# Layer3 Intel Finds White House Network Served as Proxy Exit on 26 Days

By Simon Yoon

Canonical URL: https://www.tokenpost.com/news/technology/52324
Published: 2026-11-09T13:30:25.000Z
Updated: 2026-11-09T13:30:25.000Z
Section: Technology

> Synthient inferred Rave might be involved, but the test did not confirm the app was installed on any device.

Layer3 Intel recorded 236 proxy-test exits through the White House network during a 30-day test, showing that residential proxy services could route traffic through six addresses on 26 days.

The test ran from Oct. 5 through Tuesday, Nov. 3. It found that 28 proxy services could route traffic through the network.

The network identifier AS2650 is registered to the Executive Office of the President. Residential proxies send a customer’s traffic through another person’s connected device, making it appear to come from that device’s address.

About half of the observed activity occurred between 5 p.m. and midnight ET, with almost none in the early morning. The test recorded network exit addresses and activity timing, but did not identify specific devices or users.

Synthient said it detected Windows 10 and Windows 11 devices on the network connecting to Geonode, Infatica and Mellowtel. It inferred that Rave, an app for watching YouTube, Netflix and Disney+ with friends, might be the source because its search found the app was the only Windows program with software development kits (SDKs) for all three services. The test did not confirm that Rave was installed on any device.

Synthient also claims Rave contains 12 proxy SDKs and continues running in the system tray after its window closes. It claimed Rave can enable bandwidth sharing after seven days even when users decline. The test did not show whether bandwidth sharing was active on any connected device.

Layer3 Intel warned that poorly secured proxy SDKs can create a path into internal networks and allow movement between systems. It presented that as a conditional risk, not evidence that a proxy customer reached White House systems.

Synthient’s research on the Kimwolf botnet estimated that it spread through residential proxy networks and infected at least two million devices, mostly Android devices with exposed Android Debug Bridge (ADB) services. The White House test did not establish a breach or access to internal systems.