ProxySmart linked to 87 exposed SIM farm panels across 17 countries, researchers say

A shared software platform called ProxySmart appears to sit behind a large global SIM farm ecosystem that spans at least 87 exposed control panels in 17 countries. Researchers at Infrawatch say the network connects to at least 94 physical farm locations and helps operators sell mobile proxy access at commercial scale.

The findings matter because SIM farms give customers access to real mobile connectivity rather than traditional datacenter proxies. That makes them useful for fraud, fake account creation, botting, OTP abuse, and geo-evasion, especially on services that trust mobile IPs more than other proxy traffic.

Infrawatch says the majority of the farms it identified rely on ProxySmart, a Belarus-linked platform that handles device management, IP rotation, customer provisioning, and anti-bot evasion. The company says it found 87 exposed ProxySmart control panels on the public internet, spread across at least 24 commercial providers and 35 cellular carriers.

How ProxySmart powers these SIM farms

According to Infrawatch, ProxySmart sells a turnkey stack to farm operators on a per-SIM model. Operators can manage either physical Android phones or USB 4G and 5G modems, then rent out that connectivity as mobile proxy access to customers who want domestic-looking IP addresses.

The platform reportedly includes automated IP rotation, carrier management, protocol support for HTTP, SOCKS5, OpenVPN, and VLESS, plus operating system fingerprint spoofing. That last feature matters because it can help users imitate traffic from devices running Windows, macOS, iOS, or Android, which weakens fingerprint-based fraud checks.

Infrawatch also says farm operators are advised to self-host control panels and mask physical origin points by routing traffic through cloud reverse proxies. That makes the service look cleaner from the outside while the real phone racks or modem banks stay hidden behind normal-looking infrastructure.

Why mobile proxies are harder to block

Mobile proxy traffic is harder to stop than ordinary proxy traffic because carriers often place many users behind carrier-grade NAT. That means one public IP address may represent several legitimate subscribers at the same time, which makes blanket IP blocking far less effective.

Infrawatch says operators can also force fast IP reassignment by toggling airplane mode for a few seconds. Combined with access to many carriers and many SIMs, that lets farms rotate through large pools of fresh-looking mobile IPs with very little effort.

This setup gives buyers a practical way to avoid simple fraud controls. A service that blocks datacenter IPs, suspicious browser signatures, or repeated traffic from one address may still struggle if the requests come from residential-looking mobile connectivity that keeps changing

Geographic footprint and abuse risks

Infrawatch says the network stretches across the United States, Canada, the United Kingdom, Germany, Spain, Portugal, Ukraine, Latvia, France, Romania, Brazil, Ireland, the Netherlands, Australia, Italy, Poland, and Georgia. It also says the United States had the highest concentration of observed deployments, with farms spread across 19 states.

The report says these farms support a broad range of abuse, including account takeover, fake account creation, bot amplification, OTP interception, payment fraud, and access to geo-restricted services. Some providers allegedly marketed directly to Russian-speaking buyers seeking U.S.-located mobile connectivity and access to services that restrict location or verification methods.

Infrawatch also says meaningful KYC checks were rare across many reviewed providers, and some advertised no-KYC access at all. If that finding holds broadly, it means buyers can purchase large-scale mobile proxy capability with very little friction.

Recent law enforcement cases show the scale of the problem

The research lands after several major actions against SIM-based criminal infrastructure. In September 2025, the U.S. Secret Service said it dismantled more than 300 SIM servers and 100,000 SIM cards across the New York tri-state area, calling the setup an imminent telecommunications threat.

A separate October 2025 operation in Latvia, backed by Europol partners, led to seven arrests and the seizure of around 1,200 SIM-box devices and 40,000 active SIM cards, according to widely cited reports on the case. Those reports said the network supported fraud and fake-account activity across more than 80 countries.

Together, those cases show that SIM farms are not a fringe problem. They now look like mature commercial infrastructure that can support both ordinary fraud and higher-end abuse at a scale that challenges telecom operators, platforms, and fraud teams.

Key facts at a glance

Item	Verified detail
Platform name	ProxySmart
Exposed control panels	87
Countries observed	17
Physical farm locations	At least 94
Commercial providers linked	At least 24
Cellular carriers linked	35
U.S. footprint	19 states
Main abuse risks	Fraud, botting, OTP abuse, identity evasion

This summary reflects the attached text and follow-up reporting on Infrawatch’s research.

FAQ