Residential Proxy Activity Detected in White House Network

Activity in AS2650

Layer3 Intel, a security company, reports that it observed residential proxy service activity inside Autonomous System 2650, the network range allocated to the White House. The observation window ran from Oct. 5 to Nov. 3. During that one-month period, the company logged 236 residential proxy connections, which averages about eight connections per day. Residential proxy services rent out users’ network addresses to other parties, allowing outside traffic to appear as though it originates from the rented IP address.

The report says that proxy exit-node traffic from the White House network appeared on 26 of the 30 days. Six IP addresses within AS2650 were involved. Most of the activity occurred in the evening, between 5 p.m. and midnight. The 30-day window therefore contains four days without observed White House proxy exit-node traffic. Layer3 Intel did not state whether all 236 connections came from the same device, whether they were successful, or which destinations were contacted. The company also did not say whether the six IP addresses belong to servers, workstations, or other device types. The evening concentration differs from a typical daytime office pattern, but the report offers no explanation.

Probable Source: Infatica on Windows 11

Layer3 Intel links the traffic to Infatica, a Russian residential proxy application believed to have been installed on a Windows 11 device. Infatica functions as a client that enrolls a device into a residential proxy network, letting other users route their traffic through that device. The report does not explain how the software reached the device, whether the device was directly connected to the White House network, or whether the installation was authorized. It also does not name the specific device owner, department, or user account. Infatica is described as a proxy client, not as malware in the report. The wording leaves open whether the Windows 11 device was the source of the client installation or whether the client was remotely deployed. The report does not include the device’s IP address or hostname.

Limits of the Observation

The presence of residential proxy exit-node traffic in AS2650 means that external requests may have borrowed White House IP addresses to initiate connections. This can make traffic look like it came from the U.S. government network. However, proxy traffic alone does not confirm that any White House system was compromised or that data was accessed. The observation data does not reveal whether the proxy connections were inbound, outbound, or both. Layer3 Intel’s report describes exit-node traffic, which usually means traffic leaving the proxy network from the White House IP address.

Layer3 Intel has not published connection logs, targets, payloads, or details about the affected device beyond the operating system and proxy client. The company did not provide a risk rating, indicators of compromise beyond the IP activity, or remediation advice. The report does not indicate who used the White House IP addresses, what they accessed, or whether the connections were part of an automated proxy rotation. The six IP addresses have not been linked to any specific system or user by Layer3 Intel.

What Remains Unclear

The observation points to possible unauthorized proxy software on a device associated with the White House network, or to a user-installed application. Without packet captures, process lists, or device forensics, the cause cannot be determined from the reported data. The absence of those details limits what can be concluded about the security impact. Layer3 Intel has not said whether it notified the relevant authorities. The report stops at describing what its monitoring saw, leaving several technical and operational questions open.