Six White House IP Addresses Were for Rent on 28 Proxy Services: Why IP Data Has to Flag the Address and the Hour, Not the Network

On November 4, 2026, the proxy detection firm Layer3 Intel reported that residential proxy traffic had been leaving the internet through AS2650, the network of the Executive Office of the President, for at least a month. Between October 5 and November 3 its measurement probes came out of the White House network 236 times, through six IP addresses, on 26 of the 30 days. Twenty-eight commercial proxy brands were able to sell those exits. Brian Krebs picked up the story the same day.

Nobody has shown that a White House system was compromised, and Layer3 does not claim it. What the data shows is narrower and, for anyone who scores traffic by IP address, more useful: at least one device behind those addresses runs proxy software, so for a few dollars a stranger could send requests that reach your site from an address registered to the White House. A label such as "government" or "business" describes who holds an address block. It says nothing about whose traffic one address is carrying at 9 p.m. tonight. Below: what was measured, how an office NAT address ends up for rent, what IP data returns for it, and which rules still work.

What Layer3 measured, and what it left open

Layer3 runs what it calls a Residential Proxy Observatory: it subscribes to proxy services as a customer, asks for rotating exits anywhere in the world, and records which address each request comes out of. The company says it never aimed at the White House: "We caught this by chance, simply by requesting global rotating access through these services."

An exit is an address, and the post says so plainly: "Our data shows the exits, not the device or the person behind them." Layer3's public page for AS2650 places all six in 165.119.253.0/24, one of five prefixes the AS announces (65,792 addresses, all IPv4). The addresses themselves are withheld; founder Sergiy Usatyuk said they were too sensitive to publish, CyberInsider reported. Nor had the activity stopped. Usatyuk told Infosecurity Magazine that the latest exit was recorded on the evening of November 4, and by November 5 the rolling 30-day count on Layer3's page stood at 239.

The device side comes from a second firm. Synthient posted that the activity it saw from AS2650 traces to several Windows 11 machines running the Infatica SDK, a proxy component that app developers bundle into free software for a payment per install. The post does not say how Synthient identified the software, so nobody else can reproduce the claim yet.

Six addresses do not mean six devices, or six people. Office networks reach the internet through a small pool of NAT addresses, and one machine can show up behind several of them over a month. Layer3's own chart never has more than three of the six active on the same day.

How one machine turns an office NAT address into inventory

A proxy SDK needs no open port and no misconfigured firewall. When the host app starts, the SDK opens an outbound TLS connection to the proxy operator's gateway and keeps it open. To the office firewall this is a workstation making an HTTPS connection, which is what workstations do all day.

From then on the connection is used in reverse. A customer of the proxy service sends a request to the gateway, the gateway pushes it down the tunnel, and the SDK makes the request from the machine it runs on. On the way out, the office NAT rewrites the source to one of its public addresses. The target site sees a TCP connection from 165.119.253.x and cannot tell it from a staffer loading the same page.

Twenty-eight brands does not mean twenty-eight programs on one machine. Free apps often bundle several SDKs (Cybernews reports that Synthient suspects a shared-streaming app that ships with 12), and exit supply is resold between providers, so the storefront rarely matches the SDK. Infatica itself is not among the 28 names on Layer3's AS2650 page, which lists brands such as 9Proxy, Geonode, NodeMaven, ProxyEmpire and Thordata. We described the same structure when NetNut was seized in July. Synthient founder Ben Brundage told Krebs that some resellers sell bandwidth "for as low as 60 cents a Gigabyte" and let buyers skip identity checks.

There is a worse failure mode. In January 2026 Synthient documented how the Kimwolf botnet went through residential proxy networks to reach devices on the exits' own local networks, infecting more than two million of them. Layer3 raises the same possibility for AS2650. There is no evidence that anyone tried.

An evening pattern that looks like one regular device

About half of the exits fell between 5 p.m. and midnight Eastern, and almost none in the early morning, which Layer3 reads as "a person rather than a public guest Wi-Fi network: someone regularly on the White House network late into the evening." It has not published hourly counts, so nobody else can check the shape of that curve.

