Security company Layer3 Intel: White House network AS2650 was observed as a residential proxy exit 236 times
Security company Layer3 Intel said in a report released on November 4, 2026, that its Residential Proxy Observatory observed its proxy enumeration pipeline exiting via the AS2650 network 236 times between October 5 and November 3, 2026. AS2650 is registered to the Executive Office of the President and is the autonomous system where the White House network is located.
These 236 exits came from 6 IP addresses, covered 26 of the 30 days, and involved 28 different residential proxy service providers. Layer3 Intel said it was not targeting the network, but discovered it by chance while purchasing ordinary “global rotating” residential proxy services; the company also cross-checked the relevant addresses with third-party detection services such as Spur and Synthient, which also flagged them as residential proxy exits.
The company pointed out that the activity was mainly concentrated between 5 p.m. and midnight Eastern Time, with almost none in the early morning hours. The pattern looks more like someone frequently using the White House network in the evening, with a device installed with a proxy SDK, rather than public visitor Wi-Fi. Layer3 Intel made clear that the data only shows exits and does not identify specific devices or individuals; anyone can pay a few dollars to register for public residential proxy services and send requests through these nodes.
Synthient said it observed multiple Windows devices beaconing to proxy providers such as Infatica. Infatica’s founder is Vladimir Fomenko, whose King Servers was previously linked to servers used in attacks targeting election systems in Arizona and Illinois in 2016. As of the publication of the relevant reports, the White House had not immediately responded to requests for comment.
Original source:
Title: Want to Rent an Internet Address at the White House? Publisher: Brian Krebs / Krebs on Security Publication date: 2026-11-04 URL: https://krebsonsecurity.com/2026/11/want-to-rent-an-internet-address-at-the-white-house/ Nature of source: media report Verification status: Read the full text for this report (including direct quotations from the original Layer3 Intel report and descriptions related to Synthient) Supporting content: Supports the core facts of 236 exits, 6 addresses, 26/30 days, 28 providers, the time pattern, public rental availability, and the Infatica/Vladimir Fomenko connection; does not prove the identity of specific devices or an actual internal intrusion
ABAB AI Insight
Vladimir Fomenko came into public view in 2016 when some of King Servers’ IP addresses were used for probing against U.S. state election systems. At the time, ThreatConnect and FBI-related notices linked his servers to activity in Arizona and Illinois, and Fomenko himself told NBC and The New York Times that he was unaware, saying that customers rented anonymously. Ten years later, Infatica, under his name, embeds SDKs in free apps and turns users’ devices into rentable residential proxy exit nodes. The team led by Layer3 Intel founder Sergiy Usatyuk built its observatory by actively purchasing rotating proxy services and recording exit IPs, rather than by passive monitoring.
The residential proxy business model is usually this: proxy companies provide SDKs to app developers, who embed them in free software such as video-streaming or utility apps in exchange for installation revenue shares; after users install the apps, their bandwidth is rented out to third parties. Customers pay a few dollars to have their traffic exit from the real residential or corporate IPs of infected devices. The 28 service providers observed this time could all exit from AS2650, indicating that multiple SDKs may have been installed on the same device or a small number of devices, or that the same device was accessed by multiple resellers. The cash flow is: end users pay proxy service providers → providers share revenue with SDK providers/app developers → device owners usually receive little or no direct compensation.
Compared with the 2016 King Servers incident, the similarity is that infrastructure associated with Fomenko again appeared in anomalous traffic related to U.S. government networks; the difference is that in 2016 servers were rented as attack launchpads, while this time end devices were turned into exit nodes by SDKs, and the discovery was made proactively by a security company rather than through law-enforcement notification. Spur previously mentioned in an early-2026 webinar that residential proxy nodes also existed in nearly 300 government networks and more than 100 utilities and financial institutions, indicating that this is not an isolated phenomenon.
For the White House network, this means outside parties can obtain, at relatively low cost, exit IPs that appear to come from EOP address space, to bypass trust mechanisms based on geography or ASN (for example, permissive policies used by some services toward U.S. government networks). If a proxy SDK has vulnerabilities, attackers may also be able to probe the device’s internal network in reverse from the exit node. The current observation only proves that exit traffic exists; it does not confirm the specific application, and no evidence of data exfiltration or lateral movement has been found. The key indicators to watch are whether these addresses continue to appear in public proxy pools and whether there is any official confirmation of device cleanup.
ABAB News · Cognitive Law
Publicly rentable residential proxies can turn exit IPs from highly sensitive networks into a commodity worth a few dollars.
SDKs in free apps turn employees’ personal devices into enterprise network exits that can be resold.
Enumerating proxy exits can identify nodes, but it cannot automatically prove who installed the software or whether the internal network was accessed.