Single-Platform Solution Powers Global SIM Farm Proxy Networks
Commercial Mobile Proxies Proliferate Across Globe
Racks of phones and 4G modems, connected to carrier networks and rented out as commercial mobile proxy services, operate across at least 94 locations in 17 countries.
ProxySmart Platform Identified in Investigation
According to an investigation by infrastructure intelligence firm Infrawatch, a significant portion of these deployments are linked to a shared software platform called ProxySmart, built and operated out of Minsk, Belarus.
Scope of Deployments Revealed
- Infrawatch identified 87 distinct instances of the ProxySmart control panel exposed on the internet
- Spanning at least 24 commercial proxy providers and 35 cellular carriers
- Within the United States alone, farms were discovered in 19 states
ProxySmart Operations and Features
“ProxySmart operates on a per-SIM pricing model, selling its software to farm operators. The platform handles device management, automated IP rotation, customer provisioning, plan enforcement, and anti-bot countermeasures.” – Infrawatch
Tunneling Protocols and Anti-Fraud Measures
- Supported tunneling protocols include OpenVPN, SOCKS5, VLESS, and HTTP
- VLESS support is particularly relevant in regions where deep packet inspection is prevalent, such as China, Iran, and Russia
- Anti-fraud and anti-bot systems often employ TCP/IP stack fingerprinting to determine a device’s operating system
Geographical Spread of ProxySmart-Powered Farms
- Confirmed presence in the United States, Canada, United Kingdom, Germany, Spain, Portugal, Ukraine, Latvia, France, Romania, Brazil, Ireland, Netherlands, Australia, Italy, Poland, and Georgia
- Farms are concentrated in major metropolitan areas with robust 4G/5G coverage
Carrier Connectivity and Commercial Proxy Services
- Carrier connectivity available through ProxySmart-powered farms includes AT&T, Verizon, T-Mobile, Vodafone, EE, O2, Three, Telstra, Optus, Rogers, Deutsche Telekom, Orange, SFR, Bouygues, KPN, Kyivstar, Lifecell, Vivo, Claro, and others
- Researchers have identified 24 commercial proxy services assessed to be running on ProxySmart-backed infrastructure
Detection Fingerprint and Potential Implications
“One Russia-based service openly advertised censorship circumvention on Telegram, promoting access to US-based phones as a means to use top AI services and graphics card platforms.” – Infrawatch
Infrawatch has also identified a detection fingerprint – a consistent HTTP response with a SHA-256 hash of 739f22524fb0fbb64d9bd8bd9e54df73e17abbe8807ca6df350f69078e4bf164 – which can be queried directly.
About Author
English