Infrawatch’s investigation found racks of phones and 4G/5G modems running ProxySmart-powered SIM farms operating across at least 94 locations in 17 countries, with a heavy concentration in the United States. ProxySmart provides device management, automated IP rotation, OS fingerprint spoofing, and tunneling features that enable commercial mobile proxy services used for account automation and likely large-scale fraud. #ProxySmart #Infrawatch
Keypoints
- Infrawatch identified 87 exposed ProxySmart control panels across 24 proxy providers and 35 carriers.
- Operators use Android phones and USB 4G/5G modems (e.g., Alcatel IK4) managed via an unsigned APK and ModemManager.
- IP rotation is achieved by briefly toggling airplane mode and supported tunneling includes OpenVPN, SOCKS5, VLESS, and HTTP.
- ProxySmart can spoof TCP/IP stack fingerprints to make mobile-origin traffic appear as desktop systems, prompting blocks by AT&T and Three.
- Most commercial providers require little meaningful KYC and are marketed for account creation, social media automation, and censorship circumvention.
Read More: https://www.helpnetsecurity.com/2026/04/21/sim-farm-proxy-network-cybercrime/