CARDING EMAIL INFRASTRUCTURE Domains • SMTP Warmup • Inbox Rotation • Verification • Automation
AUTHOR'S NOTE:Email is the backbone of carding operations. Every fullz verification, every drop account, every merchant account, every forum registration — it all starts with an email address.
Most carders use free email providers (Gmail, ProtonMail, Outlook). These work but they have limits: you can't create them at scale, they get banned, and they're easily traced.
The pros run their own email infrastructure. Custom domains, SMTP servers, auto-responders, and automated inbox management. This guide shows you how.
TABLE OF CONTENTS- 1.0 — Why Custom Email Infrastructure Matters
- 2.0 — Domain Strategy: How Many and What Kind
- 3.0 — Email Hosting: Self-Hosted vs Third-Party
- 4.0 — SMTP Warmup: Getting Your Emails Delivered
- 5.0 — Catch-All Configuration for Unlimited Addresses
- 6.0 — Automated Inbox Management (Python Script)
- 7.0 — Verification & Auto-Reply
- 8.0 — Cold Email for Carding Operations
- 9.0 — OpSec for Email Infrastructure
- 10.0 — Full Stack: Deploying Your Email System
1.0 — WHY CUSTOM EMAIL INFRASTRUCTURE
Free Email Problems:
| Provider | Max Accounts | Phone Verification | Ban Rate | Sending Limit |
| Gmail | 4 per phone | Required after 2 | 30-40% for bulk | 500/day |
| ProtonMail | 1 free, paid has limits | Optional but CAPTCHA | High for automation | 150/day free |
| Outlook | Unlimited (sort of) | CAPTCHA every 3rd | Very high (they hate automation) | 300/day |
| Yahoo | Unlimited | Phone required | Low but slow creation | 500/day |
With custom domains, you can create UNLIMITED email addresses with NO phone verification, NO bans (you control the server), and NO sending limits.What Custom Infrastructure Gives You:
- Catch-all addresses — receive email at ANY address @yourdomain.com
- Unlimited aliases — user+shopify@, user+amazon@, user+bank@ for tracking
- No creation limits — create 1000 addresses in 5 minutes
- Full control — you see every email, no one else
- Auto-reply — set up automated responses for verification
- Custom SMTP — send as many emails as your server can handle
- Burn domains — use a domain for 3 months, then abandon
2.0 — DOMAIN STRATEGY
Domain Tiers:
| Tier | Type | Examples | Cost | Use Case |
| Tier 1 | Generic-sounding .com | yourmailservice.com, quickinbox.net | $10-15/year | Primary carding email domain |
| Tier 2 | Simulated business | acmecorp.co, yourbusiness.io | $10-15/year | Fullz verification, bank emails |
| Tier 3 | Persona domains | johnsmith.tech, jane-dev.com | $8-12/year | Personal email for each persona |
| Tier 4 | Disposable catch-all | randomstring.xyz | $5-8/year | Short-term operations |
How to Choose a Domain:
- Avoid using your name, location, or anything linking to you
- Use WHOIS protection (included with most registrars)
- Pay with crypto if possible (Namecheap, Porkbun accept crypto)
- Register domains from a different IP than you'll use for hosting
- Don't register all domains at once — spread across 2-3 registrars
- Use .com, .net, .org, .io — avoid .xyz, .top, .ml free TLDs (high spam score)
- DNS history matters — check if the domain was previously used for spam (use mxtoolbox)
Free domains (.tk, .ml, .ga) are blacklisted by most banks and services. Don't use them for anything serious. They have 0 deliverability.3.0 — EMAIL HOSTING OPTIONS
Option A: Third-Party Email Hosting (Recommended for Beginners)
| Provider | Price | Mailboxes | Aliases | SMTP | Rating |
| MXRoute | $5-15/mo | Unlimited | Unlimited | Yes |  |
| ImproMX | $3/mo | 100 | Free | No SMTP | |
| Yandex 360 | Free | 1000 | Unlimited | Yes | |
| Zoho Mail | $1/mo | 5 | Limited | Yes | |
MXRoute is the gold standard for carding ops — they don't ask questions, accept crypto, have high deliverability, and support unlimited mailboxes and aliases.
