lists an "Infatica SDK" under its monetisation resources.

Once the app runs, the SDK opens an outbound connection to the provider's servers and waits. When a customer buys a request, the provider hands it to the SDK, which fetches the target page from the device and passes the response back. To the website, the visitor is the device's network. On an office network behind NAT (network address translation), that means the company's shared egress IP.

Because the SDK starts the connection from inside, no inbound firewall rule is broken. The firewall sees a workstation making ordinary HTTPS calls. The bigger risk sits behind that: Synthient's earlier research on the Kimwolf botnet showed poorly built proxy SDKs could reach private addresses on the device's local network, and Kimwolf used that route to reach at least 2 million devices, mostly Android boxes with the Android Debug Bridge (ADB) exposed. Layer3 warned that a similarly flawed SDK on the White House network would let any proxy buyer reach internal systems. It did not claim that is happening here.

What the researchers found

Layer3 says it did not target the network. Staff saw AS2650 appear in its Residential Proxy Observatory while requesting global rotating exits, then checked the addresses against Spur and Synthient, which also flagged them as residential proxy exits. Ipregistry's analysis of the published data adds that all six addresses sit in one /24 and no more than three were active on any day.

About half of the exits fell between 5 p.m. and midnight Eastern, with almost none in the early morning. Layer3 labels its reading of this as inference: the pattern fits one person who regularly uses the network in the evening, with a proxy SDK on their device, rather than public guest Wi-Fi. Its data shows the exits, not the device or the user.

Synthient said on November 4 that several Windows 11 machines on the network ran the InfaticaSDK. It later said, with what it called high confidence, that the app carrying it is Rave, a watch-together streaming app that bundles 12 proxy SDKs. Synthient has not published how it identified the software, so treat the app attribution as unconfirmed.

The same observatory found exits in places with almost no internet users: 413 addresses and more than 32,000 observations in Saint Helena, Ascension and Tristan da Cunha, split between Starlink and the local provider Sure, plus three exits from a Cloudflare WARP address tied to McMurdo Station in Antarctica.

What to do

Check whether your own IPs are for sale. List every public egress address (firewall NAT pools, cloud NAT gateways, branch offices). Look each one up in a residential proxy feed such as Spur or Ipregistry. In Ipregistry, the security.is_residential_proxy and security.is_proxy fields carry the verdict. A positive result means a device behind that address is relaying traffic now.

Find the device. The SDK keeps a long-lived outbound session to its provider and makes connections to many unrelated sites that the user never visited. On Windows endpoints with Sysmon, Event ID 3 (network connection) and Event ID 22 (DNS query) show which process made them. In Microsoft Defender for Endpoint, a starting query is:

DeviceNetworkEvents
| where Timestamp > ago(7d) and RemoteIPType == "Public"
| summarize Dests = dcount(RemoteUrl), Conns = count() by DeviceName, InitiatingProcessFileName, InitiatingProcessFolderPath
| where Dests > 500
| order by Dests desc

Browsers will top this list. Look past them for a user-installed app in AppData making hundreds of distinct connections, especially outside working hours. Search DNS logs for the domains of known proxy SDKs; proxy intelligence vendors publish these lists.

Inventory apps that embed monetisation SDKs. Run winget list or Get-AppxPackage across the fleet, or pull the software inventory from Intune or your EDR, and look for free utilities, streaming and "watch together" apps, VPNs and games that the business did not approve. Uninstall the app rather than killing the process, since the SDK starts again with it. Then block standard users from installing software with application control (WDAC or AppLocker) so it does not come back.

Filter egress. Workstation subnets should not reach the internet directly. Force web traffic through a proxy or secure web gateway that blocks the "proxy/anonymiser" category, and deny other outbound ports from user VLANs by default. Separate guest and personal devices from the corporate network on their own egress IP, so a staff phone with a proxy app does not borrow the company's reputation.

Use the same feeds on inbound traffic too. Residential proxies are how attackers make login attempts look like customers. Do not block on the flag alone, since real users share these addresses. Use it to step up a check, such as a second factor or a hold on a payout, as Ipregistry recommends.

Why your IP reputation is an asset

Traffic from a rented exit is indistinguishable from your own staff. Credential stuffing, scraping or fraud sent through it will be logged against your IP, which can land it on block lists, trigger CAPTCHAs for every employee and draw abuse reports to your ISP. For a government or regulated network, outsiders appearing to come from inside is also a gift to anyone trying to pass an allow list. We covered other routes into proxy networks in our posts on the Midnight Mimosa firmware proxy and the XCPE Android TV botnet.

Finding proxy SDKs and unapproved software on endpoints is part of our security operations work, and egress filtering and application control are part of safeguarding and hardening. If you want your egress addresses checked, open the chat and Yaali, our AI agent, will pass the question to an engineer.

---

Sources: SecurityWeek, Help Net Security, Security Affairs, GovInfoSecurity, Ipregistry, Infatica.