Security firms report residential proxy activity on White House network

Security firms Layer3 Intel and Synthient reported residential proxy activity on the White House network, raising the possibility that outsiders could route internet traffic through an IP address there.

Layer3 Intel found that 28 residential proxy services routed traffic out of the network from October 5 to November 3. The firm said the activity typically occurs between 5PM ET and midnight, a pattern it said suggests a person regularly using the network late in the evening rather than a public guest Wi-Fi network.

Synthient said it found Windows 10 and Windows 11 devices on the network contacting known proxy providers, including Geonode, Infatica and Mellowtel. It said the activity might be linked to the watch party app Rave, which Synthient says bundles 12 proxy SDKs.

Residential proxies let users route internet traffic through another person’s IP address, which can conceal where that traffic originates. The cybersecurity firm Spur says they can serve legitimate purposes such as ad verification and quality assurance testing, but can also be used to bypass geolocation controls and defensive filters. Layer3 said the White House proxy appeared to be publicly accessible for a fee of “a few dollars.”

The Verge reported the findings, also covered by Krebs on Security and The Register. The reports do not identify who operated the devices.