The daily chart backs the reading from another direction. A guest network fills with visitors during business hours and its population changes every day. These exits showed up on 26 of 30 days, including all four Sundays in the window: October 11, 18 and 25, and November 1, when three of the six addresses were seen. Whether the daily buckets are in UTC or in Eastern time, a Sunday bucket falls inside the weekend in Washington. That is a machine with a routine.

To be fair, the inference has limits. Nobody outside the EOP knows which internal segment sits behind those six addresses, and the White House complex is staffed around the clock, so "evening" does not single anyone out.

What IP data returns for an AS2650 address

Here is our record for an address in the /24 where Layer3 saw the exits, trimmed to the fields a fraud rule would read:

{
  "company": {
    "domain": "whitehouse.gov",
    "name":   "Executive Office Of The President",
    "type":   "government"
  },
  "connection": {
    "asn":          2650,
    "domain":       "eop.gov",
    "organization": "Executive Office Of The President",
    "route":        "165.119.253.0/24",
    "type":         "government"
  },
  "ip": "165.119.253.1",
  "location": {
    "city":    "Washington",
    "country": { "code": "US" },
    "region":  { "code": "US-DC", "name": "District of Columbia" }
  },
  "security": {
    "is_proxy":             false,
    "is_relay":             false,
    "is_residential_proxy": false,
    "is_tor":               false,
    "is_vpn":               false
  }
}

The network fields are all correct. The space is registered to the Executive Office of the President at ARIN, the AS number dates from May 24, 1993, the routes reach the internet through two Zayo networks, AS6461 and AS46887 (the former Crown Castle Fiber), and the addresses geolocate to Washington, D.C. (Layer3's page types the same network "Business" where ours says government.)

None of those fields describes what the address is doing this evening. That is the job of one boolean, security.is_residential_proxy, and it belongs to a single address at a point in time. We ran all 256 addresses of 165.119.253.0/24 through our API on the morning of November 5: every one came back as government, and none had the flag set. Layer3 has not published its six, so we cannot say which of them we should have caught, or when. Proxy flags, ours included, come from observing exits through real subscriptions to these services plus inference, which makes each one a dated sighting. On an office NAT address, a sighting goes stale within hours.

The name does not help. "Residential" describes how the exit is sourced, on somebody's own device, and people carry those devices to work. A rule that reads connection.type and waves through anything typed government, business or education treats the label on the block as a verdict on every address in it. Many proxy services let customers pick exits by country, city and ASN, so a list of trusted network types doubles as a shopping list for whoever wants to get past it.

Proxy exits are already inside agencies, hospitals and banks

AS2650 is the best-known name on a long list. In a January 2026 webinar cited by Krebs, Spur said it had found residential proxies in nearly 300 government-owned networks, 318 utilities, 166 healthcare companies or hospitals, and 141 banking and finance companies. Infoblox, looking at DNS queries instead of exits, reported on June 9 that over 65% of its Threat Defense Cloud customers had queried domains used to run residential proxy networks in 2026, including more than 60% of its government and banking customers.

The cause is usually mundane: a free app on a personal laptop or phone that joins the office network. (If you run a corporate network, look up your own NAT addresses on the public IP pages that Layer3, Spur and Synthient offer, and search your DNS logs for proxy SDK domains.)

Rules that survive a proxy exit on a trusted network

Read the per-address flag on every network type. Connection type is good context for a score and a bad reason to skip the proxy check.

Do not block on the flag, though. Each of those six addresses is also the way out for real EOP staff, and nobody has reported the other 65,786 addresses in the AS relaying anything. Blocking the /24 or the whole AS punishes the wrong people. A step-up fits better: a second factor on login, or a hold on a payout. A legitimate user behind the NAT passes it once. A rented exit usually cannot.

Treat the answer as perishable. Look the address up at the moment of the sensitive action instead of reusing a verdict stored at account creation, and expire anything you cache within hours. The laptop goes home, the app gets uninstalled, and the address goes back to being exactly what its ASN says it is.

Ipregistry returns both layers in one response: the connection type, company and ASN of the network, and separate per-address flags for proxies, residential proxies, VPNs, Tor and relays, so a rule can read the label and the behavior side by side. You can run your own traffic, or your own office addresses, through it with 20,000 free lookups to get started.