How to find cardable sites

[Professor]

The Complete Research Manual 2026​

Bro, this is the foundation of everything. Finding cardable sites isn't about luck — it's about methodical research using publicly available tools. The difference between a beginner who burns 40 cards and a pro who lands shipments consistently is target selection.

This guide is a full manual with step-by-step workflows, tool comparisons, Google Dork libraries, red flags, advanced intelligence gathering, system setup, strategies, mistakes and fixes, risks, and a complete checklist.

PART 1: THE CORE PHILOSOPHY OF TARGET SELECTION​

1.1. The Goldilocks Principle​

The ideal target sits in the middle ground:

Business Size	Annual Revenue	Behavior	Verdict
Too Small	< $500K	Owner personally checks every order	Avoid — human review kills you
Medium	$500K – $50M	Automated checkout, weak fraud detection	TARGET
Too Large	> $50M	Industrial fraud systems (Forter, Riskified, Signifyd)	Avoid — instant flag

Traffic sweet spot: 5,000 – 50,000 visitors/month (check on Ahrefs or SimilarWeb)

1.2. The Ethical Line​

Don't card small mom-and-pop businesses. These are real people. One chargeback can destroy them. Target businesses large enough to absorb the hit.

This isn't just ethics — it's operational security. Small business owners personally review orders, call customers, and remember faces. You'll burn fast.

1.3. The Security Imbalance​

Most companies prioritize sales over security. They focus on getting customers through checkout, not preventing sophisticated attacks. Their mistake — your opportunity.

Why mid-tier businesses are vulnerable:

• They have enough revenue to accept your order
• They don't have enterprise fraud detection budgets
• They use default Shopify/WooCommerce security
• They often have guest checkout and weak address verification

PART 2: GOOGLE DORKS — THE FOUNDATION​

Google search operators are built into the search engine, not a black-hat secret. 99% of people are too lazy to learn them. That's your advantage.

2.1. Platform-Specific Dorks​

Shopify Sites:

inurl:myshopify.com "add to cart"

Brings up thousands of stores on Shopify. Many small businesses don't set up custom URLs.

WooCommerce Sites:

inurl:wp-content/plugins/woocommerce "checkout"

WordPress-based stores with often outdated plugins and weak security.

Magento Sites:

inurl:/checkout/onepage "add to cart" -site:amazon.com

BigCommerce Sites:

inurl:/cart.php "add to cart" "bigcommerce"

Wix Sites:

inurl:checkout "add to cart" "wix"

Squarespace Sites:

inurl:checkout "add to cart" "squarespace"

2.2. Product-Specific Dorks​

inurl:product "add to cart" "woocommerce" "luxury watches"

Replace "luxury watches" with whatever you're after. This narrows down sites selling specific products and reveals their platform.

Product categories to target:

Category	Liquidity	Why
Electronics	Very high	Easy to resell
Luxury watches	High	High value, easy to flip
Designer handbags	High	High value
Gift cards	Very high	Instant liquidity
Sneakers	High	Resale market
Gaming consoles	Very high	Always in demand
Drones	High	High value, compact

2.3. Stacking Dorks Like LEGO Bricks​

Add filters to exclude major marketplaces and focus on individual stores:

inurl:myshopify.com "add to cart" -site:amazon.com -site:ebay.com -site:walmart.com

2.4. Advanced Dork Library​

Goal	Dork
Find stores with weak security	inurl:checkout "no 3d secure"
Find stores using specific gateways	inurl:checkout "powered by braintree"
Find stores with guest checkout	inurl:checkout "guest checkout" "add to cart"
Find stores without OTP	inurl:checkout "credit card" -"3d secure" -"verified by visa"
Find stores selling electronics	inurlroduct "add to cart" "electronics" -site:amazon.com
Find stores selling gift cards	inurlroduct "gift card" "add to cart" -site:amazon.com
Find stores with weak AVS	inurl:checkout "shipping address" "billing address" -"verify"
Find stores with email change	inurl:faq "change email" "order"
Find stores with address change	inurl:faq "change shipping address" "order"
Find stores with PayPal Standard	inurl:checkout "paypal" "standard" "add to cart"

