Layer3 Intel detects 28 residential proxy networks exiting from White House AS2650

Key facts

Discovery timeline and 236-exit observation baseline

On Wednesday 4 November 2026, threat intelligence firm Layer3 Intel published findings from its Residential Proxy Observatory disclosing that commercial residential proxy services were actively routing external internet traffic through AS2650. AS2650 is the autonomous system block registered to the Executive Office of the President (EOP) that hosts the White House network.

Between 5 October and 3 November 2026, an observation window spanning exactly 30 calendar days (derived), Layer3 Intel recorded 236 separate residential proxy exits originating from six distinct IP addresses within the White House network block. The exit activity was active across 26 out of the 30 monitoring days, representing an 86.7% operational persistence rate (derived) and an average velocity of 7.87 exits per day (derived). Most remarkably, Layer3 Intel identified 28 distinct commercial residential proxy providers capable of routing outbound traffic through the government block, meaning any individual with a credit card or cryptocurrency wallet could purchase egress bandwidth masquerading as the Executive Office of the President.

Zoom

Summary of Layer3 Intel 30-day observation window on AS2650

Metric Domain	Observed Value	Operational Standard	Analytical Significance
Observation Window	30 Calendar Days	5 October to 3 November 2026	Continuous global proxy sweep baseline (derived)
Total Recorded Exits	236 Exits	Routine non-targeted automated probes	39.3 average exits per observed IP address (derived)
Active Egress Days	26 of 30 Days	86.7% operational persistence	Persistent workstation connectivity vs transient guest use (derived)
Unique Exit IPs	6 IP Addresses	Classified within AS2650 block	Independently verified by Spur, Synthient, and IPinfo
Commercial Providers	28 Proxy Services	Syndicated proxy marketplaces	Publicly rentable bandwidth without KYC checks

Layer3 Intel stressed that the discovery was made by chance during routine global enumeration rather than targeted surveillance. The team submitted rotating requests across commercial residential proxy services and recorded the resulting egress IP addresses. To confirm the accuracy of the findings, Layer3 Intel verified the six AS2650 IP addresses against independent intelligence repositories, including Spur and Synthient, both of which independently flagged the addresses as active commercial proxy nodes.

Diurnal traffic clustering and endpoint attribution

The diurnal pattern of the egress traffic provided crucial forensic evidence regarding the nature of the host machines. Roughly half of all recorded exits occurred between 17:00 and midnight Eastern Time, a 7-hour evening window (derived). Conversely, proxy activity dropped to near-zero levels between 02:00 and 07:00 Eastern Time. This distribution strongly points to personal computers or laptops used late into the evening by staff members or contractors, rather than open guest Wi-Fi access points.

Zoom

Diurnal distribution and host usage characteristics on AS2650

Time Window (ET)	Activity Level	Telemetry Proportion	Forensic Implication
17:00 to 24:00 (Evening)	Peak Egress	~50% of total exits (derived)	Workstation active during extended evening shifts
00:00 to 02:00 (Late Night)	Moderate Egress	Occasional active relays	Systems left powered on following evening use
02:00 to 07:00 (Early Morning)	Near Zero	<5% of total exits (derived)	Endpoints shut down or in sleep mode
07:00 to 17:00 (Business Hours)	Sporadic Egress	~40% of total exits (derived)	Endpoints active alongside core office network duties

Following Layer3 Intel's disclosure, threat intelligence tracking firm Synthient confirmed that the proxy activity originating from AS2650 was associated with Windows 11 systems running Infatica. Infatica is a commercial proxy network founded by Vladimir Fomenko, a Russian national whose prior web hosting firm, King Servers, was identified by US authorities in 2016 as hosting command-and-control infrastructure used to penetrate state election databases in Illinois and Arizona.

The residential proxy monetization ecosystem

Residential proxy networks function by commercializing everyday consumer and business internet connections. Because corporate firewalls, anti-bot engines, and fraud filters routinely block requests from cloud data centers, threat actors and data scraping operations seek egress through clean residential and enterprise IP blocks. Proxy providers acquire these addresses by distributing software development kits (SDKs) to third-party software developers.

Developers integrate the proxy SDKs into free utilities, mobile games, file converters, or VPN clients. In exchange, the proxy provider pays the developer a recurring fee based on installation counts and forwarded data volume. When an unsuspecting user installs the software, the device silently joins the proxy network, functioning as an unmonitored egress gateway. Bandwidth across these syndicates is sold openly on secondary markets for as little as $0.60 per gigabyte, frequently bypassing Know Your Customer (KYC) identity verification.

Threat model: attribution spoofing and lateral ingress

The presence of active residential proxy exit nodes inside the Executive Office of the President creates severe national security and operational risks across two primary attack vectors.

Zoom

Risk matrix of residential proxy nodes inside government infrastructure

Threat Vector	Technical Mechanism	Exploitation Scenario	Defensive Control
Attribution Spoofing	Target server sees AS2650 source IP	Threat actors launch attacks appearing to come from the White House	Cryptographic egress signing & strict reputation tracking
Reverse Ingress	Bidirectional tunnel to proxy coordinator	Adversaries probe internal government subnets via proxy SDK flaws	Host-level socket auditing & internal subnet segmentation
Supply Chain Bypass	Proxy SDK bundled into consumer utilities	Unvetted personal software installed on official workstations	Strict application whitelisting (WDAC / AppLocker)
Egress Laundering	Outbound port 443 traffic blends into web flows	Unregulated data exfiltration bypassing perimeter firewalls	Authenticated forward proxy with TLS inspection

The foremost danger is attribution spoofing. Any cybercriminal or state-aligned actor purchasing access to the 28 affected proxy services could route credential stuffing attacks, automated vulnerability scans, or espionage probes through AS2650. Victim organizations observing the intrusions would log the source IP as the Executive Office of the President, creating acute geopolitical and reputational friction.

The second critical risk involves lateral network penetration. While marketed as simple egress relays, many proxy SDKs contain architectural vulnerabilities that establish reverse tunnels into the host network. In January 2026, research into the Kimwolf botnet revealed that over two million Android and Linux endpoints were compromised when attackers exploited vulnerabilities in embedded proxy SDKs to scan and pivot into local private subnets. If a proxy client on AS2650 contains similar binding flaws, external proxy buyers could access internal White House networks.

Systemic exposure and enterprise defense requirements

The compromise of AS2650 illustrates a widespread industry vulnerability. According to telemetry published by proxy-tracking platform Spur in 2026, residential proxy nodes have been identified in nearly 300 government-operated networks, 318 utility operators, 166 healthcare systems, and 141 commercial banking networks. Similarly, Infoblox telemetry indicated that 65% of its enterprise customer base actively queries residential proxy infrastructure domains.

To neutralize residential proxy infiltration, federal agencies and enterprise security teams must enforce four foundational controls: First, implement strict endpoint application whitelisting via Windows Defender Application Control (WDAC) or AppLocker to block all unauthorized consumer software. Second, ingest proxy intelligence feeds into secure DNS resolvers to sinkhole all traffic directed toward proxy coordinator domains. Third, conduct host-level socket audits to detect unauthorized reverse-tunnel listeners. Fourth, route all endpoint web traffic through authenticated forward proxies with full TLS inspection, terminating direct outbound connections.