Anyone renting a residential proxy this autumn may have been routing traffic out of the White House.
AS2650 is the address block reserved for the Executive Office of the President, and Layer3 Intel reports spotting proxy nodes beaconing from it. Layer3, which makes the probes public, recorded between October 5 and November 3 a pattern of proxy traffic from AS2650 that held fairly steady, and counted 236 exits from the White House network in that window.
Synthient attributed the traffic to multiple Windows 11 installs of Infatica, a service routinely bundled inside free mobile and desktop applications. A staffer installing a shopping or media app can hand their network position to strangers.
Why the vendor matters
Infatica’s founder, Vladimir Fomenko, ran a hosting business called King Servers. Six of the eight addresses Russian state security services used against Arizona and Illinois election systems in 2016 sat on his infrastructure.
Layer3 said the exit nodes came from six addresses, active on 26 of the days it tracked.
The device, not the perimeter
Residential proxy software is not malware in the classic sense. It ships inside consumer apps, asks for permission in a prompt few read, then sells the connection onward. A web server only ever sees the rented IP address, never the customer behind it.
Blocking the traffic at the perimeter does not address the cause. The useful controls live on endpoints: inventory what software is installed, alert on proxy services by name, and strip bundled network-sharing components from software packages corporate machines are allowed to run. Appliances that block known proxy infrastructure catch only the addresses already documented.
