White House network (AS2650): six IPs used as residential proxy exits 236 times in 30 days
Severity: medium · Patch status: unknown · Since 2026-11-04
Layer3 Intel, a residential-proxy detection firm, reports that six IP addresses on AS2650, the block registered to the Executive Office of the President, were used as exit nodes for 28 commercial residential proxy services, with 236 exits between 5 October and 3 November 2026 and activity on 26 of 30 days. Layer3 says it found this incidentally while enumerating proxy exits and did not target the network. About half the activity falls between 5 p.m. and midnight Eastern, which Layer3 reads as someone regularly on the network in the evening with a proxy SDK on their device, while stating that its data shows exits, not devices or people. Synthient attributes the traffic to Windows 10 and 11 hosts beaconing to proxy SDKs (Geonode, Infatica, Mellowtel) and says the likely carrier is the Rave.io app. Those attributions are Synthient's own claims, its method is not described in the coverage, and no device, staffer or SDK on the network has been independently confirmed. Krebs reports that the White House did not immediately respond to a request for comment. No intrusion, CVE or vendor fix is reported. Layer3 frames a risk that a flawed proxy SDK could let buyers reach internal systems as conditional and cites the Kimwolf botnet only as precedent. The practical response is to hunt the named SDKs and app on Executive Office devices, review AS2650 egress for proxy patterns, block known proxy endpoints at the edge, and segment devices that carry these SDKs.
What to do
- Hunt for and remove proxy SDKs (InfaticaSDK, Geonode, Mellowtel) and the Rave.io app from Executive Office network devices, prioritising machines active evenings
- Block beaconing to known residential proxy provider endpoints at the network edge
- Audit egress traffic on AS2650 for unexpected outbound proxy patterns and enumerate all devices acting as exit nodes
- Review whether proxy SDK exposure could allow lateral movement to internal systems and segment accordingly
- Screen software installs for bundled proxy SDKs and enforce application allowlisting
Sources
All live incidents on Threat Watch
