{
  "id": 18385281,
  "title": "The White House is apparently a popular residential proxy exit spot",
  "url": "https://urgent.news/2026/11/05/the-white-house-is-apparently-a-popular-residential-proxy-exit-spot",
  "topic": "science",
  "section": "Science",
  "published": "2026-11-05T20:50:57.000Z",
  "source": {
    "name": "The Register Science",
    "slug": "the-register-science",
    "url": "https://www.theregister.com/security/2026/11/05/the-white-house-is-apparently-a-popular-residential-proxy-exit-spot/5307969"
  },
  "original_language": "en",
  "account": "Recent reports have revealed that devices connected to the White House network may be functioning as residential proxy exit nodes, potentially exposing the sensitive network to security threats. Security firm Layer3 Intel discovered this illicit activity using their newly launched Residential Proxy Observatory tool. According to Layer3 founder Sergiy Usatyuk, the activity might have gone unnoticed without the new tool. Residential proxies, which mask a user's location using IP addresses from residential internet connections, are commonly exploited by threat actors for malicious purposes such as concealing command-and-control (C2) infrastructure, conducting phishing attacks, sending spam, and disguising malicious traffic.\n\nBetween October 5 and November 3, Layer3's data shows that 28 distinct residential proxy services exited into the White House network nearly every day, with a total of 236 separate exits. Most of the activity occurred between 5 pm and midnight, suggesting that an infected device within the White House network is likely serving as an exit node, possibly through a compromised proxy software development kit (SDK). If this is confirmed, it poses a serious security risk, as poorly secured proxy SDKs can allow internal network access and lateral movement, enabling attackers to infiltrate sensitive government systems.\n\nLayer3's data has been independently verified by other residential proxy detection services, indicating that the White House's IP addresses have been utilized by proxy networks for malicious activities for an extended period. However, Usatyuk cannot determine the exact number of devices being used as exit nodes within the White House network. He suggests that the Infatica SDK, which allows app developers to monetize users' internet connections by turning devices into residential proxy exit nodes, may be installed on multiple Windows 10 and 11 devices at the White House. This software could potentially provide attackers with an entry point into internal systems if vulnerable.\n\nThe US State Department has requested a copy of Layer3's logs to investigate the situation, which Usatyuk has already forwarded to them. The White House has not responded to inquiries regarding this matter.",
  "summary": "How it got there is another matter entirely",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}