Overview
- Security firm Layer3 Intel recorded 236 residential proxy exits through six IP addresses in the White House AS2650 block during the October 5–November 3 observation window.
- Layer3 and two independent trackers cross-checked the addresses and found that 28 different residential proxy services could route traffic through those White House addresses.
- About half of the observed connections happened between 5 p.m. and midnight Eastern Time, a pattern researchers say suggests a single regularly used device rather than an open guest network.
- Some of the activity was linked to the proxy service Infatica and to Windows 11 installations, and reporting noted public scrutiny of Infatica’s founder and past ties to a hosting firm used in 2016 intrusions.
- Layer3 has backed up raw logs and shared them with a U.S. federal agency, and researchers cautioned that earlier flaws in proxy SDKs let buyers probe local networks or move laterally if an SDK on a device is vulnerable.