A residential proxy opens up a way for people to rent access to a home IP address and route their internet traffic through it, allowing them to conceal where their activity is actually coming from. Some apps and browser extensions include third-party software development kits (SDKs) that put proxy nodes on a user’s device — whether users know it or not. Third-party services can then sell access to the residential proxies on users’ devices.

At the White House, Layer3 Intel found that 28 residential proxy services routed traffic out of the network from October 5th to November 3rd. It notes that this activity typically happens between 5PM ET and midnight. “That pattern suggests a person rather than a public guest Wi-Fi network: someone regularly on the White House network late into the evening, whose device is infected with a proxy SDK,” Layer3 says. The SDK in question might be linked to the watch party app Rave, according to Synthient, which says the app “bundles 12 proxy SDKs into the platform.”

Synthient found “a number of Windows 10 and Windows 11 devices on the White House’s network beaconing to known proxy providers like Geonode, Infatica and Mellowtel.” As noted by Krebs on Security, Infatica is a proxy service founded by Vladimir Fomenko, the owner of King Servers, which was linked to 2016 cyberattacks on election systems in Illinois and Arizona.

Layer3 warns that the residential proxy is “public access,” adding that “anybody can obtain it by signing up to a public residential proxy service, paying a few dollars and sending requests through it.”