Researchers from Layer3 Intel identified residential proxy nodes within the White House network, specifically the autonomous system AS2650. Between October 5 and November 3, 2026, the network recorded 236 instances of traffic exiting through these proxy services.
The activity was linked to the Infatica proxy application running on Windows 11 devices. Reports indicate that up to 28 different proxy services may have been selling access to IP addresses associated with the White House network.
Residential proxy services allow users to rent IP addresses to mask their identity or location. Access to these networks can be purchased for as little as $0.60 per gigabyte, enabling third parties to route traffic through trusted government infrastructure.
These proxies often enter secure environments via software installed on employee devices. Developers frequently embed proxy SDKs into free applications to monetize their software, which can lead to unauthorized network exposure in corporate and government settings.
Data from the proxy tracking service Spur shows that such services are present in nearly 300 government networks, 318 utility companies, 166 medical institutions, and 141 financial organizations.
