Criminal actors are refining their playbook to evade detection online, and at the heart of this strategy is a sophisticated approach to using residential proxies for carding. These individuals no longer view residential IPs as a simple anonymity tool, but rather as one component of a broader identity-simulation stack. They’re now combining these proxies with other techniques designed to create convincing digital identities.
According to research by Flare, which analyzed over 2,800 unique underground posts across approximately 545 discussion threads, the use of residential proxies in carding has evolved significantly in recent years. Gone are the days when a proxy was considered “clean” simply because it belonged to a residential internet provider. Today, actors repeatedly describe a market in which proxy pools become overused, addresses accumulate poor reputations, location data is inaccurate, and financial services block entire ranges.
The research suggests that carders have become more selective in their choice of proxies, attempting to match IP geography with stolen identity data while combining proxies with antidetect browsers and other techniques designed to create a convincing digital identity. This is no longer just about selecting an IP in the same country as the stolen card, but rather about achieving geographic consistency down to city, ZIP code, time zone, browser language, and billing information.
The use of residential IPs is no longer considered sufficient on its own, and they’re frequently paired with antidetect browsers and fingerprint manipulation. This creates a more convincing digital identity that’s harder for financial services to detect as fraudulent. The market has even created a secondary market for supposedly “clean” residential IPs capable of reaching financial services.
The takeaway from this research is clear: defenders should no longer treat residential traffic as evidence that a user is legitimate. Instead, it should be viewed as context that requires further investigation. This shift in approach highlights the importance of moving beyond simple IP-based blocking and towards more sophisticated threat detection techniques.
Carders are refining their playbook to evade detection online, and we need to stay ahead of them. By understanding how they’re using residential proxies and other techniques designed to create convincing digital identities, we can uncover underground carding schemes and protect our financial services from these emerging threats.
Source: Bleeping Computer — 2026-07-17