Unveiled: 28 IPs and 85 Domains Powering Carding Markets

Summary Points

1. A recent investigation identified 28 IP addresses and 85 domains hosting sophisticated underground carding marketplaces, trading stolen credit card data from $5 to $150 depending on details like credit limits.
2. Researchers used internet-wide scanning of server banners on ports 80 and 443 to detect hosting infrastructure before it was obscured by protections like Cloudflare, revealing key server patterns and keywords such as “CVV” and “Dumps”.
3. The infrastructure analysis highlighted offshore hosting providers, predominantly Privex, operating in jurisdictions with lax regulations, facilitating the operation of multiple malicious activities beyond carding.
4. The stolen data is trafficked through layered methods, including web skimming, breaches, physical skimming devices, and is handled along a sophisticated supply chain for sale and cash conversion.

Problem Explained

A recent investigation has uncovered the complex technical infrastructure behind underground carding operations. Researchers identified 28 unique IP addresses and 85 domains actively hosting illicit marketplaces where stolen credit card details are bought and sold. These sites function like sophisticated e-commerce platforms for financial fraud, enabling criminals to trade stolen payment information for prices ranging from $5 to $150 per card. The discovery was made through internet-wide scans conducted from July to December 2025, which detected servers broadcasting carding-related keywords before they could hide behind protective services like Content Delivery Networks (CDNs). Notably, these servers often used domains ending in .su, .cc, and .ru, exploiting jurisdictional weaknesses. The investigation, reported by Team Cymru analysts, revealed that this infrastructure supports multiple criminal activities, including hacking, skimming, and data breaches, with hosting providers like Privex offering anonymous services that facilitate these illegal operations. This comprehensive analysis demonstrates how cybercriminals strategically establish and maintain their illicit marketplaces, making law enforcement efforts more challenging but also more targeted through detailed infrastructure mapping.

This investigation sheds light on why and how these illegal markets thrive. Criminals exploit lax registration policies and offshore jurisdictions, cleverly using certificate attributes and cloning techniques to evade detection. The analysis indicates that stolen data flows through a sophisticated supply chain, involving multiple stages from theft to sale. The findings, reported by cybersecurity researchers, provide critical insights into the technical backbone of these operations, enabling authorities to take precise action—such as subpoenas and takedowns—to dismantle these clandestine networks. Ultimately, this research highlights the importance of continuous monitoring and advanced scanning techniques in combating the ongoing threat of financial cybercrime.

Security Implications

The issue of 28 unique IP addresses and 85 domains hosting carding markets can seriously threaten any business. Such illicit activity often targets e-commerce platforms, stealing sensitive customer data and undermining trust. Consequently, your business could face financial losses, legal repercussions, and damage to its reputation. Furthermore, these unauthorized markets facilitate fraud, leading to increased security costs and resource diversion. As a result, your operations may slow down, and customer confidence diminishes. Ultimately, ignoring this threat leaves your company vulnerable to exploitation and long-term damage. Therefore, proactive monitoring and security measures are essential to prevent such risks from impacting your business.

Fix & Mitigation

Prompt response to cybersecurity threats is critical to prevent malicious activities from spreading and causing further harm. In the context of new research revealing 28 unique IP addresses and 85 domains hosting carding markets, swift intervention can mitigate financial theft, protect user data, and preserve organizational reputation.

Mitigation Steps

• Immediate Blocking: Block identified IP addresses and domains at firewall and network perimeter to prevent ongoing access.
• Threat Intelligence Utilization: Incorporate threat intelligence feeds to monitor and update blocking rules dynamically.
• Enhanced Monitoring: Increase network and user activity monitoring to detect suspicious behaviors associated with these threat vectors.
• Access Controls: Restrict access privileges to reduce the attack surface, ensuring that only authorized personnel can modify security settings.
• Archiving Evidence: Collect logs and evidence related to the identified domains and IP addresses for analysis and potential legal action.

Remediation Steps

• System Cleanup: Remove malicious scripts or files associated with the compromised domains from affected systems.
• Vulnerability Management: Conduct vulnerability scans to identify and fix weaknesses exploited by these markets.
• Patch Management: Regularly update and patch software, systems, and security tools to safeguard against exploitation.
• User Training: Educate staff about phishing and social engineering tactics used to lure users into unsafe sites.
• Incident Response: Activate incident response plans to investigate, contain, and recover from any breaches linked to these threats.
• Coordination: Work with external cybersecurity agencies and industry partners to share intelligence and coordinate countermeasures.

Explore More Security Insights

Stay informed on the latest Threat Intelligence and Cyberattacks.

Explore engineering-led approaches to digital security at IEEE Cybersecurity.

Disclaimer: The information provided may not always be accurate or up to date. Please do your own research, as the cybersecurity landscape evolves rapidly. Intended for secondary references purposes only.

Cyberattacks-V1cyberattack-v1-multisource