The White House
Image credit: National Park Service
Devices connected to the White House network appear to be running software that lets strangers rent its internet addresses. And one of the services involved was founded by a Russian businessman whose former hosting company provided internet addresses used in the 2016 election hacks.
Security firm Layer3 Intel reported on November 4 that it detected "residential proxy" activity on the network registered to the Executive Office of the President. Between October 5 and November 3, researchers successfully routed traffic through six White House internet addresses on 236 occasions, with activity detected on 26 of the 30 days. In all, 28 different proxy services could route traffic through the network.
A residential proxy service works like a forwarding address for web traffic. Paying customers send their web traffic through someone else's connection, so it appears to come from that person's home or office instead of their own. Criminals often use these services to hide their location, take over accounts and commit fraud.
For just a few dollars, customers of these proxy services could route their internet traffic through White House addresses, making their online activity appear to originate from the Executive Office of the President.
One of the services identified was Infatica. According to cybersecurity journalist Brian Krebs, security firm Synthient linked some of the activity to multiple Windows 11 installations of Infatica's proxy software.
Infatica's founder, Vladimir Fomenko, formerly ran a hosting company called King Servers. During the 2016 attacks on election databases in Arizona and Illinois, six of the eight internet addresses Russia's state security services used to break in were hosted on King Servers. Neither Layer3 nor Krebs says Infatica itself took part in those attacks or that the proxy software just discovered on the White House network was used for anything illicit.
There's no evidence that anyone at the White House knowingly installed the software or used it for illicit purposes. Residential proxy software is sometimes bundled into free apps and browser extensions without users realizing their internet connections are being rented out. About half the activity occurred between 5 p.m. and midnight Eastern, suggesting it may have come from a device regularly used by someone on the network. However, researchers could not identify the device or its owner.
How residential proxies threaten network security
The danger goes beyond strangers borrowing a White House internet address. Poorly secured residential proxy software can also provide access to other devices on the same local network. In January 2026, dozens of proxy services had to address vulnerabilities that attackers exploited to reach devices behind users' routers. Security firm Spur separately found that nearly every residential proxy service it tested allowed access to local networks by default. If similar weaknesses exist in software running on the White House network, attackers could potentially use it to probe internal systems. There is no evidence that happened here.
The White House did not immediately respond to Krebs's request for comment.
The residential proxy problem is far more widespread than just the White House. Security firm Spur found residential proxies on nearly 300 government networks, as well as networks belonging to hundreds of utility companies, hospitals and financial institutions.
How to check if your internet connection is being used as a proxy
And that same risk applies at home. Free apps and browser extensions sometimes pay for themselves by renting out your connection or collecting what you do online, as we reported with free VPN-style extensions that were quietly harvesting browsing data. Even apps that openly pay users to share their internet connections, like Honeygain, have been found to be routing criminal traffic.
Our advice is that if you can't tell how a free app makes money, skip it. If you want a VPN, choose a reputable paid service rather than a free one of unknown origin, and remove any browser extensions or apps you don't recognize or no longer need to. Even legitimate browser extensions have been acquired by malicious operators and updated to introduce harmful functionality.
You can check whether your home internet connection has been identified as a proxy using Spur's free IP address checker. The site automatically checks your public IP address and shows whether Spur has detected proxy or VPN activity associated with it. If your home connection is flagged as a residential proxy and you don't knowingly use a bandwidth-sharing service, it's worth investigating the apps and devices on your network. However, a clean result doesn't guarantee you're safe – Spur can only identify activity it has detected, and the check won't tell you which device might be responsible.
Read more: How to Tell If Your Phone Has Been Hacked
