Just about anyone can rent access to White House IP addresses

Researchers found residential proxy activity operating through the White House network. That means online traffic from outsiders could be routed through IP addresses associated with the presidential network. The discovery matters because residential proxies can conceal a user’s real location and help bypass online defenses.

Layer3 Intel identified 28 residential proxy services routing traffic out of the network from October 5th to November 3rd. Synthient found a number of Windows 10 and Windows 11 devices beaconing to providers including Geonode, Infatica, and Mellowtel. Synthient also suggested the watch party app Rave might be involved because it bundles 12 proxy SDKs.

Layer3 described the proxy as public access. Anyone could reportedly sign up for a residential proxy service, pay a few dollars, and send requests through it. Researchers said the activity usually occurred between 5PM ET and midnight, suggesting a regularly used device rather than ordinary guest Wi-Fi.

A residential proxy is a service that routes internet traffic through a residential IP address. Instead of appearing to connect directly from their own device, a user’s requests appear to come from another person’s network. This can hide the user’s actual source and make the traffic look like ordinary residential activity.

The key mechanism is proxy software, often delivered through an app or browser extension. A third-party software development kit, or SDK, can place a proxy node on a device, sometimes without the user knowing. A proxy service then sells outsiders access to that node, allowing their traffic to pass through the device and its IP address.

The White House findings show why this matters. Researchers found traffic routed through residential proxy services on the network. Layer3 said anyone could obtain access by signing up, paying a few dollars, and sending requests through the public residential proxy.

The activity covered 28 residential proxy services during the period from October 5th to November 3rd. That is the clearest measure of its scale in the reported findings. The services routed traffic out of the White House network, making the network’s IP addresses available as apparent traffic sources.

Synthient found a number of Windows 10 and Windows 11 devices on the network beaconing to known proxy providers. The article does not give an exact number of devices. It names three providers: Geonode, Infatica, and Mellowtel. The findings therefore identify the device types and providers, but not a precise device total.

Layer3 also observed a recurring time pattern. The proxy activity typically occurred between 5PM ET and midnight. Together, the month-long date range, service count, device evidence, and timing helped researchers characterize the activity as more than an isolated network event.

Researchers focused on when the proxy activity occurred. Layer3 Intel said it typically happened between 5PM ET and midnight. A repeated pattern at those hours can point toward a device being used by someone with a regular schedule on the network.

Layer3 therefore suggested the activity came from a person regularly present on the White House network. Its assessment was that the device might be infected with a proxy SDK. An SDK is software that can create a proxy node, allowing a third-party service to route traffic through the device.

The timing did not fit Layer3’s description of a public guest Wi-Fi network as well. Public access could produce varied use throughout the day, while the observed evening window was more consistent with one person’s routine, according to the researchers. The article presents this as a pattern-based inference, not an identified individual.

A residential proxy connected to a sensitive network can turn that network’s IP address into an apparent source for someone else’s traffic. Outsiders do not need to connect directly from their own locations. Their requests can pass through the proxy device, making the activity appear to originate from the network hosting it.

Layer3 warned that the White House residential proxy was public access. Anyone could sign up for a public residential proxy service, pay a few dollars, and send requests through it. This could allow users to conceal where their activity actually came from while using an IP address associated with the presidential network.

The article does not report a specific attack through the White House proxy. It does explain that bad actors can use residential proxies to bypass geolocation controls and defensive filters. Hackers have also used them to create botnets and carry out account takeovers, so the exposure could provide a useful concealment route.

Residential proxies are not automatically malicious. The cybersecurity firm Spur said people can legitimately use them for ad verification and quality assurance testing. Those tasks may require checking how websites or advertisements behave from different residential locations.

The technology works the same way whether the goal is legitimate or harmful. Traffic is sent through a proxy node on someone’s device, so the outside user appears to connect through that device’s residential IP address. Apps and browser extensions can place these nodes through third-party SDKs, sometimes without users knowing.

The risk comes from how that borrowed identity is used. Bad actors can use residential proxies to bypass geolocation controls and defensive filters. The article also notes that hackers have used them to create botnets and conduct account takeovers. On the White House network, researchers found this infrastructure connected to public proxy providers.

An IP address is a numerical identifier assigned to a device or network connection. Internet routing uses these identifiers much like delivery information: one address helps identify the destination, while the apparent source address identifies where traffic came from. The address does not necessarily reveal the person behind the connection.

A residential proxy changes the apparent source. An outsider sends a request to a proxy service, which forwards it through a device connected to another network. The destination sees the proxy device’s residential IP address rather than the outsider’s original address. Replies travel back through the proxy to the requester.

That mechanism explains the White House concern. Researchers found residential proxy services routing traffic out of the network, so outsiders could use associated White House IP addresses. Layer3 warned that public access meant users could pay a few dollars and send requests through the proxy, potentially hiding their true origin.