2.5. Dork Combinations for Maximum Efficiency​

Combo 1: Shopify + Guest Checkout + No 3DS

inurl:myshopify.com "add to cart" "guest checkout" -"3d secure"

Combo 2: WooCommerce + Electronics + No ID

inurl:wp-content/plugins/woocommerce "checkout" "electronics" -"id verification"

Combo 3: Any Platform + Gift Cards + Guest Checkout

inurl:checkout "gift card" "add to cart" "guest checkout" -site:amazon.com

PART 3: LOCAL TARGETING WITH GOOGLE MAPS​

3.1. The Location-Matching Strategy​

Step 1: Get a card with a BIN in a specific state (e.g., Florida)
Step 2: Set up a VPN or proxy matching that location
Step 3: Search Google Maps for:

• "boutique jewelry stores Florida"
• "designer handbags Tampa"
• "luxury watch dealers Miami"
• "electronics stores Orlando"
• "sneaker boutiques Jacksonville"

Why this works: Local businesses often have their own websites with minimal fraud protection. They're legitimate, have inventory, and can't afford enterprise security.

3.2. Traffic Verification​

Before targeting, check traffic on:

• Ahrefs (paid, but most accurate)
• SimilarWeb (free tier available)
• SEMrush (paid)

Ideal range: 5,000 – 50,000 visitors/month

Red flags:

• < 1,000 visitors → too small, owner reviews orders personally

• 100,000 visitors → likely has enterprise fraud detection

3.3. Local Business Red Flags​

Red Flag	Why Avoid
"Family owned since 1952"	Owner will personally review
Only 1-2 employees	Manual review likely
No online checkout	Can't card
Requires phone order	Too much social engineering
"We verify all orders"	Manual verification

PART 4: MINING EBAY AND AMAZON FOR TARGETS​

4.1. The Marketplace Goldmine​

Huge marketplaces are teeming with legitimate businesses that also maintain their own storefronts — which tend to have far weaker protections.

4.2. eBay Strategy​

Step 1: Look for sellers with professional business names, not personal usernames

• "LuxTimeWatches" — probably a real business
• "John_Sells_Stuff" — probably not

Step 2: Once you spot a professional seller:

• Google their company name + "official website"
• Check their eBay profile for direct links
• Many proudly advertise their own separate websites

Step 3: Analyze their independent site for weaknesses

4.3. Amazon Strategy​

Step 1: Look for "Sold by [Business Name]" underneath product listings
Step 2: Google that name to find their independent site
Step 3: These sites are often powered by Shopify with minimal security

4.4. Why This Works​

Independent sites are:

• Established enough to have inventory
• Not sophisticated enough to have robust fraud detection
• Often running on Shopify/WooCommerce with default security settings

[
HEADING=2]4.5. Advanced eBay/Amazon Tactics[/HEADING]
Tactic 1: Check "About" pages

• Many sellers link their own site in their profile
• Look for "Visit our website" or "Official store"

Tactic 2: Reverse image search

• Take product photos from eBay/Amazon
• Reverse image search on Google
• Find the original source (often a smaller site)

Tactic 3: Check business registries

• Search the business name on your state's Secretary of State website
• Find registered address, owner name, and sometimes website

PART 5: THE SHOP APP — SHOPIFY'S HIDDEN TREASURE​

5.1. What It Is​

Shopify's Shop app is a treasure trove of millions of Shopify sellers in a single searchable database.

5.2. The Key Insight​

Many people get order cancellations through the app itself, but they forget: every store listed there has its own direct Shopify website.

