Researchers Uncover SIM Farm-as-a-Service Operation Spanning 87 Panels in 17 Nations

Infrastructure intelligence firm Infrawatch has exposed a globally distributed SIM Farm-as-a-Service ecosystem powered by a single Belarus-based software platform called ProxySmart, identifying 87 exposed control panels across 17 countries and at least 94 physical phone-farm locations.

A SIM farm is a physical rack of smartphones or 4G/5G USB modems, each loaded with active SIM cards and connected to carrier networks.

These farms allow operators to generate large volumes of mobile IP addresses and phone numbers on demand, making them powerful tools for bypassing SMS-based verification, rotating IP addresses, and enabling large-scale bot automation.

Unlike traditional proxies, mobile IPs sit behind carrier-grade NAT, meaning a single IP is shared by many users simultaneously, making IP-based blocking far less effective.

The ProxySmart Platform

At the center of this operation is ProxySmart, a turnkey software platform sold to farm operators on a per-SIM pricing model.

The platform, publicly associated with a Belarus-based dealer footprint, delivers an end-to-end commercial stack that handles device management, automated IP rotation, customer provisioning, retail proxy sales, and payment handling.

Its web-based control panel is typically self-hosted by operators, who are advised to deploy a reverse proxy via cloud providers such as DigitalOcean or Hetzner to obscure the farm’s physical location.

ProxySmart supports both physical smartphones and USB 4G/5G modems. On phone-based farms, IP rotation is achieved by toggling airplane mode for approximately three seconds to force a carrier reconnect and reassign the egress IP.

The platform also supports multiple tunneling protocols, including OpenVPN, SOCKS5, VLESS, and HTTP proxies, with VLESS commonly used in censorship-heavy environments like Russia, China, and Iran.

A particularly notable capability is OS fingerprint spoofing, which allows farm traffic to mimic TCP/IP stack behavior from macOS, iOS, Windows, or Android, directly undermining fingerprint-based fraud detection systems.

Infrawatch identified 87 distinct ProxySmart control panel instances across 17 countries, linked to at least 24 commercial proxy providers and 35 cellular carriers.

The physical farm footprint spans 94 locations across North America, Europe, and South America, with a concentrated presence in 19 U.S. states, from California and Texas to Maine and Delaware.

Carrier connectivity across these farms spans major networks globally, including AT&T, Verizon, T-Mobile, Vodafone, EE, O2, Deutsche Telekom, Telstra, Rogers, and dozens more.

Operators commonly distribute SIM cards across multiple carriers within a single farm to expand IP address pools and evade carrier-level enforcement.

Fraud Enablement and KYC Failures

Documented abuse cases enabled by these farms include SMS OTP interception, fake account creation, social media automation, and payment fraud.

Infrawatch found that meaningful Know Your Customer (KYC) verification was uncommon across downstream providers, with some explicitly advertising that KYC was not required.

Several services are marketed directly to Russian-speaking audiences to access geo-restricted Western platforms and bypass state censorship.

This discovery follows major enforcement operations. In September 2025, the U.S. Secret Service dismantled a telecommunications threat in New York involving over 300 SIM servers and 100,000 SIM cards.

In October 2025, a Europol-supported operation in Latvia disrupted a SIM-box cybercrime network, resulting in seven arrests and the seizure of 1,200 SIM-box devices and 40,000 active SIM cards.

Infrawatch assesses that ProxySmart materially lowers the barrier to operating and reselling mobile proxy infrastructure at scale.

Organizations are advised to adopt internet infrastructure intelligence platforms capable of real-time scanning and behavioral validation to detect and block traffic originating from SIM farm proxy networks, as IP-based controls alone are insufficient against this infrastructure.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.