Carding Proxies: Residential vs Datacenter vs Mobile
A proxy is the IP your request leaves from. For carding, what matters is that it looks like a residential connection in the cardholder’s city, because that is the only version of the story the issuer’s risk engine believes.
Contents
The three types
| Type | Where it comes from | Verdict |
|---|---|---|
| Datacenter | Server ranges, AWS, Hetzner, OVH | Cheap, fast, recognised instantly. Fine for food, poor for retail. |
| Residential | Real consumer connections, often shared | The working standard. City-level targeting available. |
| Mobile | Carrier NAT, thousands of users per IP | Strongest signal, expensive, city granularity is poor. |
Mobile is the strongest because the issuer cannot distinguish you from any other subscriber behind the same carrier NAT. It is also four to six times the price, and the exit city can jump around mid-session, which breaks the geography anyway. Residential is the sensible default.
What the issuer actually scores
Distance between the IP and the billing address. ASN reputation. Whether the IP is on a hosting range. Whether it has been seen on many cards recently.
That last one is why shared residential pools degrade. If forty other carders have hammered the same exit in a week, it is burned regardless of its type. Rotating the pool every few weeks is not paranoia.
Matching rules
- City, not country. A state match is the floor, a city match is the target, and a metro-distance match is what gets accepted.
- Timezone identical. Adjust the profile to the proxy, never the other way round. An hour off is a flag on several issuers.
- One proxy per profile. Never rotate mid-session and never share a proxy between two identities.
- Sticky where possible. Session stickiness of at least 30 minutes, so the whole checkout happens from one IP.
Buy the card after the proxy, not before
Set the proxy and its city first, then filter Cardvenza to that city and buy a card that matches it. Doing it backwards is the single most common beginner error.
Checking a proxy before use
Load an IP geolocation lookup and confirm the city, the ASN and that it is not flagged as hosting. Then load a second checker. If the two disagree on the city, the pool is mislabelled and you should ask for a replacement.
Also test DNS and WebRTC leaks through the browser profile. A residential IP with a datacenter DNS resolver behind it is a contradiction the merchant can see.
Vendor traps
“Residential” pools that are quietly datacenter ranges relabelled. Pools with no city selector. Pools that rotate every request, which breaks the session. And vendors that sell the same IP block to everyone in a Telegram group.
Ask for a trial and check three IPs by hand before paying for anything. Related: anti-detect profiles, address matching, opsec.
