Residential proxies in the White House. And, in all likelihood, in your network too.

Between 5 October and 3 November 2026, Layer3 Intel watched 28 different residential proxy services route traffic through six addresses in the network of the Executive Office of the President (AS2650). On 26 of 30 days, 236 times in total. The team did not go looking for those addresses; it found them while browsing its own Residential Proxy Observatory, launched that same week, simply by ordering globally rotating access from public proxy services. Two other proxy-telemetry companies, Spur and Synthient, independently list the same addresses as proxy exits. Synthient was also able to name the software responsible: the Infatica client, on several Windows 11 installations inside the White House network.

Layer3 stresses that its data shows the exits, not the device and not the person behind them. No breach has been established. You can still read this as a spy story. That is the less interesting reading. The more interesting one: if this runs for four weeks in one of the most closely watched networks in the world without anyone inside noticing, the question for you is not whether something like it is happening in your network. It is whether you would see it.

What a residential proxy is – and who pays for it.

A residential proxy is a service that routes internet traffic through the connections of real households or businesses. To the receiving end, the traffic appears to come from a home connection in Düsseldorf or an office in Hamburg. That is precisely the product: addresses that do not look like a data centre.

Those connections are not volunteered. They are recruited by software. Proxy providers pay app developers a small amount per install for embedding an SDK in their application – weather apps, video downloaders, screensavers, browser extensions, “free” VPN clients. The user agrees to rent out their bandwidth somewhere in a EULA nobody reads, and their device becomes an exit node for traffic someone else is paying for. The same model is found in smart TVs, set-top boxes and other IoT devices, including those from reputable manufacturers.

The customers of such services range from price-comparison crawlers and ad verification, through mass content scraping for AI training, to account takeover, fraud and geoblocking evasion. Entry is cheap: Synthient founder Ben Brundage told Krebs that resellers offer bandwidth from 60 cents per gigabyte, with no identity checks at all. On the SDK in question, Brian Krebs did some digging: Infatica’s founder, Vladimir Fomenko, also runs the hosting company King Servers, whose addresses – six of eight – carried the 2016 Russian attacks on voter databases in Arizona and Illinois. That is not proof of intent in the current case. It is an indication of the milieu this market operates in.

Why endpoint protection stays silent.

From an EDR agent’s point of view, nothing happened. No vulnerability was exploited, no signature fired, no process misbehaved. A signed application is doing what the user permitted: opening outbound connections and relaying data. Johannes Ullrich of the SANS Internet Storm Center puts it plainly – endpoint protection will often fail here, so watch the network.

Then there is the question of whose device it is. Layer3 analysed the timing: about half of the activity falls between 5 p.m. and midnight Eastern time, and almost none in the early morning. That does not point to public guest Wi-Fi but to a person who regularly works in the White House network late into the evening – on a device running a proxy SDK. Krebs adds that such proxies typically beacon from employee devices brought into the workplace. A personal Windows 11 laptop with a streaming tool that joins the office Wi-Fi in the morning has no agent, no policy and no inventory record. Zack Whittaker rightly notes that environments where many outside devices share the same Wi-Fi are particularly hard to defend. If you rely on endpoint telemetry alone, you have none for exactly those devices.

What this means for your organisation.

First, on prevalence, so nobody mistakes this for a Washington peculiarity. In early 2026 Spur found residential proxies in nearly 300 government networks, plus 318 utility companies, 166 hospitals and healthcare organisations, and 141 banks and financial institutions. Infoblox reported that 65 percent of its own customer base resolves domains belonging to proxy providers. Utilities, hospitals, banks: that is exactly the list of entities NIS2 classifies as essential or important.

Three consequences follow that go beyond “someone else’s traffic on our line”:

Your IP address becomes an instrument. If credential stuffing against online banks, ticket fraud or scraping runs through your connection, your address ends up on blocklists, in fraud reports and, eventually, in a law-enforcement request. The explanation that you knew nothing about it is true – and still uncomfortable.

You are operating a tunnel you do not control. A proxy SDK is a permanently open, encrypted outbound connection to infrastructure whose operator you do not know and whose traffic you cannot see. Technically it is indistinguishable from a command-and-control channel. And the direction can be reversed: in late 2025, criminals mass-exploited a vulnerability in such proxy services to probe the local network behind each exit node for vulnerable systems. Synthient documented how the Kimwolf botnet reached at least two million devices this way, mostly Android devices with an exposed ADB service; in January 2026, dozens of proxy providers had to patch. Layer3 draws the obvious conclusion: if the SDK in the White House has a comparable flaw, any paying proxy customer can reach internal systems. That ad crawlers run through the tunnel today says nothing about what runs through it tomorrow.

The reverse applies to you as well. The same market supplies attackers with German residential addresses for logging into your Microsoft 365. A sign-in rule that treats “login from Germany” as a trust signal is worthless against this infrastructure. Anyone using geolocation as a security control should know it can be bypassed for 60 cents per gigabyte.

For organisations under NIS2 this is not a side issue. Asset inventory, network security, supply-chain control and the ability to detect incidents are listed as measures in Article 21. A proxy SDK on a machine in the corporate network is a supply-chain problem that manifests as a network problem and starts with a missing inventory.

What you need to see – and how.

Detection happens in three places: on the endpoint (what is installed), at the network edge (what leaves) and from the outside (how your addresses look to everyone else). None of the three is sufficient on its own – and for devices people bring in, only the last two are available.

By its own account, Layer3 found the White House addresses by chance, through an observatory that had existed for a few days. Nobody inside the network had raised an alarm. That is the actual finding: the outside view saw what the inside view did not.

Four actions for this week.

1. Check your egress addresses. Compare every public IP your organisation uses to reach the internet against proxy and reputation databases. Layer3 offers a public check tool for this; Spur and Synthient provide context pages per address. Takes an hour, costs nothing, answers the most important question immediately.
2. Inventory against the approved list. Pull the software inventory of all managed endpoints and run it against the list of approved applications. Anything not on it is either approved or removed. Application control closes the gap permanently.
3. Outbound into the SIEM. Firewall logs, NetFlow and DNS are the data sources that actually make proxy SDKs visible – including on devices without an agent. If they are not yet analysed centrally, that is the single highest-leverage change.
4. Separate devices people bring in. Own segment for guest and BYOD, own egress address, no path into the corporate network. Then an employee’s personal laptop can neither damage your reputation nor serve as a stepping stone.

The residential proxy market is known, documented and monetised. That it turns up in a government network is only surprising because someone looked. Assume it is present in your network as well. Then the only remaining question is whether you can see it.