Option B: Self-Hosted (Advanced)
Code:
Requirements:
- VPS (Linode $10/mo, Hetzner €4/mo, RackNerd $15/year)
- Ubuntu 22.04 or Debian 12
- 1GB+ RAM, 20GB+ storage
- Reverse DNS (rDNS) set up with your ISP
Software Stack:
- Mailcow (all-in-one, recommended): dockerized, web UI, all features
https://mailcow.github.io/mailcow-dockerized-docs/
- iRedMail (another option): simpler but less flexible
- Postfix + Dovecot (DIY): maximum control, maximum complexity
Installation (Mailcow, ~30 minutes):
1. Deploy VPS
2. Point your domain's MX record to the VPS IP
3. SSH in: wget -O setup.sh https://raw.githubusercontent.com/mailcow/mailcow-dockerized/master/install.sh
4. bash setup.sh
5. Follow prompts
6. Login to web admin at https://[VPS-IP]:8443
7. Create mailboxes, set up DKIM, SPF, DMARC
8. Done.DNS Records for Email Delivery:
Code:
Record Type | Name | Value
─────────────────────────────────────────────────────
MX | @ | mail.yourdomain.com (priority 10)
A | mail | [VPS IP]
TXT | @ | v=spf1 mx ~all
TXT | dkim._domainkey | v=DKIM1; k=rsa; p=[DKIM PUBLIC KEY]
TXT | _dmarc | v=DMARC1; p=quarantine; rua=mailto:admin@domain
─────────────────────────────────────────────────────
Check your setup: https://mxtoolbox.com/diagnostic.aspx4.0 — SMTP WARMUP
Fresh IPs and domains have zero email reputation. Send too many emails too fast and they'll all go to spam or be rejected.
Warmup Schedule:
Code:
Week 1: 10-20 emails/day (to known good inboxes that you control)
Week 2: 50-100 emails/day
Week 3: 200-500 emails/day
Week 4: 500-1,000 emails/day
Week 5+: Scale to desired volume
Total time to full capacity: 25-35 daysWarmup Automation Script:
Code:
# warmup_bot.py
import smtplib
import ssl
from email.mime.text import MIMEText
from email.mime.multipart import MIMEMultipart
import time
import random
import schedule
from typing import List
class SMTPWarmupBot:
"""Automated SMTP warmup with natural conversation simulation."""
def __init__(self, smtp_host, smtp_port, smtp_user, smtp_pass):
self.smtp_config = {
"host": smtp_host,
"port": smtp_port,
"user": smtp_user,
"pass": smtp_pass
}
self.warmup_targets = []
self.daily_count = 0
def add_target(self, email: str):
"""Add an inbox to send warmup emails to."""
self.warmup_targets.append(email)
def _send_email(self, to_addr: str, subject: str, body: str):
"""Send a single email."""
msg = MIMEMultipart("alternative")
msg["From"] = self.smtp_config["user"]
msg["To"] = to_addr
msg["Subject"] = subject
part = MIMEText(body, "plain")
msg.attach(part)
context = ssl.create_default_context()
with smtplib.SMTP(self.smtp_config["host"], self.smtp_config["port"]) as server:
server.starttls(context=context)
server.login(self.smtp_config["user"], self.smtp_config["pass"])
server.sendmail(self.smtp_config["user"], to_addr, msg.as_string())
self.daily_count += 1
def _generate_conversation(self) -> tuple:
"""Generate a natural email to build reply chains."""
templates = [
("Meeting follow-up", "Hey, thanks for the call earlier. I've reviewed the docs you sent and have a few questions. Are you free tomorrow?"),
("Quick question", "Hey, just following up on the proposal we discussed. Any updates on your end?"),
("Thanks", "Thanks for getting back to me. The information was really helpful. Let me know when you're available to discuss further."),
("Checking in", "Hi, just checking in on this. No rush, but wanted to see if there were any updates."),
("Documents attached", "Hi, I've attached the documents you requested. Let me know if you need anything else."),
("Re: your message", "Thanks for your email. I'll look into this and get back to you by end of week."),
("Invoice attached", "Please find attached invoice for last month's services. Let me know if you have questions."),
("Meeting reminder", "Reminder: we have a call scheduled for tomorrow at 2 PM. Let me know if that still works."),
("Follow-up", "Just following up on my previous email. Wanted to make sure you saw it."),
("Quick update", "Quick update on the project: we're on track for the deadline. Will share more details soon.")
