White House network traffic routed through residential proxies

Residential proxies let users route internet traffic through another person’s home IP address, masking where the activity originates. Some apps and browser extensions include third-party software development kits (SDKs) that install proxy nodes on users’ devices, sometimes without their knowledge; services can then sell access to those nodes.

Such proxies have legitimate uses, including ad verification and quality-assurance testing, cybersecurity firm Spur says. They can also help bad actors evade geographic restrictions and security filters, and have been used in botnets and account takeovers.

Layer3 said the White House network activity usually occurred between 5 p.m. ET and midnight. That timing suggested an individual, rather than a public guest Wi-Fi network, was involved, the firm said, describing a person regularly using the network late in the evening whose device may have a proxy SDK. Synthient said the SDK could be linked to the watch-party app Rave, which it said “bundles 12 proxy SDKs into the platform.”

Synthient also identified Windows 10 and Windows 11 devices on the network contacting proxy providers including Geonode, Infatica and Mellowtel. Krebs on Security reported that Infatica was founded by Vladimir Fomenko, who owns King Servers, a company linked to 2016 cyberattacks on election systems in Illinois and Arizona.

Layer3 described the White House residential proxy as “public access,” saying anyone could obtain it by registering with a public proxy service, paying a few dollars and sending requests through it.