White House IP addresses found in public proxy services | Magica
White House IP addresses surface in public proxy services
Editorial Team
••📖7 min read
Researchers observed public proxy traffic exiting six addresses registered to the Executive Office of the President. The findings expose a possible route for outsiders to borrow government network identities, but do not establish access to internal systems.
Layer3 Intel recorded 236 probe exits through six presidential office IP addresses during a 30-day period.
A second tracking company suspects a shared-streaming app bundled with proxy software; that attribution remains unconfirmed.
The activity reportedly stopped after disclosure, but there is no public explanation of its cause or internal reach.
Public residential proxy services routed traffic through internet addresses registered to the Executive Office of the President, the federal agency hosting the White House network, according to security researchers. Paying outsiders could send requests that appeared to originate from government address space. The researchers have not demonstrated access to internal systems.
Layer3 Intel’s observations of proxy exits on AS2650, October 5–November 3, 2026. These are the company’s enumeration results, not a count of all proxy traffic or malicious requests. Source: Layer3 Intel. Source: Layer3 Intel.
Six addresses available through 28 services
Layer3 Intel, a threat-intelligence firm that tracks residential proxies and other anonymization infrastructure, said in its November 4 research report that its enumeration system exited through the presidential office's network 236 times between October 5 and November 3. The observations covered six IP addresses on 26 of those 30 days. Twenty-eight separate proxy services provided exits through the network.
Residential proxy services sell customers the ability to route requests through other people's devices. The destination website sees the exit device's internet address rather than the customer's. Despite the industry's name, those devices can sit on workplace or government networks as well as home connections.
Whether those requests could also reach private systems depends on the proxy software and network controls.
The 236 observations count Layer3's own enumeration results, not all traffic through the proxies or a count of malicious requests. Layer3 said it encountered the addresses by requesting globally rotating proxy access, rather than targeting the White House. It found the activity while exploring its newly launched Residential Proxy Observatory and checked the addresses against public detection pages from proxy-tracking services Spur and Synthient. Layer3 said those services independently identified the addresses as proxy exits.
N-able says its latest N-central hotfix patches all identified vulnerabilities exploitable without authentication and hosted servers are back online. Further patches, customer-side upgrades and checks for compromise remain necessary after public exploit code prompted a precautionary shutdown.
Editorial Team
The firm's network profile identifies AS2650—the network's autonomous-system identifier—as belonging to the Executive Office of the President. Neither six addresses nor 28 providers establishes a count of affected devices: Layer3 said its data could not determine how many machines were involved.
About half the observed activity fell between 5 p.m. and midnight Eastern time, with almost none in the early morning. Layer3 interpreted that pattern as consistent with a person's device rather than public guest Wi-Fi. But its report explicitly says the data identifies exits, not the device or person behind them. The timing does not establish who installed software or whether the devices belonged to staff.
An app hypothesis and a cheap reseller market
Synthient, a security company specializing in identifying residential proxies, VPNs and bot infrastructure, offered a more specific explanation. Its founder, Ben Brundage, previously demonstrated a residential-proxy vulnerability that criminals were exploiting to take over devices on users' local networks; dozens of services patched their networks in January 2026, according to an account of that work.
Its initial assessment of the White House activity pointed to Windows 11 machines running Infatica's proxy software. A subsequent assessment described Windows 10 and Windows 11 devices communicating with providers including Geonode, Infatica and Mellowtel, according to a report quoting its November 4 and 5 statements.
Synthient said it believed with high confidence that the installed application was Rave.io, which lets people watch streaming video together, and alleged that the app bundles 12 proxy software development kits. That is Synthient's attribution, rather than a publicly confirmed account from the White House or Rave. Neither had responded to requests for comment in the report describing the app assessment.
The business model offers a way for consumer software to create an institutional exposure. App developers can embed proxy SDKs to earn money from installations, while providers sell the resulting connections to customers. Synthient said in the same report that some resellers offered bandwidth for as little as 30 cents per gigabyte or $4 per hour without customer identity checks. Those are reported reseller offers, not a verified price for guaranteed access to a particular White House device.
Infatica is a Singapore-based proxy and web-data provider, according to a report on the findings. Its founder, Vladimir Fomenko, also owns hosting provider King Servers. Six of the eight internet addresses used in attacks on Arizona and Illinois election databases in 2016 were hosted by King Servers, according to reporting on that earlier connection. That hosting history does not establish who used the newly detected proxy exits or connect this incident to a state-directed operation.
Infoblox’s diagram explains proxy routing and DNS-policy enforcement in its customer networks. It does not depict the White House network or establish which controls were present there. Source: Infoblox. Source: Infoblox.
A known weakness, with uncertain reach here
The risk extends beyond disguising the origin of traffic. Layer3 cited previous research showing that poorly secured proxy SDKs can permit access to local networks and movement between systems. It made its warning conditional: an SDK with a similar flaw on this network could let a proxy customer reach internal systems.
Layer3 pointed in its report to Synthient's research on the Kimwolf botnet, which reportedly reached at least 2 million devices through residential proxy networks, mostly Android devices. That precedent concerns a particular route to vulnerable devices; the current findings do not show that the same flaw exists on AS2650.
Government exposure also predates this disclosure. Proxy-tracking firm Spur said in a January 2026 webinar that it found residential proxies in nearly 300 government-owned and operated networks, according to reporting on its findings. That is a count of observed networks, without a denominator establishing how common exposure was across government.