5.3. The Workflow​

1. Find a store you like in the Shop app
2. Visit its own storefront (not through the app)
3. You bypass the centralized security of Shopify's app
4. Same inventory, weaker security

Limitation: Doesn't work for very large stores (their main site has stronger security than the app). But for mid-tier merchants? Perfect.

5.4. AI Search Feature​

The app now has AI search — just describe what you want and it returns potential targets. Download from your app store or visit shop.app.

5.5. Shop App Advanced Tactics​

Tactic	How
Filter by category	Use AI search with specific product terms
Check store age	Newer stores have weaker security
Check reviews	Look for "no questions asked"
Check shipping policy	Flexible shipping = weaker fraud checks
Check return policy	Lenient returns = weaker verification

PART 6: REVIEW SITES AS SECURITY AUDITS​

6.1. The Reverse Strategy​

Use review aggregators like ResellerRatings.com for the wrong reason — instead of helping consumers find reputable sellers, you're looking for ones with security holes.

6.2. What to Look For​

Prime targets:

• 2-3 star ratings
• Minimal reviews
• Well-known enough to be listed
• Not sophisticated enough to have robust protection

6.3. Reading Reviews as Intelligence​

Reviews often tell you about verification methods:

Review Quote	What It Tells You
"This store keeps asking for my ID"	They do manual verification — avoid
"They changed my shipping address without question"	Weak address verification — target
"Order was cancelled for no reason"	Strong fraud detection — avoid
"Shipped same day, no questions asked"	Weak fraud detection — target
"They called me to verify"	Manual review — avoid
"They required a signature"	Harder to receive — avoid unless you have drop

​

6.4. Other Review Sites​

• Trustpilot
• SiteJabber
• BBB (Better Business Bureau)
• Google Reviews

The reviews themselves are security audits in plain text.

6.5. Advanced Review Mining​

Tactic 1: Search for specific phrases

• "no questions asked"
• "shipped immediately"
• "didn't verify"
• "guest checkout"

Tactic 2: Check review dates

• Recent reviews (last 3 months) = current security
• Old reviews = outdated info

Tactic 3: Look for patterns

• Multiple reviews mentioning "cancelled" = strong fraud detection
• Multiple reviews mentioning "easy checkout" = weak fraud detection

PART 7: TECHNICAL INTELLIGENCE TOOLS​

7.1. Tech Stack Detection​

Browser Extensions:

Tool	What It Shows	Cost
Wappalyzer	CMS, payment processor, security tools	Free
BuiltWith	Full tech stack, hosting, analytics	Free/Paid
WhatRuns	Frameworks, libraries, CDN	Free
Ghostery	Trackers, analytics	Free

7.2. How to Use This Intel​

Once you find a site that works well:

1. Analyze it with Wappalyzer/BuiltWith
2. Note the exact combination of technologies
3. Find other sites using the same combination
4. Similar tech stacks often have similar weaknesses

7.3. Traffic Analysis Tools​

Tool	Purpose	Cost
SimilarWeb	Traffic volume, sources, demographics	Free tier
SimilarSites	Find sites in the same category	Free
Ahrefs	Detailed traffic and SEO data	Paid
SEMrush	Competitor analysis	Paid
Alexa	Basic traffic ranking	Free (discontinued)

7.4. Advanced Paid Tools​

TheirStack — digs deep into each site and their platforms. Avoid sites that show:

• Signifyd
• Riskified
• Forter
• Kount
• Sift
• CyberSource
• Adyen

These are enterprise fraud detection tools. If you see them, move on.

