Team Cymru Identifies 28 IPs Linked to Carding Markets and Forums

Jan 9, 2026 · Original article ↗

Summary

Team Cymru says its July–December 2025 analysis identified 28 IP addresses and 85 domains hosting carding markets or forums, using scans, passive DNS, certificate data and NetFlow. It cautions that not all identified sites were confirmed operational.

Key points

Team Cymru analyzed carding infrastructure observed between July and December 2025 using internet-wide scans, passive DNS and NetFlow.
The researchers identified 28 IP addresses hosting carding-market login pages or forum landing pages, and 85 related domains.
They searched HTTP and HTTPS page titles on ports 80 and 443 for carding-related terms and used X.509 certificate attributes to cluster infrastructure.
The analysis aimed to identify origin servers before CDN obfuscation; NetFlow was used to link related infrastructure.
The most common top-level domains were .su, .cc and .ru; Privex had the most identified IP addresses among the hosting ASNs.
Team Cymru cautions that website cloning can make some identified infrastructure appear to be carding sites when it is not confirmed to be operational.

Article Details

Attack Vectors: Malicious JavaScript injected into compromised e-commerce checkout pages to capture payment-card details.
Phishing emails and websites used to trick people into disclosing card data.
Stolen card data sold through carding markets and forums, then used for unauthorized purchases or donations.
Physical skimming devices and hidden cameras used at ATMs, gas pumps, and POS terminals to capture card data and PINs.
Defensive Notes: Use internet-wide port scanning, passive DNS, and NetFlow analysis to identify and link carding infrastructure.
Search HTTP and HTTPS title banners on ports 80 and 443 for carding-related terms, and cluster infrastructure using reused X.509 certificate attributes.
Capture origin-server identity and host IP addresses during initial configuration, before CDN obfuscation can conceal them.
Treat identified IP addresses cautiously: the article notes that website cloning can make some appear to be carding markets or forums without confirming they are operational.
Team Cymru says customers can use its Scout query to search for the carding infrastructure identified in the research.

Indicators of compromise

Type	Indicator	Context
SHA1	`222d7ce22a5623c52ddb34edfa89d5fafb58bc3a`	HTTP banner hash included in Team Cymru's Scout query for searching carding infrastructure.
SHA1	`2814dfe95d0db67dded7993656e5c348be0b698e`	HTTP banner hash included in Team Cymru's Scout query for searching carding infrastructure.
SHA1	`306fb5c433fb6d8a3cfb2682a6c97c5caefece13`	HTTP banner hash included in Team Cymru's Scout query for searching carding infrastructure.
SHA1	`414d89c6165c9321f073e1872525c2c9dd11f56e`	HTTP banner hash included in Team Cymru's Scout query for searching carding infrastructure.
SHA1	`4ddb778eb8cae951c674cdca38c1951078743009`	HTTP banner hash included in Team Cymru's Scout query for searching carding infrastructure.
SHA1	`519d8dcc491c794f6d6b3c7aaca4cf5c0dbf1319`	HTTP banner hash included in Team Cymru's Scout query for searching carding infrastructure.
SHA1	`52b51f30a61d66a00e825a6a351d521d910429cd`	HTTP banner hash included in Team Cymru's Scout query for searching carding infrastructure.
SHA1	`546c3d522c939a1f6ff38300eb82c0111130d1c7`	HTTP banner hash included in Team Cymru's Scout query for searching carding infrastructure.
SHA1	`557a61eaf0a978e0546ad66a7308aab09465156e`	HTTP banner hash included in Team Cymru's Scout query for searching carding infrastructure.
SHA1	`5c180d7ee7049d85e567cd6400c62e0ce6629306`	HTTP banner hash included in Team Cymru's Scout query for searching carding infrastructure.
SHA1	`661a5c6a1638b83c25f49cda99f2f809043d83bd`	HTTP banner hash included in Team Cymru's Scout query for searching carding infrastructure.
SHA1	`75e35902080e3030b88e4fc8f0c8023deaeed97a`	HTTP banner hash included in Team Cymru's Scout query for searching carding infrastructure.
SHA1	`7ae9e4fa48d05f7850f147e2c371fcac47b70889`	HTTP banner hash included in Team Cymru's Scout query for searching carding infrastructure.
SHA1	`880ba96eb15fd0dbe56f7e6cf777ce8afd665567`	HTTP banner hash included in Team Cymru's Scout query for searching carding infrastructure.
SHA1	`bb6a55ae8aa6ad73f1e5c70c5b533a15562ed454`	HTTP banner hash included in Team Cymru's Scout query for searching carding infrastructure.
SHA1	`c4ce8db9c180f2a4e7261e477439b96f458691d4`	HTTP banner hash included in Team Cymru's Scout query for searching carding infrastructure.
SHA1	`ccdf2f73e80b0d45b089789b82901c8a81120194`	HTTP banner hash included in Team Cymru's Scout query for searching carding infrastructure.
SHA1	`d288cc42b2eec356e4eaef941b4987641d6456ac`	HTTP banner hash included in Team Cymru's Scout query for searching carding infrastructure.
SHA1	`d3501d9dbf31b4611ee56594840f9d02bd81b18f`	HTTP banner hash included in Team Cymru's Scout query for searching carding infrastructure.
SHA1	`d7a32dee1077ae97481009512a903c5e41c5306b`	HTTP banner hash included in Team Cymru's Scout query for searching carding infrastructure.
SHA1	`deccc5aa3fc147adadaa4b34a93c76bcbe2574f2`	HTTP banner hash included in Team Cymru's Scout query for searching carding infrastructure.
SHA1	`f1e3c64bfdf7f38837f891a4583543cdef305080`	HTTP banner hash included in Team Cymru's Scout query for searching carding infrastructure.
SHA1	`f72326d36842da941efb3b07450833b86d3eab0d`	HTTP banner hash included in Team Cymru's Scout query for searching carding infrastructure.
SHA1	`fd1ec39e084966961b23fff7ae12fecd95f05ea6`	HTTP banner hash included in Team Cymru's Scout query for searching carding infrastructure.
SHA1	`fe41569db860e4dc9808b7b2097a8b7e8bac436b`	HTTP banner hash included in Team Cymru's Scout query for searching carding infrastructure.