White House IP Addresses Are Being Rented Out Through Residential Proxies
Residential proxy traffic has been exiting the White House network, according to security firms Layer3 Intel and Synthient, allowing outside users to appear as if their connections originate from the president's office.
A residential proxy service routes a customer's traffic through IP addresses assigned to ordinary home broadband connections rather than datacenter ranges. An IP address is the numeric label that identifies where a connection comes from. Because the traffic arrives from addresses that look like home internet, it is harder to block. Layer3 Intel found the White House network while probing services that sell access to everyday devices for rerouting traffic. The network is identified as AS2650, an autonomous system number, the identifier for a network that manages its own routing.
Layer3's Residential Proxy Observatory recorded residential proxy traffic exiting the White House network 236 times in 30 days. Layer3 Intel also found that 28 residential proxy services routed traffic out of the network between October 5 and November 3. The activity typically occurs between 5PM ET and midnight, according to Layer3.
Layer3 assessed that the pattern suggests a person regularly on the White House network late into the evening, whose device is infected with a proxy SDK (a software development kit, the bundle of code an app uses for a specific function), rather than a public guest Wi-Fi network. Synthient reported that Windows 10 and Windows 11 devices on the network were beaconing, or sending periodic check-in signals, to proxy providers Geonode, Infatica and Mellowtel. Synthient linked the possible SDK to Rave, a watch party app, stating that the app bundles 12 proxy SDKs. Synthient research cited by Layer3 found that the Kimwolf botnet, a network of compromised devices under remote control, reached at least two million devices.
Layer3 warned that the White House residential proxy is public access. Anyone can sign up to a public residential proxy service, pay a few dollars and send requests through it. Krebs on Security reported in an article titled "Want to Rent an Internet Address at the White House?" that reputation-based allowlists treat a White House address as inherently trustworthy. BankInfoSecurity described the same network as one whose devices are being used as proxies for outside users.
Researchers said no breach or compromise of the White House network was confirmed in connection with the residential-proxy traffic. The Register covered the findings on November 5, 2026.
The reporting so far places the source of the traffic on consumer endpoints inside the network, not on the network's core infrastructure.
In my view, the technical question is less about the White House than about the trust model. Allowlists, geofenced access rules and reputation scoring all rely on the assumption that a government IP address reflects an authorized, managed endpoint. When that address can be rented by the request, the signal loses value for everyone who depends on it, not only for the network's operator. The same mechanism that lets a consumer app monetize spare bandwidth also lets a third party borrow a trusted origin. That source distinction also matters for remediation. Clearing an SDK from a laptop, or auditing the bundled libraries of a watch party app, closes the exit path directly. Hardening reputation systems that grant implicit trust to a known address addresses why the exit path is valuable in the first place. Both sets of work are routine for security teams, and both are now visible in a single, very public case.
