> ## Content Index > Fetch the complete content index at: https://www.dailyferment.com/llms.txt > Use this file to discover other available public pages before exploring further. # Strangers rented White House internet addresses 236 times. Banks have a name for that. - URL: https://www.dailyferment.com/residential-proxy-white-house-network/ - Published: 2026-11-06T01:00:00.000Z - Updated: 2026-11-06T00:59:59.000Z - Description: Residential proxy traffic left the White House network 236 times in 30 days, Layer3 Intel found. It means a device there is renting out its address, likely through an app. Banks call the same trade a money mule. - Author: Rana Bilal Zafar - Tags: Engineering, #reframe Between 5 October and 3 November 2026, paying customers of residential proxy services sent their internet traffic out through the White House network 236 times. Layer3 Intel, a firm that tracks these services, published the finding on 4 November. It saw six addresses on AS2650, the network registered to the Executive Office of the President, active on 26 of 30 days through 28 different proxy services. So what does a residential proxy on the White House network mean? Not that someone broke in. It means at least one device there is renting out its connection, almost certainly through an app its owner installed for something else. ## What is a residential proxy, and why would one be on the White House network? A residential proxy service sells the use of ordinary home and office internet addresses. A customer's traffic goes out through someone else's device, so a website sees what looks like a normal user. The FBI described the setup in a March 2026 [public service announcement](https://www.ic3.gov/PSA/2026/PSA260312?ref=dailyferment.com): devices get enrolled through free VPN apps, mobile apps with embedded software kits (SDKs) whose developers are paid per download, TV boxes, pirated software and apps that pay people to "share" bandwidth. **236**proxy exits through the White House network, 5 Oct to 3 Nov 2026 **6**addresses on AS2650 **26 of 30**days with activity **28**residential proxy services that could exit there Source: Layer3 Intel, 4 Nov 2026, as also reported by Krebs on Security, 4 Nov 2026. The apps are the part that matters. Google's Threat Intelligence Group, which [disrupted the IPIDEA network](https://cloud.google.com/blog/topics/threat-intelligence/disrupting-largest-residential-proxy-network?ref=dailyferment.com) in January, found that "Many of the malicious applications we analyzed in our investigation did not disclose that they enrolled devices into the IPIDEA proxy network." The owner thinks they installed a game, a VPN or a utility. The app quietly sells their connection on the side. For the White House case, Brian Krebs [reported](https://krebsonsecurity.com/2026/11/want-to-rent-an-internet-address-at-the-white-house/?ref=dailyferment.com) that Synthient, another tracking firm, tied the activity to several installations of Infatica, a proxy program often built into "free" mobile and desktop apps. Layer3 put it bluntly, as Krebs quotes it: "This is public access." Anyone with a few dollars could have routed traffic through those addresses. About half of it ran between 5 p.m. and midnight Eastern, which fits a phone or laptop that's on the network in the evening. ## My first reaction: so the White House is compromised That's how the story spread, and it's where I started. Then I checked what the data can show. Layer3 sees the traffic leaving. It doesn't see the device, the person or what else that device can reach. Nobody I read claims an attacker got into a White House system. The White House hadn't responded when Krebs published. Guess first: in January 2026, how many threat groups did Google see using one residential proxy network's exit addresses in a single week? **More than 550**, using IPIDEA's network, in one seven-day period. Source: Google Threat Intelligence Group, 28 Jan 2026. But "not a break-in" isn't the same as "harmless". Google warns that "When a user's device becomes an exit node, network traffic that they do not control will pass through their device." Synthient's earlier work on the Kimwolf botnet, which Krebs [wrote up in January](https://krebsonsecurity.com/2026/01/the-kimwolf-botnet-is-stalking-your-local-network/?ref=dailyferment.com), showed attackers using proxy endpoints to reach other devices on the same local network. More than 2 million devices ended up infected that way. So the honest reading is in between: an address that should be trusted is for rent, and the device renting it is a door nobody is watching. ## Where have I seen a trusted name rented out before? In banking, where it's called a money mule. A mule is a person whose bank account is used to move someone else's money. The account has a clean history, a real name and a real address, which is exactly what the criminals need. When Europol, Eurojust and the European Banking Federation ran a coordinated action in late 2018, they [identified 1,504 money mules](https://www.eurojust.europa.eu/news/over-1-500-money-mules-identified-worldwide-money-laundering-sting?ref=dailyferment.com) through more than 300 banks. Their description of mules is the line that matters here: people who, "often unwittingly, have been recruited by criminal organisations". ![A finger pressing the keypad of a metal cash machine](https://storage.ghost.io/c/d7/b7/d7b77195-48c5-45ab-8688-51750879d1d6/content/images/2026/11/df98-split-atm.jpg) Illustrative. Photo by [Eduardo Soares](https://unsplash.com/photos/person-pressing-metallic-atm-keypad-utWyPB8%5FFU8?ref=dailyferment.com) on [Unsplash](https://unsplash.com/photos/person-pressing-metallic-atm-keypad-utWyPB8%5FFU8?ref=dailyferment.com) The mechanics line up closely. The criminal needs something they can't easily get themselves: an account, or an internet address, that already has a good reputation. They rent it from an ordinary person, through a recruiter who offers a job, easy money or a free app. The owner often doesn't understand what they agreed to. Google found that many of the IPIDEA apps it analysed never told users. Eurojust says mules are often unwitting. And the institution on the other end sees only the clean name. A bank sees a real customer. A website sees a White House address. The same trade in two systems #### Residential proxy - *What is rented:* an internet address with a clean reputation - *Who rents it out:* a device owner, usually through an app - *Do they know?