Racks of phones and 4G modems, connected to carrier networks and rented out as commercial mobile proxy services, are operating across at least 94 locations in 17 countries. An investigation by infrastructure intelligence firm Infrawatch traced a large portion of those deployments to a shared software platform called ProxySmart, built and operated out of Minsk, Belarus.
SIM farm (Source: Infrawatch)
Infrawatch identified 87 distinct instances of the ProxySmart control panel exposed on the internet, spread across at least 24 commercial proxy providers and 35 cellular carriers. In the United States alone, farms were found in 19 states, from California and Texas to Maine and Delaware. Researchers assess that an overwhelming majority of the farms it identified are U.S.-based.
“The legal grey area that SIM farms sit in has allowed that model to scale with limited disruption and we assess that it’s highly likely to be facilitating large-scale fraud operations,” said Lloyd Davies, CEO at Infrawatch.
What ProxySmart provides
ProxySmart sells its software to farm operators on a per-SIM pricing model. The platform covers device management, automated IP rotation, customer provisioning, plan enforcement, and anti-bot countermeasures. Operators self-host a control panel and are advised to route traffic through a reverse proxy on cloud infrastructure to obscure the farm’s physical origin.
Devices in the farms are either physical Android phones or USB 4G/5G modems. Phones enroll via an unsigned APK downloaded from the ProxySmart website, with SMS send and receive capability included. Modems are managed through ModemManager, an open-source USB dongle management tool. The Alcatel IK4, available through Amazon and eBay, is among the commonly used modem hardware. The ProxySmart service itself is written in Python and obfuscated using PyArmour.
IP address rotation is achieved by briefly placing mobile devices in airplane mode for three seconds, forcing a reconnection to the carrier and a new IP assignment. Supported tunneling protocols include OpenVPN, SOCKS5, VLESS, and HTTP. VLESS support is relevant in markets such as China, Iran, and Russia, where deep packet inspection is common.
OS fingerprint spoofing
ProxySmart includes an OS spoofing capability that lets operators configure individual proxy ports to present TCP/IP stack characteristics associated with macOS, iOS, Windows, or Android. Anti-fraud and anti-bot systems commonly use TCP/IP stack fingerprinting to infer a connecting device’s operating system.
The ProxySmart feature allows traffic originating from mobile carrier infrastructure to present as a desktop operating system, such as Microsoft Windows. AT&T in the U.S. and Three in the U.K. have implemented network-level countermeasures that block this spoofing.
Geographic spread and carrier coverage
The 94 farm locations Infrawatch identified span North America, Europe, and South America, with confirmed presence in the United States, Canada, United Kingdom, Germany, Spain, Portugal, Ukraine, Latvia, France, Romania, Brazil, Ireland, Netherlands, Australia, Italy, Poland, and Georgia. Farms are concentrated in major metropolitan areas with strong 4G/5G coverage. Some operators use external antennas positioned next to device racks to improve signal stability.
Carrier connectivity available through ProxySmart-powered farms includes AT&T, Verizon, T-Mobile, Vodafone, EE, O2, Three, Telstra, Optus, Rogers, Deutsche Telekom, Orange, SFR, Bouygues, KPN, Kyivstar, Lifecell, Vivo, Claro, and others.
Origins and operator links
ProxySmart is publicly linked through open-source intelligence to a man who advertises assistance with building 4G mobile proxy networks targeting platforms including Instagram, Facebook, and LinkedIn. His personal website promotes hands-on infrastructure setup services.
Coronium, one of the more established operators using ProxySmart, references ProxySmart’s remote script updating service on its installation website and uses an SSH key linked to the platform’s operator in that process.
Commercial providers and KYC
Infrawatch identified 24 commercial proxy services assessed to be running on ProxySmart-backed infrastructure. Some operate their own physical farms; others package third-party farm capacity into retail proxy plans. Some providers target narrow geographic markets and specific use cases including account creation, social media posting and engagement, and general platform automation.
Several services are marketed directly to Russian-speaking audiences as a way to obtain U.S.-located mobile connectivity and access to geo-restricted platforms. Most providers assessed did not appear to require meaningful KYC verification, according to Infrawatch.
A Russia-based service linked to U.S. SIM farms openly advertised censorship circumvention on Telegram, with promotional copy describing access to U.S.-based phones as a way to use top AI services and graphics card platforms.
Detection fingerprint
The ProxySmart control panel produces a consistent HTTP response with a SHA-256 hash of 739f22524fb0fbb64d9bd8bd9e54df73e17abbe8807ca6df350f69078e4bf164. Infrawatch notes this can be queried directly. A small number of larger operators have rebranded their panels to remove ProxySmart references. One instance was found running on a U.K. residential IP address.
UPDATE: April 21, 15:07 ET
Alex Zak, Technical Consultant & Director of Public Relations at ProxySmart, reached out to Help Net Security with the following comment:
“ProxySmart is a data-path proxy management layer, not a SIM farm. It has no voice primitives, no SMS origination, no interconnect functionality — the technical capabilities that define the infrastructure dismantled in the Europol and Secret Service cases the research references. Our deployments run on IoT-class cellular equipment authorised by the carriers themselves, in stock configurations, not the amplifier-heavy rack hardware used for SIM-box fraud. The infrastructure underpins legitimate work across advertising verification, brand protection, cybersecurity research, fraud-detection model training, and application QA, alongside the downstream providers visible on the public internet. Our full response to the research, covering the technical, methodological, and process points in detail, is here.”
Click Here For The Original Source.