7.5. Payment Gateway Detection​

Gateway	Security Level	Bypass Difficulty
Stripe	Medium	Medium
Braintree	Low	Easy
Authorize.net	Low	Easy
Square	Medium	Medium
Shopify Payments	Medium	Medium
PayPal Standard	Low	Easy
PayPal Express	Medium	Medium
2Checkout	Low	Easy

PART 8: RED FLAGS — SITES TO AVOID​

8.1. Immediate Disqualifiers​

Red Flag	Why Avoid
Signifyd / Riskified / Forter	Enterprise fraud detection
3D Secure enforced	OTP kills transactions
Email verification required	Can't use cardholder email
No guest checkout	Forces account creation
Require ID for orders	Manual verification
< 1,000 visitors/month	Owner personally reviews orders
> 100,000 visitors/month	Enterprise security likely
"We verify all orders"	Manual verification
"Signature required"	Harder to receive

8.2. Yellow Flags (Proceed with Caution)​

Yellow Flag	What to Do
2-3 star reviews	Test with small order first
Shopify platform	Check if app vs. main site
PayPal Express Checkout	Harder to change address
New site (launched < 1 year ago)	May have stricter fraud rules
Limited payment options	Fewer bypass opportunities
"Contact us for pricing"	Manual process

PART 9: TOOL COMPARISON TABLE​

Tool	Purpose	Cost	Priority
Google Dorks	Find targets	Free	Critical
Google Maps	Local targeting	Free	Critical
Wappalyzer	Tech stack detection	Free	Critical
BuiltWith	Tech stack detection	Free/Paid	High
SimilarWeb	Traffic analysis	Free tier	High
Shop App	Shopify target database	Free	High
ResellerRatings	Security audits via reviews	Free	High
Ahrefs	Detailed traffic data	Paid	Medium
TheirStack	Deep platform analysis	Paid	Medium
SimilarSites	Find similar sites	Free	Medium
Trustpilot	Review intelligence	Free	High
SiteJabber	Review intelligence	Free	High

PART 10: STEP-BY-STEP WORKFLOW​

Phase 1: Target Discovery (Day 1)​

1. Pick your product category (electronics, watches, gift cards)
2. Run Google Dorks for that category
3. Filter out major marketplaces (-site:amazon.com, etc.)
4. Compile a list of 20-30 potential targets

Phase 2: Initial Filtering (Day 1-2)​

For each target:

• □ Check traffic on SimilarWeb (5K-50K ideal)
• □ Check tech stack on Wappalyzer
• □ Check for Signifyd/Riskified/Forter
• □ Check if 3D Secure is enforced
• □ Check if guest checkout is available

Eliminate: Any site with enterprise fraud detection or 3DS

Phase 3: Deep Analysis (Day 2-3)​

For remaining targets:

• □ Read reviews on Trustpilot/ResellerRatings
• □ Check if email can be changed after order
• □ Check if address can be changed after order
• □ Check payment gateway (Stripe, Braintree, etc.)
• □ Test with $1-5 order (if possible)

Eliminate: Sites that require ID, have no guest checkout, or cancel small orders

Phase 4: Testing (Day 3-4)​

For top 5 targets:

• □ Place test order with small amount
• □ Monitor order status
• □ Check if it ships
• □ Document everything

Phase 5: Scaling (Day 5+)​

For successful targets:

• □ Place larger orders
• □ Find similar sites using same tech stack
• □ Build a personal database of working targets
• □ Repeat the process monthly

PART 11: COMPLETE CHECKLIST​

Target Qualification Checklist​

• □ Traffic: 5,000 – 50,000 visitors/month
• □ No Signifyd / Riskified / Forter / Kount / Sift
• □ No enforced 3D Secure
• □ Guest checkout available
• □ Email change possible after order
• □ Address change possible after order
• □ Reviews mention "no questions asked"
• □ Payment gateway: Stripe / Braintree / Authorize.net
• □ Platform: Shopify / WooCommerce / BigCommerce
• □ Not a mom-and-pop business

Before Carding Checklist​

• □ Card verified (GP/ValidCC)
• □ Proxy matches card region (IPQS > 80)
• □ Antidetect configured (WebRTC off, time matches)
• □ Billing = cardholder address
• □ Email = cardholder email (if possible)
• □ Test order placed and shipped

