Overview
- Layer3 Intel says its new Residential Proxy Observatory recorded 236 proxy exits through six IP addresses in AS2650 between October 5 and November 3, and cross-checks show 28 different residential proxy services could route through those addresses.
- About half of the observed connections occurred in the evening hours, which Layer3 interprets as a pattern consistent with a single regularly used device on the White House network rather than open guest Wi‑Fi.
- Proxy trackers first linked the activity to Windows installs of the Infatica SDK but later reported high confidence that the Rave app, which bundles multiple proxy SDKs, is the likely installed software.
- Researchers stress there is no confirmed compromise of White House systems, and Layer3 has preserved raw logs and shared them with a U.S. federal agency while warning that past proxy‑SDK flaws have allowed outsiders to probe local networks or move laterally.
- The incident highlights a systemic risk: app developers can embed proxy SDKs that rent device IPs to low‑KYC resellers, and past exploits show that inexpensive access to trusted IPs can be abused by criminals or state actors.