For just a few dollars, paying customers could route internet traffic through network addresses registered to the White House, according to cybersecurity researchers. Findings from security firms Layer3 Intel and Synthient revealed residential proxy activity originating from the presidential network, though the researchers could not identify the specific machines or show that outsiders had gained access to sensitive internal systems.
A residential proxy allows users to route their traffic through an intermediary IP address, hiding where their requests actually originate. These connections are typically created when apps or browser extensions bundle third-party software development kits (SDKs) that turn a host device into a proxy relay node, often without the owner realizing it. While businesses use residential proxies for benign tasks like ad verification, attackers also use them to evade regional blocks and conceal malicious behavior.
Between October 5 and November 3, Layer3 Intel observed 28 residential proxy networks routing traffic through the White House. The traffic concentrated between 5:00 p.m. and midnight Eastern Time, a schedule that researchers said pointed to an individual working late on a compromised device rather than traffic on an open visitor network. Synthient identified several Windows 10 and Windows 11 machines communicating with proxy providers, noting that bundled SDKs in entertainment software—such as the watch-party app Rave—may be responsible.
Because commercial proxy providers sell access to anyone who signs up, researchers warned that public buyers could send requests directly through government-registered addresses. Among the proxy networks receiving connection signals was Infatica, founded by an entrepreneur previously connected to server infrastructure used in 2016 election-system cyberattacks. The discovery highlights how casual consumer software can introduce security blind spots into strictly monitored networks.