System Setup Checklist​

• □ Antidetect browser installed (Octo, Linken Sphere, Dolphin)
• □ Residential proxy configured (IPQS > 80)
• □ WebRTC disabled
• □ Timezone matches proxy location
• □ Language matches card region
• □ Canvas fingerprint randomized
• □ Cookies warmed (3-5 min on major sites)

PART 12: COMMON MISTAKES AND FIXES​

Mistake 1: Targeting Too Small​

Symptom: Order cancelled, owner calls cardholder
Fix: Use SimilarWeb to filter out sites < 5,000 visitors

Mistake 2: Targeting Too Large​

Symptom: Instant decline, account flagged
Fix: Avoid sites > 100,000 visitors or with enterprise fraud tools

Mistake 3: Ignoring Tech Stack​

Symptom: Repeated declines on similar sites
Fix: Use Wappalyzer to identify and avoid bad stacks

Mistake 4: Not Reading Reviews​

Symptom: Surprised by verification requests
Fix: Read Trustpilot/ResellerRatings before targeting

Mistake 5: Skipping Test Orders​

Symptom: Large orders cancelled
Fix: Always test with $1-5 first

Mistake 6: Using Same Target Repeatedly​

Symptom: Site catches on, blocks you
Fix: Rotate targets, wait 2-4 weeks before returning

Mistake 7: Ignoring Payment Gateway​

Symptom: Repeated declines
Fix: Check gateway with Wappalyzer, avoid high-security gateways

Mistake 8: Not Checking for 3DS​

Symptom: OTP request kills transaction
Fix: Test with $1, check for 3DS, avoid if present

PART 13: ADVANCED STRATEGIES​

13.1. The "Similar Sites" Strategy​

Once you find a working site:

1. Analyze its tech stack (Wappalyzer)
2. Find similar sites (SimilarSites, Google)
3. Test them with same setup
4. Build a portfolio of working targets

13.2. The "Niche Domination" Strategy​

Pick one niche (e.g., luxury watches):

1. Find 20-30 sites in that niche
2. Analyze all of them
3. Test top 5
4. Master that niche before moving on

13.3. The "Seasonal" Strategy​

Target seasonal businesses:

• Christmas: gift cards, electronics
• Black Friday: everything
• Summer: outdoor gear, travel
• Back to school: electronics, clothing

13.4. The "New Store" Strategy​

New Shopify stores (< 1 year old):

• Often have default security
• Eager to please customers
• Less sophisticated fraud detection
• Find them via Shop App, Google Dorks

PART 14: KEY TAKEAWAYS​

Bro, finding cardable sites is methodical research, not random luck.

The Formula:

1. Google Dorks → Find platforms (Shopify, WooCommerce)
2. Google Maps → Find local businesses by BIN location
3. eBay/Amazon → Find sellers with independent sites
4. Shop App → Find Shopify stores with weak app security
5. Review Sites → Read security audits in plain text
6. Wappalyzer/BuiltWith → Identify tech stacks and weaknesses
7. SimilarWeb → Verify traffic in Goldilocks zone

Golden Rules:

• Target the middle: not too small, not too large
• Avoid enterprise fraud detection (Signifyd, Riskified, Forter)
• Read reviews for verification intel
• Test with small orders first
• Rotate targets to avoid detection
• Don't card mom-and-pop businesses — target companies that can absorb the hit

The Core Truth:
Most companies prioritize sales over security. They focus on getting customers through checkout, not preventing sophisticated attacks. Their mistake — your opportunity.

Tools Summary:

Tool	Purpose	Priority
Google Dorks	Find targets	Critical
Google Maps	Local targeting	Critical
Wappalyzer	Tech stack	Critical
SimilarWeb	Traffic analysis	High
Shop App	Shopify database	High
ResellerRatings	Security audits	High
Trustpilot	Review intelligence	High
BuiltWith	Tech stack	High
Ahrefs	Traffic data	Medium
TheirStack	Deep analysis	Medium

Stay methodical, stay ethical, stay profitable. Good luck, bro.