- Published on
Want to Rent an Internet Address at the White House?
- Authors
- Name
- DeepHorus
Security experts warned that White House staffers are using devices equipped with residential proxy services that make their internet addresses available for rent. Layer3 Intel detected multiple proxy nodes beaconing from the Executive Office of the President network (AS2650). Activity persisted between October 5 and November 3, with proxies exiting the White House network 236 times.
Residential proxies let customers rent someone else's internet address to anonymize traffic or spoof location. One service involved is Infatica, often bundled into free apps. Its founder, Vladimir Fomenko, is a Russian whose hosting firm housed six of eight IP addresses used in 2016 election system breaches in Arizona and Illinois.
Layer3 Intel said the White House exit nodes came from six internet addresses on 26 of 30 days, mostly between 5 p.m. and midnight. Synthient linked the activity to multiple Windows 11 installations of Infatica. Twenty-eight separate residential proxy services could exit through this network.
Layer3 Intel called it "public access," noting anybody can obtain it by signing up to a public residential proxy service, paying a few dollars and sending requests through it. The White House did not immediately respond to a request for comment. Residential proxies are a major source of malicious traffic.
They also introduce serious security risks. In late 2025, cybercriminals mass exploited a vulnerability in these services to probe local networks for vulnerable systems. In January 2026, dozens of proxy services patched their networks after Synthient founder Ben Brundage showed how criminals abused a vulnerability to seize control of devices.
Brundage told KrebsOnSecurity that resellers sell bandwidth for as low as 60 cents per gigabyte, so for less than a dollar one can access confidential networks and skip Know Your Customer processes. All too often, these proxy services beacon from employee devices, as app developers embed proxy network SDKs, underscoring the need for stricter workplace device controls.
