THE SCIENCE OF CARDING: The Complete IP Quality Masterclass

[Professor]

The Definitive Carder's Guide to IP Reputation, Scoring, Evasion, and Infrastructure​

Bro, I dropped a topic that's actually worth reading twice. Most carders treat IP like a checkbox — "got a proxy, good to go." That mindset is exactly why they burn cards, accounts, and operations. This guide expands that file into a full technical masterclass: how IP scoring actually works, what metrics matter, how data-sharing networks operate, and how to build a system that keeps your IP clean across the entire internet ecosystem.

This is not a "5 Easy Steps" guide. This is a reprogramming manual for carders who want to think like engineers, not script kiddies.

CHAPTER 1: WHY YOUR IP IS THE QUEEN ON THE BOARD​

1.1. The Mental Shift​

Most carders think of IP as one factor among many. Wrong. Your IP is the first thing checked, the most heavily weighted, and the hardest to fix once burned. It touches every stage of the carding process.

Stage	What the IP Affects	Why It Matters
Initial Connection	AI systems size you up before you click	First impression = last impression
Browsing Behavior	Tracking pixels build a cross-site profile	Your history follows you
Checkout	IP reputation overrides other signals	Clean IP saves borderline cards
Post-Purchase	Triggers post-order audits	Order can be cancelled after confirmation

1.2. The Real-World Scenario​

You've got a fresh high-balance card. Your antidetect is configured perfectly. Your drop address is bulletproof. You hit checkout on a designer store.

Rejected.
The card wasn't the problem. The proxy wasn't "technically" broken. The IP reputation was the problem.

1.3. The Core Principle​

You may have a card so clean it squeaks, but if your IP is dirtier than a back-alley drug deal, you're done.

CHAPTER 2: THE INVISIBLE COURT — HOW WEBSITES EVALUATE YOUR IP​

2.1. The Real-Time Scoring Pipeline​

Every time you visit a website, this happens within milliseconds:

1. IP lookup against multiple reputation databases
2. Historical analysis — past sessions, fraud flags, chargebacks
3. Cross-site correlation — browsing patterns across the internet
4. Geolocation sequence check — does your location make sense?
5. Network reputation check — is your subnet flagged?
6. Device correlation — does your device match the IP profile?
7. Behavioral biometrics — do your actions look human?
8. Real-time fraud network query — has this IP hit any fraud system recently?
9. Velocity check — how many transactions from this IP recently?
10. Consistency scoring — do all signals align?

2.2. The Data-Sharing Networks (The Real Threat)​

This is the part most carders don't understand. Fraud data isn't siloed — it's shared in real time across the entire internet.

Network	What They Do	Impact on You
Emailage	Ties email addresses to fraud history	Burn an email = burn the IP
Ekata	Identity and risk scoring across platforms	Cross-platform IP correlation
Sift	Real-time fraud detection network	One chargeback = flagged network-wide
IPQualityScore	IP reputation data sold to merchants, processors, advertisers	Your shady actions last week block you this week
Proxyrack	IP data aggregation	Subnet-level reputation mapping
Spamhaus	Network abuse tracking	Datacenter IPs get instantly flagged
FraudScore	Fraud risk scoring	Proxy detection and abuse history
MaxMind	Geolocation and proxy detection	IP-to-location mapping
LexisNexis	Identity and fraud data	Cross-reference with public records
ThreatMetrix	Device and IP fingerprinting	Real-time session scoring

2.3. The Real-Time Update Reality​

These networks do NOT update daily. They update in real time:

• Burn an IP on one site → it becomes toxic across the entire internet within minutes
• Trigger a chargeback at an obscure electronics store → it comes back on an unrelated site later
• Use a static proxy for a failed Adyen transaction → your Stripe fraud score drops instantly

2.4. Cross-Platform Correlation​

Remember that static proxy you used for an Adyen transaction that ended in a chargeback? Don't be surprised if it suddenly crashes your Stripe transaction fraud score. These systems talk to each other.

2.5. The Shared Data Ecosystem​

Data Source	Shared With	Impact
Merchant A	Fraud network	Your IP flagged network-wide
Payment Processor	Merchant B	Your next attempt blocked
Bank	Fraud network	Your card flagged
ISP	Reputation databases	Your subnet flagged
Ad Network	Everyone	Your browsing history exposed

CHAPTER 3: WHAT MAKES OR BREAKS IP QUALITY​

Your IP score is a weighted average of multiple factors. No single factor kills you — but small issues pile up fast.

