The Soviet Ghost: How Carding Markets Survive on Legacy Domains

Team Cymru’s analysis maps the infrastructure behind carding markets and forums, using internet-wide port scanning and passive DNS to surface 28 IPs and 85 domains before they are obscured by CDNs. The report highlights heavy use of jurisdiction-shielding TLDs (.su, .cc, .ru) and privacy-focused hosting (e.g., Privex) that enable resilient, bulletproof operations, and it outlines the carding supply chain from data theft to monetization. The insights are intended to support early evidence collection and disruption efforts by law enforcement and financial institutions.