]
return random.choice(templates)
def run_daily(self, target_count: int):
"""Execute the day's warmup emails."""
self.daily_count = 0
for i in range(target_count):
target = random.choice(self.warmup_targets)
subject, body = self._generate_conversation()
try:
self._send_email(target, subject, body)
print(f" ✓ Sent warmup email {i+1}/{target_count} to {target}")
except Exception as e:
print(f" ✗ Failed: {e}")
# Random delay between emails (2-8 minutes)
delay = random.uniform(120, 480)
time.sleep(delay)
return self.daily_count
# Usage
if __name__ == "__main__":
bot = SMTPWarmupBot(
smtp_host="mail.yourdomain.com",
smtp_port=587,
smtp_user="carding@yourdomain.com",
smtp_pass="your-password"
)
# Add your warmup targets
bot.add_target("backup-inbox-1@protonmail.com")
bot.add_target("backup-inbox-2@gmail.com")
bot.add_target("backup-inbox-3@outlook.com")
# Week 1: 15 emails/day
for day in range(7):
bot.run_daily(15)
print(f"Day {day+1} complete: {bot.daily_count} emails sent")
time.sleep(86400) # Wait 24 hours5.0 — CATCH-ALL CONFIGURATION
The most powerful feature of custom email: catch-all. Every email sent to ANY address @yourdomain.com arrives in your inbox.
What This Enables:
Code:
You sign up for a service with: cardshop@yourdomain.com
→ That email lands in your catch-all inbox.
→ No need to create the address beforehand.
→ If it starts getting spam, you block just that alias.
Plus (+) addressing:
→ user+shopify@yourdomain.com
→ user+amazon@yourdomain.com
→ user+bankofamerica@yourdomain.com
→ All arrive in user@yourdomain.com
→ You know exactly which service leaked/sold your emailSetting Up Catch-All in Mailcow:
Code:
1. Login to Mailcow admin
2. Go to Configuration → Mailboxes → Resources
3. Find your domain
4. Set "Catch-all mailbox" to your primary mailbox
5. Save
6. DONE — all @domain.com emails arrive in your inboxSetting Up Catch-All in MXRoute:
Code:
1. Login to MXRoute cPanel
2. Go to Mail → Forwarders
3. Create forwarder: @ → yourprimary@domain.com
4. Or contact support — they'll enable it in 5 minutes
5. DoneAlias Management (Python):
Code:
# alias_manager.py
import json
import random
import string
from typing import Dict, List
class AliasManager:
"""Manage email aliases for carding operations."""
def __init__(self, domain: str):
self.domain = domain
self.aliases = {} # {alias: purpose}
def generate_alias(self, purpose: str) -> str:
"""Generate a unique alias for a specific purpose."""
prefix = purpose.lower().replace(" ", "").replace("@", "")
random_suffix = ''.join(random.choices(string.ascii_lowercase + string.digits, k=6))
alias = f"{prefix}.{random_suffix}@{self.domain}"
self.aliases[alias] = purpose
return alias
def generate_plus_alias(self, base: str, tag: str) -> str:
"""Generate a plus-addressed alias."""
return f"{base}+{tag}@{self.domain}"
def get_aliases_by_purpose(self, purpose: str) -> List[str]:
"""Get all aliases for a given purpose."""
return [a for a, p in self.aliases.items() if p == purpose]
def save_to_file(self, path: str = "aliases.json"):
"""Save alias mapping to file."""
with open(path, "w") as f:
json.dump(self.aliases, f, indent=2)
def get_stats(self) -> Dict:
"""Get alias statistics."""
