Иллюстрация: infrawatch.com
Researchers at Infrawatch have identified a large-scale SIM farm infrastructure spanning dozens of countries and supporting the mobile proxy market. According to their findings, at least 87 active farms have been detected in 17 countries, used for automation, bypassing restrictions and fraudulent activities.
SIM farms are physical installations — racks containing hundreds of smartphones or 4G/5G modems connected to mobile networks. Such systems make it possible to generate large numbers of “real” mobile IP addresses. Due to the nature of carrier networks, a single IP address can be used by multiple users simultaneously, making blocking less effective.
A key element of the infrastructure, analysts say, is the ProxySmart platform — a software suite that effectively serves as a control centre. It allows operators to remotely manage devices, automatically rotate IP addresses, handle clients and sell proxy access. The service is positioned as a turnkey solution, significantly lowering the technical barrier to entry into this business.
Researchers note that ProxySmart is publicly linked to a supplier with Belarusian ties.
According to Infrawatch estimates, at least 24 commercial providers operate on the basis of ProxySmart. Some manage farms directly, while others act as intermediaries, reselling capacity. Customer requirements are minimal: identification procedures (KYC) are often absent, making the services accessible to virtually any buyer.
The network’s geography spans North and South America, Europe and Australia. The highest concentration has been recorded in the United States, where farms are located in at least 19 states. In Europe, the infrastructure is present, among others, in Germany, France, Poland and the Netherlands.
SIM farms are widely used to register and manage social media accounts, for automated promotion and other types of bot activity. Some services explicitly advertise their ability to bypass geographic restrictions and censorship, offering, for example, access to US online platforms via “real” mobile devices.
Law enforcement agencies have already encountered similar infrastructure. In 2025, a network involving hundreds of SIM servers and tens of thousands of SIM cards was dismantled in the United States, while in Latvia an operation targeted a cybercriminal group using SIM-box equipment.
Experts note that the combination of rapid IP rotation, the use of multiple carrier networks and digital fingerprint spoofing technologies makes such systems particularly difficult to detect. As a result, traditional methods of combating online fraud based on IP address analysis are becoming increasingly ineffective.