Infrawatch Links ProxySmart to SIM Farms Across 17 Countries
Summary
Infrawatch linked many SIM-farm deployments across 17 countries to ProxySmart, which manages mobile devices, rotates IPs and spoofs OS fingerprints. The firm assesses the networks are likely facilitating large-scale fraud.
Key points
- Infrawatch identified 87 exposed ProxySmart control panels across 24 proxy providers and 35 carriers, and farms at 94 locations in 17 countries.
- The farms use Android phones or USB 4G/5G modems managed through ProxySmart; phones enroll through an unsigned APK.
- IP rotation works by briefly toggling a device’s airplane mode to trigger a new carrier IP assignment. Supported tunneling includes OpenVPN, SOCKS5, VLESS and HTTP.
- ProxySmart can make mobile-origin traffic present TCP/IP characteristics associated with desktop operating systems; AT&T and Three have implemented network-level blocks against this spoofing.
- Infrawatch says most assessed providers appeared to require little meaningful KYC and were marketed for account creation, social media automation or related uses.
- Infrawatch assesses the infrastructure is highly likely to facilitate large-scale fraud; this is an assessment, not confirmation of specific fraud incidents.
- The control panel returns a consistent HTTP response with a SHA-256 fingerprint that Infrawatch says can be queried for detection.
Article Details
- Attack Vectors
- ProxySmart-powered farms use Android phones or USB 4G/5G modems to provide mobile proxy connections, with IP addresses rotated by briefly toggling airplane mode.
- Operators can route traffic through a cloud-hosted reverse proxy to obscure the physical location of a farm.
- ProxySmart supports OpenVPN, SOCKS5, VLESS, and HTTP tunneling, and can spoof TCP/IP stack fingerprints to make mobile-origin traffic appear to come from desktop operating systems.
- ProxySmart services are marketed for account creation, social media automation, and censorship circumvention; Infrawatch assesses that the infrastructure is highly likely to facilitate large-scale fraud.
- Defensive Notes
- The ProxySmart control panel produces a consistent HTTP response fingerprint with SHA-256 value 739f22524fb0fbb64d9bd8bd9e54df73e17abbe8807ca6df350f69078e4bf164, which Infrawatch says can be queried directly.
- The article reports that AT&T and Three have implemented network-level countermeasures that block ProxySmart’s TCP/IP fingerprint spoofing.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 739f22524fb0fbb64d9bd8bd9e54df73e17abbe8807ca6df350f69078e4bf164 | SHA-256 fingerprint of the HTTP response produced by ProxySmart control panels; Infrawatch identifies it as a queryable detection fingerprint for the SIM-farm infrastructure. |
MITRE ATT&CK
People
Vendors
Products
Alcatel IK4Operators use Android phones and USB 4G/5G modems (e.g., Alcatel IK4) managed via an unsigned APK and ModemManager.ProxySmartInfrawatch’s investigation found racks of phones and 4G/5G modems running ProxySmart-powered SIM farms operating across at least 94 locations in 17 countries, with a heavy concentration in the United States.
Countries
AustraliaKingdom, Germany, Spain, Portugal, Ukraine, Latvia, France, Romania, Brazil, Ireland, Netherlands, Australia, Italy, Poland, and Georgia.BelarusAn investigation by infrastructure intelligence firm Infrawatch traced a large portion of those deployments to a shared software platform called ProxySmart, built and operated out of Minsk, Belarus.Brazilin the United States, Canada, United Kingdom, Germany, Spain, Portugal, Ukraine, Latvia, France, Romania, Brazil, Ireland, Netherlands, Australia, Italy, Poland, and Georgia.Canadaidentified span North America, Europe, and South America, with confirmed presence in the United States, Canada, United Kingdom, Germany, Spain, Portugal, Ukraine, Latvia, France, Romania, Brazil, Ireland,Francepresence in the United States, Canada, United Kingdom, Germany, Spain, Portugal, Ukraine, Latvia, France, Romania, Brazil, Ireland, Netherlands, Australia, Italy, Poland, and Georgia.GeorgiaPortugal, Ukraine, Latvia, France, Romania, Brazil, Ireland, Netherlands, Australia, Italy, Poland, and Georgia.GermanyEurope, and South America, with confirmed presence in the United States, Canada, United Kingdom, Germany, Spain, Portugal, Ukraine, Latvia, France, Romania, Brazil, Ireland, Netherlands, Australia, Italy,IrelandStates, Canada, United Kingdom, Germany, Spain, Portugal, Ukraine, Latvia, France, Romania, Brazil, Ireland, Netherlands, Australia, Italy, Poland, and Georgia.ItalyGermany, Spain, Portugal, Ukraine, Latvia, France, Romania, Brazil, Ireland, Netherlands, Australia, Italy, Poland, and Georgia.Latviawith confirmed presence in the United States, Canada, United Kingdom, Germany, Spain, Portugal, Ukraine, Latvia, France, Romania, Brazil, Ireland, Netherlands, Australia, Italy, Poland, and Georgia.NetherlandsCanada, United Kingdom, Germany, Spain, Portugal, Ukraine, Latvia, France, Romania, Brazil, Ireland, Netherlands, Australia, Italy, Poland, and Georgia.PolandSpain, Portugal, Ukraine, Latvia, France, Romania, Brazil, Ireland, Netherlands, Australia, Italy, Poland, and Georgia.Portugaland South America, with confirmed presence in the United States, Canada, United Kingdom, Germany, Spain, Portugal, Ukraine, Latvia, France, Romania, Brazil, Ireland, Netherlands, Australia, Italy, Poland, and Georgia.Romaniain the United States, Canada, United Kingdom, Germany, Spain, Portugal, Ukraine, Latvia, France, Romania, Brazil, Ireland, Netherlands, Australia, Italy, Poland, and Georgia.RussiaVLESS support is relevant in markets such as China, Iran, and Russia, where deep packet inspection is common.SpainEurope, and South America, with confirmed presence in the United States, Canada, United Kingdom, Germany, Spain, Portugal, Ukraine, Latvia, France, Romania, Brazil, Ireland, Netherlands, Australia, Italy, Poland, andUkraineAmerica, with confirmed presence in the United States, Canada, United Kingdom, Germany, Spain, Portugal, Ukraine, Latvia, France, Romania, Brazil, Ireland, Netherlands, Australia, Italy, Poland, and Georgia.United Kingdomspan North America, Europe, and South America, with confirmed presence in the United States, Canada, United Kingdom, Germany, Spain, Portugal, Ukraine, Latvia, France, Romania, Brazil, Ireland, Netherlands, Australia,United StatesInfrawatch’s investigation found racks of phones and 4G/5G modems running ProxySmart-powered SIM farms operating across at least 94 locations in 17 countries, with a heavy concentration in the United States.