* often not (Google, Jan 2026) - *What the other side sees:* a normal user at that address #### Money mule - *What is rented:* a bank account with a clean history - *Who rents it out:* an account holder, through a recruiter - *Do they know?* "often unwittingly" (Eurojust) - *What the other side sees:* a real customer moving money Sources: FBI PSA I-031226-PSA, 12 Mar 2026; Google Threat Intelligence Group, 28 Jan 2026; Eurojust, 4 Dec 2018. So where do you look? A bank that finds a mule account doesn't conclude its vault was breached. It concludes that a customer's good name is being used by someone else, and it goes looking for how that customer was recruited. A network team that finds a proxy exit should read it the same way: find the device, then find the app that signed it up. Blocking known proxy addresses at the edge, as the FBI suggests businesses do, is the equivalent of refusing the transfer. It doesn't find the mule. ## Is this only a White House problem? Almost certainly not, and that's why I think the story matters past Washington. Krebs cites a January 2026 webinar in which the firm Spur said it had found residential proxies in nearly 300 government networks, 318 utilities, 166 healthcare organisations and 141 banking and finance companies. Synthient's founder, Ben Brundage, told Krebs that "Some of these resellers sell bandwidth for as low as 60 cents a Gigabyte." At that price, the trusted addresses of governments, hospitals and banks are on sale with everyone else's. The White House is just the address that made people look. We've seen the same pattern from the other side before: an [AI coding tool that packaged a user's git history](https://www.dailyferment.com/zcode-silent-upload-consent-capture-versus-use/) without asking, and [infostealer malware that ranks its victims with AI](https://www.dailyferment.com/volta-infostealer-ai-ranks-victims/). In each case the software did something on the device that the owner never knowingly agreed to. ![Card: two parallel chains. Proxy: paying customer, proxy service, device on AS2650 with a proxy SDK, website sees a White House address. Mule: criminal group, recruiter, mule account with an often unwitting owner, bank sees a clean real name](https://storage.ghost.io/c/d7/b7/d7b77195-48c5-45ab-8688-51750879d1d6/content/images/2026/11/df98-rented-address.png) Card by Daily Ferment. Sources: Layer3 Intel and Krebs on Security, 4 Nov 2026; Eurojust, 4 Dec 2018. ## How sure am I? Established Layer3's counts (236 exits, 6 addresses, 26 of 30 days, 28 services). Synthient tying the activity to Infatica installations, as Krebs reports. How devices get enrolled (FBI, Google). The EMMA mule figures (Eurojust, 2018). Inferred That a phone or laptop with a proxy SDK, used on the network in the evenings, is the likeliest cause. That the mule comparison is the right way to read the risk: a rented name, not a breached vault. Still a guess That most large organisations, governments included, would find the same thing if someone looked from outside. The claim, in one sentence A residential proxy exit on a network is a rented address, not a break-in, but like a money mule account it shows that someone inside is lending out a trusted name, usually without knowing it, so the fix starts with finding the app that signed them up. What I don't know is which device it was, whose it was, or whether it's still there. If the White House or Layer3 says more, I'll come back to this. **More on Daily Ferment:** [VOLTA asks an AI what you're worth. A refusal just sends it to the next model.](https://www.dailyferment.com/volta-infostealer-ai-ranks-victims/) and [Half of the Binance hack could be frozen. The other half had no one to call.](https://www.dailyferment.com/binance-hack-stablecoins-frozen/) ## Sources - [Layer3 Intel, Residential Proxies Detected on White House Network](https://layer3intel.com/blog/residential-proxies-white-house-network?ref=dailyferment.com), 4 November 2026. - [Krebs on Security, Want to Rent an Internet Address at the White House?](https://krebsonsecurity.com/2026/11/want-to-rent-an-internet-address-at-the-white-house/?ref=dailyferment.com), 4 November 2026. - [FBI, Public Service Announcement I-031226-PSA on residential proxy networks](https://www.ic3.gov/PSA/2026/PSA260312?ref=dailyferment.com), 12 March 2026. - [Google Threat Intelligence Group, No Place Like Home Network: Disrupting the World's Largest Residential Proxy Network](https://cloud.google.com/blog/topics/threat-intelligence/disrupting-largest-residential-proxy-network?ref=dailyferment.com), 28 January 2026. - [Krebs on Security, The Kimwolf Botnet is Stalking Your Local Network](https://krebsonsecurity.com/2026/01/the-kimwolf-botnet-is-stalking-your-local-network/?ref=dailyferment.com), 2 January 2026. - [Eurojust, Over 1 500 money mules identified in worldwide money laundering sting](https://www.eurojust.europa.eu/news/over-1-500-money-mules-identified-worldwide-money-laundering-sting?ref=dailyferment.com), 4 December 2018.