return {
"total": len(self.aliases),
"by_purpose": {
purpose: len([a for a, p in self.aliases.items() if p == purpose])
for purpose in set(self.aliases.values())
}
}
# Usage
if __name__ == "__main__":
am = AliasManager("carding-mail.net")
# Generate aliases for different operations
am.generate_alias("shopify-checkout")
am.generate_alias("amazon-account")
am.generate_alias("bank-drop-chase")
am.generate_alias("fullz-vendor-contact")
am.generate_alias("forum-registration")
print(am.get_stats())
# → {"total": 5, "by_purpose": {"shopify": 1, ...}}6.0 — AUTOMATED INBOX MANAGEMENT
Checking email manually for 50+ aliases is a waste of time. Automate it.
Code:
# inbox_manager.py
import imaplib
import email
from email.header import decode_header
import smtplib
import re
import time
import json
from typing import Dict, Optional, List
from datetime import datetime, timedelta
class InboxManager:
"""Automated email inbox monitoring and processing."""
def __init__(self, imap_host: str, imap_user: str, imap_pass: str):
self.imap_config = {
"host": imap_host,
"port": 993,
"user": imap_user,
"pass": imap_pass
}
self.connection = None
def connect(self):
"""Connect to IMAP server."""
self.connection = imaplib.IMAP4_SSL(self.imap_config["host"], self.imap_config["port"])
self.connection.login(self.imap_config["user"], self.imap_config["pass"])
self.connection.select("INBOX")
def disconnect(self):
if self.connection:
self.connection.close()
self.connection.logout()
def _decode_header(self, header_value) -> str:
"""Decode email header."""
decoded_parts = decode_header(header_value)
result = []
for part, encoding in decoded_parts:
if isinstance(part, bytes):
try:
result.append(part.decode(encoding or "utf-8", errors="ignore"))
except:
result.append(part.decode("utf-8", errors="ignore"))
else:
result.append(str(part))
return " ".join(result)
def _extract_verification_code(self, body: str) -> Optional[str]:
"""Extract verification codes from email body."""
patterns = [
r'(\d{4,8})[.\s]*(?:is|as|your)[.\s]*(?:verification|code|OTP|one.time)',
r'(?:verification|code|OTP|one.time)[.\s]*(?:is|:)\s*(\d{4,8})',
r'(\d{4,8})\s*(?:is your|is the)',
r'code[:\s]*(\d{4,8})',
r'OTP[:\s]*(\d{4,8})',
r'verification code[:\s]*(\d{4,8})'
]
for pattern in patterns:
match = re.search(pattern, body, re.IGNORECASE)
if match:
return match.group(1)
# Fallback: find any 5-8 digit number
numbers = re.findall(r'\b(\d{5,8})\b', body)
return numbers[0] if numbers else None
def _extract_links(self, body: str) -> List[str]:
"""Extract all links from email body."""
return re.findall(r'https?://[^\s<>"]+|www\.[^\s<>"]+', body)
def fetch_unread(self) -> List[Dict]:
"""Fetch all unread emails."""
if not self.connection:
self.connect()
emails = []
status, messages = self.connection.search(None, "UNSEEN")
if status != "OK":
return emails
for msg_id in messages[0].split():
status, msg_data = self.connection.fetch(msg_id, "(RFC822)")
if status != "OK":
continue
raw_email = msg_data[0][1]
msg = email.message_from_bytes(raw_email)
email_data = {
"id": msg_id.decode(),
"from": self._decode_header(msg.get("From", "")),
"to": self._decode_header(msg.get("To", "")),
"subject": self._decode_header(msg.get("Subject", "")),
"date": msg.get("Date", ""),
"body": "",
"verification_code": None,
"links": []
}
# Extract body
if msg.is_multipart():
for part in msg.walk():
if part.get_content_type() == "text/plain":
try:
email_data["body"] = part.get_payload(decode=True).decode(errors="ignore")
except:
pass
else:
try:
email_data["body"] = msg.get_payload(decode=True).decode(errors="ignore")
except:
pass
# Extract verification code
code = self._extract_verification_code(email_data["body"])
if code:
email_data["verification_code"] = code
# Extract links
email_data["links"] = self._extract_links(email_data["body"])
emails.append(email_data)
return emails
def wait_for_verification(self, timeout: int = 300,
poll_interval: int = 5) -> Optional[Dict]:
"""
Wait for a verification email to arrive.
