An overview of IP address masking methods in the context of carding

[Student]

Carding is a form of cybercrime in which criminals (carders) use stolen payment card data to commit fraudulent transactions. A key aspect of their activity is masking their IP address to evade detection by fraud detection systems of banks, payment processors (e.g., Visa, Mastercard, Stripe), and law enforcement. This is especially important during the card testing or card checking phase, when carders verify the validity of data through small purchases (often $1–5) on websites to avoid raising suspicion. Without IP masking, banks can quickly block accounts based on geolocation or traffic patterns.

For educational purposes, we will examine how these methods work, drawing on cybersecurity reports (e.g., from Stripe, NordVPN, Chainalysis, and Europol). I'd like to emphasize that such practices are illegal (in the US, under the CFAA), and studying them is useful for understanding the threats and protecting against them. I won't provide actionable instructions, but will focus on concepts and detection mechanisms.

Why IP masking is critical for carders​

An IP address is a unique identifier for a device on the internet, revealing its geolocation, provider, and activity history. Banks and stores use it for fraud detection: if a transaction originates from a country other than the card's billing address, it is flagged. Carders mask the IP address to:

• Simulate the location of the card owner (e.g. US IP for a US card).
• Avoid blocking by IP blacklists.
• Distribute tests across different IPs to avoid creating patterns (for example, 100 tests from one IP is a red flag).
• Protect yourself from traceback by law enforcement.

According to reports, 80–90% of fraud attacks involve IP masking, but modern systems detect it through device fingerprinting, behavioral analysis, and proxy piercing (technologies that penetrate masking).

Using proxy servers​

Proxies are intermediate servers that redirect traffic: requests originate from the proxy IP, not the actual user. Carders prefer them for their speed, flexibility, and the ability to rotate IP addresses. This allows for large-scale testing of cards without risk.

Types of proxies used in carding​

• HTTP/HTTPS proxies: For web traffic, suitable for sites with payment forms. They only mask HTTP requests but do not fully encrypt traffic.
• SOCKS5 proxies: Universal, supporting any protocol (TCP/UDP). Ideal for automated tools like bots or Python/Perl scripts. They allow you to emulate browsers and devices, making traffic appear "natural."
• Residential proxies: IP addresses from real home devices (often from botnets or volunteer networks). They appear to be regular users and are less likely to be blocked. They cost $0.01–$0.50 per IP address and are sold on the darknet or through services like Luminati (now Bright Data) or SocksEscort.
• Data-center proxies: Cheap IPs from cloud servers (AWS, DigitalOcean). Fast, but easily detected as "non-residential."
• Mobile proxies (4G/5G): IP addresses from cellular networks simulate mobile users. Useful for testing mobile websites.

How carders use proxies in testing​

1. Selection and configuration: Proxies are selected based on their geographic location (to match the map), speed, and "cleanliness" (not blacklisted). Configuration is done in browsers (extensions like FoxyProxy) or software (Burp Suite, AntiDetect browsers for fingerprint imitation).
2. IP rotation: Changed every 5-10 tests to avoid flags for "high frequency." Bots automate this, testing thousands of maps per hour.
3. Combination with bots: Carders use botnets (networks of infected devices) for distributed testing. This masks the volume of activity.
4. Behavior emulation: Proxies are combined with tools to change the MAC address, user agent, and fingerprint to make the traffic appear to be from a real user.

Efficiency and risks: Proxies speed up the process, but are detected through proxy piercing (header and latency analysis) or proxy databases (such as IPQS or Fraudlogix). According to reports, 70% of proxy fraud is blocked at the IP reputation level.

Using a VPN​

A VPN (Virtual Private Network) creates an encrypted tunnel, routing all traffic through a remote server. This provides complete IP masking and encryption, but is slower than a proxy.

Types of VPNs in Carding​

• Commercial VPNs: Services like ExpressVPN, NordVPN, or Mullvad. Servers in 100+ countries, OpenVPN/WireGuard protocols for speed and security.
• Dedicated or DIY VPNs: On VPS (Virtual Private Server) from providers like DigitalOcean. Full control, no logs.
• No-log VPN: No logs are kept to avoid subpoena (requests from authorities).

How carders use VPNs in testing​

1. Connection: Select a server in the desired country and connect via the client. Traffic is encrypted (AES-256), and the IP address is masked.
2. Kill-switch and chaining: Automatic disconnection when disconnected to prevent real IP leakage. Chaining — VPN chain (VPN1 → VPN2) for multi-layered masking.
3. Integration with other tools: VPN + proxy for double protection; or with Tor for anonymity (although Tor is slow for tests).
4. Automation: In bots, the VPN masks the source traffic while the proxies rotate the destination IPs.

Effectiveness and risks: VPNs protect against ISP eavesdropping, but known servers are blocked (for example, Netflix blocks VPN IPs). Detection is through leaks (WebRTC, DNS) or fingerprinting.

Proxy and VPN comparison​

Aspect	Proxy servers	VPN
Disguise	Selected traffic (flexible)	All traffic (full)
Encryption	Minimal or none	Full (AES-256)
Speed	Tall, suitable for bots	Lower due to overhead
Flexibility	IP rotation, geo-selection	Fixed servers, chaining
Price	0.01–1$/IP (in batches)	5–15$/month
Detection	Легче (proxy lists)	It's more difficult, but VPN IPs are blacklisted.
Application	Automated tests, bots	Manual sessions, basic protection
Risks	Headline leaks	Leaks during rupture, browser holes

From sources: Proxies are more often used for scale, VPNs for basic anonymity.

Advanced Techniques and Combinations​

• VPN + Proxy: Traffic through VPN, then proxy - double masking.
• Botnets and residential networks: Infected devices as proxies (e.g. MikroTik routers in botnets).
• Anti-detect tools: Browsers like Multilogin that change fingerprints (OS, screen, fonts).
• Fake Personas: Creating fake accounts with proxies for money laundering through gift cards.

How to prevent and detect​

Banks use:

• Proxy/VPN detection: Databases (IPQS, Fraudlogix) flag suspicious IPs.
• Behavioral analysis: Flags for fast tests, low amounts, abandoned carts.
• Multi-factor authentication (MFA) and tokenization: Reduce risks.
• Education: Users must monitor transactions and use virtual cards.

According to Verizon's DBIR 2023–2025, 80% of fraud is detected by signals other than IP. Carders are evolving, but security systems are ahead.

Conclusion​

Masking IP addresses through proxies and VPNs is the foundation of carding, allowing fraud to scale without immediate detection. However, this isn't a panacea: modern detection tools (like Arkose Labs or Stripe Radar) penetrate it, and law enforcement can track it through leaks. For educational purposes, this demonstrates the importance of cyber hygiene: use MFA, monitor accounts, and avoid suspicious websites. Such actions result in billions of dollars in losses annually and are punishable by law—it's better to invest in protection than in risk.