3.1. The Ten Factors​

Factor	Weight (Typical)	What It Measures
Geolocation Sequence	25%	Does your location make sense over time?
Usage Patterns	15%	How is this IP typically used?
Historical Behavior	30%	Past fraud flags, chargebacks, abuse
Network Reputation	20%	Is your subnet or ASN flagged?
Technical Details	5%	Browser headers, DNS leaks, WebRTC
Movement Patterns	5%	Rapid location changes = proxy
Device Correlation	5%	Does your device match the IP profile?
Behavioral Biometrics	5%	Cursor, typing, timing patterns
Context and Speed	5%	How fast are you moving through checkout?
Data Center vs. Residential	10%	Is this IP residential, mobile, or datacenter?

3.2. The Dynamic Scoring Problem​

These weights are not static. Machine learning models adjust weightings based on new fraud patterns.

What worked yesterday may kill you today.

3.3. The Accumulation Effect​

A small geolocation error can be ignored if everything else checks out. But:

• Small error + tainted subnet + fast checkout + shared device fingerprint = DOA

3.4. The Four Pillars of IP Quality​

Pillar	Components	How to Optimize
Cleanliness	Fraud score, abuse reports, blacklists	Use fresh IPs, avoid abuse
Consistency	Location, timezone, carrier, device	Match everything
Legitimacy	Residential/mobile, ISP reputation	Avoid datacenter
Behavior	Browsing patterns, transaction velocity	Act human

CHAPTER 4: PROXY TYPES — THE COMPLETE BREAKDOWN​

4.1. The Four Proxy Categories​

Type	Trust Level	Speed	Cost	Best For
Mobile (4G/5G)	10/10	Fast	$20-40/GB	High-value targets, banking apps
Residential (ISP)	8/10	Fast	$15-30/GB	Major retailers, luxury
Static Residential	7/10	Very Fast	$10-20/GB	Medium targets
Datacenter	2/10	Fastest	$2-5/GB	NEVER USE

4.2. Residential Proxies — Not Your Silver Bullet​

This is where most carders get burned. Residential proxies are not a blank slate.

Problem	Why It Matters
Tainted Pools	Shared IPs = you inherit every previous carder's mess
Active Scanning	IP quality assessors constantly hunt for proxy ranges
Unnatural Patterns	Rapid location changes scream "proxy"
Overuse	Popular services burn out fast
Quality Degradation	Even clean IPs turn to crap when heavily carded

4.3. The Proxy Provider Landscape (2026)​

Provider	Type	Reliability	Notes
Bright Data	Residential	High	Expensive, but cleaner
Oxylabs	Residential	High	Enterprise-grade
IPRoyal	Residential	Medium	Good for smaller ops
Smartproxy	Residential	Medium	Decent rotation
Soax	Residential	Medium	Popular, but heavily carded
S5 922	Residential	Medium	Shared pools, can be tainted
Faceless	Residential	Medium-High	Better rotation
MobileHop	Mobile	High	Best for mobile ops
LTESocks	Mobile	High	Good for mobile carding
NSocks	Mobile	High	Android/TCP
Doppelganger	Mobile	High	Windows/TCP

4.4. The Rule​

In this game, you are only as strong as your weakest link. One bad proxy can ruin your entire operation.

CHAPTER 5: TOOLS TO CHECK YOUR IP — GOLD OR TRASH​

5.1. Free Tools (Baseline)​

Tool	URL	What It Gives You
Scamalytics	scamalytics.com	Basic fraud score
IPQualityScore	ipqualityscore.com	Detailed fraud score + proxy detection
Whoer	whoer.net	Anonymity check, DNS leaks
BrowserLeaks	browserleaks.com	WebRTC, Canvas, WebGL leaks
AbuseIPDB	abuseipdb.com	Abuse reports for IP
IPVoid	ipvoid.com	Blacklist check
Spamhaus	spamhaus.org	Network abuse tracking
DNSLeakTest	dnsleaktest.com	DNS leak check
IPLeak	ipleak.net	Comprehensive leak check

5.2. Advanced Metrics (What the Pros Check)​

Metric	What It Means	Target
Fraud Score	Overall risk rating	< 20
Proxy/VPN Detection	Is IP flagged as proxy?	No
Tor Detection	Is IP flagged as Tor?	No
Bot Detection	Is IP flagged as bot?	No
Abuse Velocity	Recent abuse reports	0
Recent Abuse	Last 24h abuse	0
ISP Reputation	ISP trust level	High
ASN Reputation	Network trust level	High
Geolocation Consistency	Does IP match claimed location?	Yes
Timezone Match	Timezone matches IP	Yes
DNS Leak	DNS leaking real IP	No
WebRTC Leak	WebRTC leaking real IP	No
Connection Type	Residential/mobile/datacenter	Residential/Mobile
Hosting Detection	Is IP from hosting provider?	No

5.3. The Pro Tip​

If you want access to advanced metrics on IPQualityScore, don't pay. Just check the free version — it gives you 80% of what you need.