Returns the email data with extracted code.
"""
start = time.time()
while time.time() - start < timeout:
emails = self.fetch_unread()
for email_data in emails:
if email_data["verification_code"]:
return email_data
time.sleep(poll_interval)
return None
# Usage
if __name__ == "__main__":
manager = InboxManager(
imap_host="mail.yourdomain.com",
imap_user="carding@yourdomain.com",
imap_pass="your-password"
)
# Check for new verification codes
result = manager.wait_for_verification(timeout=120)
if result:
print(f"✅ Code: {result['verification_code']}")
print(f"📧 From: {result['from']}")
print(f"📝 Subject: {result['subject']}")
else:
print("❌ No verification email received within timeout")7.0 — VERIFICATION & AUTO-REPLY
Some services require you to REPLY to a verification email or click a link. Automate this.
Code:
# auto_verify.py
import imaplib
import smtplib
import email
import re
import time
import requests
from typing import Optional
class AutoVerifier:
"""Automatically handle email verifications."""
def __init__(self, email_config: dict):
self.config = email_config
self.imap = None
self.smtp = None
def _connect_imap(self):
self.imap = imaplib.IMAP4_SSL(self.config["imap_host"], 993)
self.imap.login(self.config["email"], self.config["password"])
self.imap.select("INBOX")
def _connect_smtp(self):
self.smtp = smtplib.SMTP(self.config["smtp_host"], self.config["smtp_port"])
self.smtp.starttls()
self.smtp.login(self.config["email"], self.config["password"])
def click_verification_link(self, service: str, timeout: int = 180) -> bool:
"""
Wait for a verification email from a specific service,
extract the link, and click it.
"""
start = time.time()
while time.time() - start < timeout:
self._connect_imap()
status, messages = self.imap.search(None, "UNSEEN")
if status == "OK":
for msg_id in messages[0].split():
status, data = self.imap.fetch(msg_id, "(RFC822)")
if status != "OK":
continue
msg = email.message_from_bytes(data[0][1])
from_addr = msg["From"] or ""
subject = msg["Subject"] or ""
body = ""
if msg.is_multipart():
for part in msg.walk():
if part.get_content_type() == "text/plain":
body = part.get_payload(decode=True).decode(errors="ignore")
else:
body = msg.get_payload(decode=True).decode(errors="ignore")
# Check if this is from the target service
if service.lower() in from_addr.lower() or service.lower() in subject.lower():
# Extract and click verification link
links = re.findall(r'https?://[^\s<>"\']+', body)
verify_links = [l for l in links if any(k in l.lower()
for k in ["verify", "confirm", "activate", "validate"])]
if verify_links:
link = verify_links[0]
# Click the link
try:
resp = requests.get(link, timeout=15,
headers={"User-Agent": "Mozilla/5.0"})
if resp.status_code == 200:
return True
except:
pass
time.sleep(5)
return False
def send_reply(self, to_addr: str, subject: str, body: str):
"""Send a reply email (needed for some KYC verifications)."""
self._connect_smtp()
msg = email.mime.multipart.MIMEMultipart()
msg["From"] = self.config["email"]
msg["To"] = to_addr
msg["Subject"] = f"Re: {subject}"
msg.attach(email.mime.text.MIMEText(body, "plain"))
self.smtp.sendmail(self.config["email"], to_addr, msg.as_string())8.0 — COLD EMAIL FOR CARDING
Email isn't just for receiving verifications. It's also for outreach.
