The Soviet Ghost: How Carding Markets Survive on Legacy Domains

A new analysis by Team Cymru researchers sheds light on the infrastructure powering carding bands, showing a network that relies heavily on bulletproof offshore hosting and legacy domains from countries that no longer exist. Between July and December 2025, investigators traced digital footprints across 28 unique IP addresses and 85 domains hosting these illicit platforms, revealing a landscape where sites evade takedowns through jurisdictional shielding.

The study distinguishes two hubs: Markets, which function like e-commerce sites for stolen data, and Forums, where threat actors exchange techniques and promote so‑called bulletproof services. The value of stolen data varies, with a card fetching between $5 and $150, depending on credit limit, country of origin, and whether it comes with fullz.

Privex Inc. was identified as the ASN with the most IP addresses tied to carding markets, a hosting provider described as privacy‑minded infrastructure used by criminals to host illicit content with minimal customer information. The researchers note that identifying these servers early can aid law enforcement and financial institutions in disrupting the supply chain before data is cashed out.