CHAPTER 6: STEP-BY-STEP IP QUALITY WORKFLOW​

6.1. Pre-Operation IP Check​

Step 1: Basic Check

1. Go to whoer.net
2. Verify anonymity is 90-100%
3. Verify no WebRTC/DNS leaks
4. Verify timezone matches IP

Step 2: Fraud Score Check

1. Go to ipqualityscore.com
2. Enter your IP
3. Check fraud score (< 20)
4. Check proxy/VPN/Tor detection (all should be "No")
5. Check recent abuse (should be 0)

Step 3: Blacklist Check

1. Go to abuseipdb.com
2. Check abuse reports
3. Go to ipvoid.com
4. Check blacklist status (should be clean)

Step 4: Subnet Check

1. Check if the /24 subnet is flagged
2. Check if the ASN is flagged
3. If either is flagged, do not use

Step 5: Consistency Check

1. Verify IP location matches billing address
2. Verify timezone matches cardholder timezone
3. Verify carrier matches IP (if mobile)
4. Verify device OS matches IP location

6.2. During-Operation IP Monitoring​

Critical: Your IP should not change during a session.

Check	Frequency	Action if Failed
IP consistency	Every 5 min	Abort session
DNS leak	Every 5 min	Abort session
WebRTC leak	Every 5 min	Abort session
Timezone match	Once	Fix before continuing
Fraud score	Every 30 min	Abort if > 40

6.3. Post-Operation IP Hygiene​

After each operation:

1. Rotate the IP — don't reuse for 24-48 hours
2. Log the IP — track what worked and what didn't
3. Check for flags — run fraud score again
4. Retire if flagged — if score > 40, discard
5. Check associated cards/emails — if IP burned, they may be flagged too

CHAPTER 7: STRATEGIES FOR IP QUALITY MANAGEMENT​

7.1. IP Rotation Strategy​

Strategy	When to Use	How Often
Per-Operation	High-value targets	Every order
Per-Session	Medium-value targets	Every session
Per-Day	Low-value targets	Daily
Per-Week	Aged accounts	Weekly

7.2. Proxy Type Selection​

Target Type	Recommended Proxy	Why
Major retailers (Amazon, Walmart)	Mobile (4G/5G)	Highest trust
Luxury brands	Residential (ISP)	Clean but not mobile
Digital goods	Residential	Less scrutiny
Banking apps	Mobile (matching carrier)	Must match device
Small shops	Residential	Lower bar
Gift cards	Mobile	High-trust needed
Subscription services	Residential	Lower risk

7.3. The Matching Principle​

Everything must match.

Element	Must Match
IP Location	Billing Address
IP Timezone	Cardholder Timezone
Carrier (if mobile)	IP Provider
Device OS	IP Location
Browser Language	IP Country
DNS Server	IP Provider
Screen Resolution	Device Type

7.4. The Burn Protocol​

If an IP gets flagged:

1. Stop using it immediately
2. Do not reuse it for 30+ days
3. Check all associated cards — they may be flagged too
4. Check all associated emails — they may be flagged too
5. Rotate to a new subnet
6. Log the burn — learn from it

7.5. The Rotation Matrix​

Operation Type	IP Reuse Window	Proxy Type
High-value ($1000+)	Never	Mobile
Medium-value ($200-999)	48 hours	Residential
Low-value (<$200)	24 hours	Residential
Aged accounts	7 days	Static Residential

CHAPTER 8: COMMON IP MISTAKES AND SOLUTIONS​

Mistake	Why It's Bad	Solution
Using datacenter proxies	All flagged instantly	Use residential or mobile
Using same IP for multiple cards	Cross-contamination	Rotate per operation
Ignoring timezone mismatch	Instant flag	Match timezone to IP
Not checking fraud score	Blind operation	Always check before use
Reusing burned IPs	Guaranteed failure	Retire flagged IPs
Using public proxy lists	All compromised	Buy from reputable providers
Ignoring subnet reputation	Even clean IPs can be tainted	Check ASN and /24
Fast location changes	Screams "proxy"	Keep location stable
Not matching carrier	Mobile mismatch = flag	Match carrier to IP
Ignoring DNS leaks	Exposes real IP	Use DNS leak protection
Using VPN + Proxy	Double leak risk	Use one or the other
Ignoring WebRTC	Exposes real IP	Disable or spoof WebRTC
Using same device fingerprint	Cross-contamination	Rotate fingerprints
Not logging IPs	No learning	Keep detailed logs
Ignoring post-purchase flags	Order cancelled later	Monitor post-purchase

