New Study Uncovers Infrastructure Behind Carding Markets: 28 IPs, 85 Domains

Cybersecurity researchers have identified 28 unique IP addresses and 85 domains hosting carding markets and forums, shedding light on the technical infrastructure enabling credit card fraud operations worldwide.

The research, conducted between July and December 2025, utilized advanced technical fingerprinting methods to track these illicit platforms before criminals could entirely obscure them.

Infamous Dark Net Carding Site

Team Cymru’s investigation leveraged internet-wide scanning capabilities to identify carding servers as they were created or modified, capturing critical data before operators hid them behind protective services like content delivery networks.

This proactive approach provides law enforcement, financial institutions, and fraud prevention teams with actionable intelligence for takedowns, subpoenas, and evidence collection.

The research revealed that many IP addresses were hosted by offshore infrastructure providers operating in jurisdictions with limited international law enforcement co-operation.

Privex, a “privacy minded infrastructure” provider, emerged as the most common hosting service, advertising dedicated VPS servers that criminals can purchase anonymously without providing identification.

Analysis of the 85 domains uncovered interesting patterns in cybercriminal preferences. The most common top-level domains were .su (Soviet Union), .cc, and .ru, chosen for their combination of jurisdictional shielding and lax oversight.

The .su domain belongs to the now-defunct Soviet Union and has historically maintained loose registration policies, while.cc appeals to carders as it can represent “credit card” and offers cheap bulk registration.

Carding operates as a sophisticated supply chain where criminals specialize in data theft, sales, or cashing out. Stolen credit card data sells for $5 to $150 per card, depending on credit limits, freshness, country of origin, and whether it includes complete identity details.

Data harvesting occurs through multiple methods, including web skimming (Magecart attacks), phishing campaigns, database breaches, and physical skimming devices at ATMs and point-of-sale terminals.

Team Cymru distinguishes between carding market transactional platforms operating as e-commerce sites for stolen financial data and carding forums, which function as discussion hubs where threat actors share techniques, advertise services, and build reputations within the cybercrime community.

The research methodology combined internet-wide port scanning, passive DNS collection, and NetFlow data analysis, using regular expression searches to identify servers broadcasting carding-specific keywords like “CVV,” “Dumps,” and “Shop” across HTTP and HTTPS banners.

Researcher has shared a Scout query with customers to enable ongoing tracking of identified carding infrastructure, transforming network intelligence into a proactive tool for disrupting criminal operations globally.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyber Press as a Preferred Source in Google.