Carding-Related Cold Email Use Cases:
- Contacting store owners for wholesale pricing (using fullz persona)
- Social engineering Shopify support for merchant access
- Approaching liquidators for bulk deals
- Contacting freight forwarders for shipping arrangements
- Phishing campaigns (see Part 4: OpSec before attempting this)
Cold Email Template Library:
Code:
Subject: Wholesale Inquiry — Looking to Place Bulk Order
Hi [Store Name] team,
My name is [Fullz First Name] and I'm interested in placing a bulk order for your products. I'm a reseller based in [City] and I've been following your brand for a while.
I'm looking to purchase:
- [Quantity] of [Product 1]
- [Quantity] of [Product 2]
- [Quantity] of [Product 3]
Could you let me know if you offer wholesale pricing? My total order would be approximately $[Amount].
Happy to provide my business details and references. Looking forward to hearing from you.
Best,
[Fullz Name]
[Fullz Email]
[Fullz Phone]
Code:
Subject: Urgent: Unable to Process Refunds — Need Help
Hi Shopify Support,
I'm the owner of [Store Name] and I'm having an issue with refunds. Several of my customers are reporting that their refunds are failing to process. I've tried issuing refunds to the original cards but the transactions are being declined.
I need to refund these customers urgently as they're requesting chargebacks. Can you help me process these refunds to alternative cards?
The affected order IDs are:
[Order IDs]
I can provide the new card details for each refund if needed.
Please help as soon as possible.
Best,
[Fake Store Owner Name]
[Store URL]9.0 — OPSEC FOR EMAIL INFRASTRUCTURE
Critical OpSec Rules:
- NEVER access your email server from your home IP. Always use VPN/proxy.
- NEVER use the same email domain for carding and personal communication.
- NEVER set up email forwarding from your carding domain to your personal email.
- ALWAYS use different passwords for each mailbox (password manager).
- ALWAYS enable 2FA on your email server admin panel.
- ALWAYS monitor for unauthorized access (failed login attempts).
- Set up email aliases per-operation (one alias per service).
- Rotate domains every 6-12 months. Let them expire and register new ones.
- Pay for everything with crypto. Never associate a card or bank with your email infra.
- If a domain gets burned (blacklisted, reported), abandon it immediately.
The #1 OpSec mistake: accessing your carding email from the same device/IP as your personal email. Once you log into Gmail (personal) and then check your carding inbox, Google knows both are you. Don't cross the streams.10.0 — FULL STACK DEPLOYMENT
Complete Email Stack for Carding Operations:
Code:
┌─────────────────────────────────┐
│ Domain Registrar │
│ (Namecheap/Porkbun, crypto) │
└──────────────┬──────────────────┘
│ Nameservers
▼
┌─────────────────────────────────┐
│ Email Hosting Provider │
│ (MXRoute $15/mo OR self-host) │
└──────────────┬──────────────────┘
│ IMAP/SMTP
▼
┌─────────────────────────────────┐
│ Inbox Manager (Python) │
│ • Auto-fetch verification codes │
│ • Click verification links │
│ • Organize by alias/operation │
└──────────────┬──────────────────┘
│
┌────────────────────────┼────────────────────────┐
▼ ▼ ▼
┌──────────────┐ ┌──────────────┐ ┌──────────────┐
│ Fullz │ │ Drop Setup │ │ Merchant │
│ Verifications│ │ Emails │ │ Social Eng. │
└──────────────┘ └──────────────┘ └──────────────┘Quick Deploy Checklist:
Code:
□ Register 2-3 domains with WHOIS protection
□ Set up email hosting (MXRoute or self-host)
□ Configure DNS (MX, SPF, DKIM, DMARC)
□ Set up catch-all on primary domain
□ Generate 10+ aliases for different operations
□ Install Inbox Manager script on VPS
□ Test email deliverability (mail-tester.com)
□ Set up SMTP warmup bot
□ Configure auto-verification for common services
□ Document everything in encrypted notes
□ Set up monitoring (Telegram alerts on new emails)END OF EMAIL INFRASTRUCTURE GUIDE
Email is the backbone. Get this right and everything else becomes easier.
Get it wrong and you're leaving a trail of breadcrumbs to your front door.
Email is the backbone. Get this right and everything else becomes easier.
Get it wrong and you're leaving a trail of breadcrumbs to your front door.