In a June 9 analysis of billions of DNS resolutions and associated network telemetry, network-security provider Infoblox said more than 65% of its Threat Defense Cloud customers had queried domains used to access or orchestrate residential proxy networks in 2026. More than 60% of its government customers had also queried residential-proxy indicators. Those figures measure domain-query activity within a vendor's customer population, not the share of all organizations infected or proof that every querying network hosted an exit node. The analysis does not supply customer counts for those percentages.
Infoblox also cautioned that some proxy use may have a valid business purpose and that its research could not determine how much participation was intentional. It said properly designed proxies block routing to internal addresses, while its own protective DNS service can enforce customers' domain-blocking policies on proxy traffic. Both software design and surrounding network controls matter to the risk; the published White House observations do not establish those configurations.
Logs are available; the cause remains unresolved
Layer3 said it had retained raw logs and would share them with relevant agencies. In a November 5 follow-up account, Layer3 Intel founder Sergiy Usatyuk said the observatory exposed data the company had been collecting for the past year. He said its retained data went back to July 10 and described continuous proxy activity over months. The published 30-day count therefore does not establish when the exposure began.
Usatyuk said the State Department had requested the logs that morning and that the company had supplied them. He also said the latest observed activity occurred on Wednesday night, November 4, hours after the original disclosure, and had since stopped.
That cessation does not identify the cause or establish that remediation is complete. The White House had not answered questions in that follow-up account. Resolving the exposure requires identifying the devices and installed software, establishing what network access they had, and determining whether anyone used the proxy route to reach internal resources. The public observations establish an exit path; those further questions remain open.
Vates has patched an exploited Xen Orchestra login bypass, while its November 10 advisory leaves a separate VM import flaw unfixed. Administrators must also review delegated permissions and investigate possible host compromise.
CISA has listed exploited flaws in Openwave’s webmail document converter and Cisco’s BroadWorks communications platform, setting a November 24 federal remediation deadline. Openwave dates its fix to 2021; a separate research account links Cisco’s flaw to theft of telecom authentication keys.
Maersk confirms data theft from an acquired legacy system and disputes WhiteArmor’s password claims. The group demands $5 million while Maersk says it has found no impact on wider systems and expects no customer disruption.
Binance warns that malicious iPhone apps could use worse_query to read other apps’ files. A file manager built on the public code demonstrates cross-app access, but no cryptocurrency losses have been confirmed and the latest Apple updates have not been linked conclusively to a fix.
Microsoft fixed an actively exploited Outlook flaw that can disclose authentication information when a user opens a malicious file. The moderate-rated bug warrants priority within a November release exceeding 1,000 vulnerabilities, but the attackers and scale of abuse remain undisclosed.
Vanderbilt University allowed students and employees to resume using university devices Tuesday after ordering a shutdown Monday. Key services were available, but wider restrictions persisted and attackers’ claims of extensive data theft remained unconfirmed.
Barracuda says exploitation of recently disclosed vulnerabilities has affected a small number of organizations. Patches are available, and the two-flaw chain can give attackers root access to Email Security Gateway appliances with reachable administrative interfaces.
SAP’s November release addresses four flaws rated 10.0, including ICM2SHELL and PROXYGATE. Customers face unauthenticated routes into core business systems, and Gateway remediation can require configuration changes alongside patches.
Compromised Qubole credentials let an attacker assume customer AWS roles, harvest secrets and download data in October. Dormant integrations extended the exposure, while gaps in storage logs complicated efforts to establish what was stolen.
Google has fixed an actively exploited XML vulnerability in its Chrome desktop browser. The update brings this year’s exploited zero-day tally to eight, while details of the attacks remain undisclosed.
N-able took hosted N-central offline and urged customers running their own servers to do the same after public exploit disclosures. The shutdown interrupts a platform used to manage customer networks, while the scope of the flaws and a safe restoration date remain unresolved.
Trump nominated Palantir security chief Michael LoSapio to lead CISA, where workforce losses and a proposed funding reduction complicate the job as Senate control is set to change.
Iris Plaza says an intrusion into an external cloud service may have exposed data on 5.8 million current and former members and 1.9 million non-members. Its official shopping site remains suspended, while the actual extent of any leak is still under investigation.
France attributes October attacks on roughly 700 retail sites to an Iranian Revolutionary Guard cyber unit. Fires and spoiled food have turned exposed refrigeration controls into a diplomatic and criminal case, while responsibility for later attacks remains unresolved.
Apple says three macOS updates stop bundled command-line tools from accepting compromised eMudhra certificates, extending protections already delivered to Safari and Mail. Apps with their own certificate lists still require separate checks.
Elliptic estimates that responders froze or seized 44% of the $6.43 billion stolen from Binance. Cross-chain services and screening gaps kept other funds moving, but most remaining value was still parked and little had likely been cashed out.
Alpine Linux has patched a password-authentication bypass reachable through OpenSSH on systems using musl without PAM authentication. Under specific account and server settings, attackers can enter key-only accounts; some cloud instances can then give them root access.
Sekoia uncovered mobile data-theft tools delivered through compromised websites, cloned portals and Plerdy's analytics tracker. The analyzed attacks used already-patched flaws, and the report does not establish how many phones were infected.
Ryan James Roach has been extradited to face charges over alleged intrusions targeting US universities with supercomputers. Prosecutors allege credential theft and the diversion of university processing power for cryptocurrency mining; a second defendant remains in Canadian extradition proceedings.