CHAPTER 9: COMPLETE IP QUALITY CHECKLIST​

9.1. Pre-Operation​

• □ Proxy type matches target (mobile/residential)
• □ IP location matches billing address
• □ IP timezone matches cardholder timezone
• □ Carrier matches IP (if mobile)
• □ Fraud score < 20
• □ No proxy/VPN/Tor detection
• □ No recent abuse
• □ Subnet not flagged
• □ ASN not flagged
• □ DNS leak protection enabled
• □ WebRTC leak protection enabled
• □ Anonymity score 90-100%
• □ Connection type: residential/mobile
• □ Hosting detection: No

9.2. During Operation​

• □ IP remains consistent
• □ No DNS leaks
• □ No WebRTC leaks
• □ Timezone remains consistent
• □ No rapid location changes
• □ Fraud score stays < 40
• □ Session doesn't time out
• □ No error pages

9.3. Post-Operation​

• □ Log IP, result, and any flags
• □ Rotate IP for next operation
• □ Retire flagged IPs (score > 40)
• □ Check associated cards/emails if IP burned
• □ Verify order not cancelled
• □ Monitor for post-purchase flags

CHAPTER 10: KEY TAKEAWAYS​

1. IP is the queen. It affects every stage of the carding process.
2. Fraud data is shared in real time. One burn = flagged across the internet.
3. No single factor kills you. But small issues accumulate fast.
4. Residential proxies are not a silver bullet. They can be tainted, shared, and burned.
5. Always check your IP before use. Scamalytics and IPQualityScore are your baseline.
6. Match everything. IP location, timezone, carrier, device, language.
7. Rotate aggressively. Per-operation for high-value targets.
8. Retire burned IPs. Don't try to rehabilitate them.
9. Keep a log. Track what works and what doesn't.
10. The antifraud game never sleeps. Neither should your IP hygiene.

FINAL WORDS​

Bro, IP quality is the foundation of every successful carding operation. It's not glamorous. It's not exciting. But it's the difference between striking gold and getting slapped in the face by every antifraud system in existence.

The golden rules:

1. Check your IP before every operation
2. Match everything (location, timezone, carrier, device)
3. Rotate aggressively
4. Retire burned IPs
5. Keep a log
6. Stay paranoid

In the next guide, we'll go deeper — building your own IP quality checker, advanced subnet analysis, and cross-referencing fraud databases.

Until then, keep calm and keep your IP addresses clean.

APPENDIX: QUICK REFERENCE​

IP Quality Score Targets​

Metric	Good	Warning	Bad
Fraud Score	< 20	20-40	> 40
Anonymity	90-100%	70-89%	< 70%
Proxy Detection	No	Maybe	Yes
Tor Detection	No	No	Yes
Bot Detection	No	Maybe	Yes
Recent Abuse	0	1-2	3+
Abuse Velocity	0	1-2	3+
Subnet Flags	0	1	2+
ASN Flags	0	1	2+
Connection Type	Residential/Mobile	Static Residential	Datacenter
Hosting Detection	No	Maybe	Yes

Recommended Tools​

Tool	URL	Purpose
Scamalytics	scamalytics.com	Basic fraud score
IPQualityScore	ipqualityscore.com	Detailed fraud score
Whoer	whoer.net	Anonymity check
BrowserLeaks	browserleaks.com	Fingerprint leaks
AbuseIPDB	abuseipdb.com	Abuse reports
IPVoid	ipvoid.com	Blacklist check
Spamhaus	spamhaus.org	Network abuse
DNSLeakTest	dnsleaktest.com	DNS leak check
IPLeak	ipleak.net	Comprehensive leak check
MaxMind	maxmind.com	Geolocation check

Proxy Provider Quick Reference​

Provider	Type	Best For
Bright Data	Residential	High-value targets
Oxylabs	Residential	Enterprise
IPRoyal	Residential	Small-medium ops
Smartproxy	Residential	General use
MobileHop	Mobile	Mobile carding
LTESocks	Mobile	Mobile carding
NSocks	Mobile	Android/TCP
Doppelganger	Mobile	Windows/TCP
Soax	Residential	Budget option
Faceless	Residential	Good rotation

The Matching Matrix​

Element	Must Match
IP Location	Billing Address
IP Timezone	Cardholder Timezone
Carrier (if mobile)	IP Provider
Device OS	IP Location
Browser Language	IP Country
DNS Server	IP Provider
Screen Resolution	Device Type
Browser Fingerprint	Device Model

Good luck, brother. Keep your IPs clean, keep your operations alive.