🗄️ Running and Hardening Your Own Dedicated Server 🗄️

[d0ctrine]

Why a Server is Your New Best Friend

As a carder, your number one priority is staying off the radar and as much as possible not having any concrete evidence against you in your device. That's where your own server comes in.
It's not just a tech toy - it's a fucking shield between you and the sites you're hitting.

Your own server gives you a crucial layer of separation. It's like having a fall guy that can't snitch. You don't even need to run everything through a proxy.
With some basic coding skills, you can use your server to handle repetitive tasks, optimize your workflow, and keep your real identity several steps removed from your operations.

In future episodes, we'll dive into the real meat of server operations - from automated carding to data scraping, hacking toolkits, and hosting your own dark web markets.
But first, let's break down why a personal server isn't just nice to have - it's fucking essential.

Think of your server as a digital fortress. It's not just about separation - it's about creating an impenetrable barrier between your real identity and your operations.
With your own server, you're not just automating tasks - you're scaling your operations to a whole new level.
Run multiple carding scripts simultaneously, orchestrate massive data breaches and data dissimenation, host card shops and darknet markets, or manage an army of botnets - all without breaking a sweat on your personal machine.

But here's where it gets really interesting: your server becomes a chameleon.

Need to pose as a legit business for a phishing campaign? Spin up a professional-looking website and host it in minutes.
Want to sell cvv without exposing yourself? Set up a hidden service in your server.
And when things get hot? Poof.

Your entire operation vanishes in seconds. No hrad drives to destroy, no local evidence. Just torch the server and disappear into the digital ether.

Your server isn't just a tool - it's your ticket to playing in the big leagues. It's the difference between being a small-time carder and running a sophisticated, optimized, untraceable operation.

Now, let's get into a provider that won't sell you out at the moment they see what sort of shit you're running:

Choosing Your Provider: OPSEC is King

When it comes to picking a hosting provider, forget about uptime guarantees and customer support. We're looking for the digital equivalent of a fortress. Here's what matters:

• Jurisdiction: Stay the fuck away from Five Eyes countries (US, UK, Canada, Australia, New Zealand) and their buddies.
  Look for countries that tell Western law enforcement to kick rocks. Make sure they are actually 'offshore'.
• Payment Methods: Crypto is king. Only signup with a card if you're carding the service itself, but carding these services mean you won't have a server once the chargeback happens, and they might actually sell you out since you've stolen from them.
  If you're planning a long-term operation, I do not suggest you cheap out and card them.
• KYC Requirements: The less they want to know about you, the better. Ideally, an email address should be enough - and make it a burner.
• Logging Policies: "We don't log shit" is what you want to hear. Be skeptical of anyone too eager to cooperate with authorities.
• Anonymous Sign-up: Providers that let you sign up over Tor are your best bet. It shows they understand the game, and they most likely have an actual market for carders and hackers.

Some good options I have personal experience with:

• Njalla: Based in Sweden. Accepts crypto, acts as a privacy shield between you and the VPS.
• RootLayer: Offers offshore hosting in Moldova. Accepts Bitcoin, no KYC.
• FlokiNET: Locations in Iceland, Romania, and Finland. Privacy-focused, accepts various cryptos.
• Shinjiru: Malaysian provider known for "bulletproof" hosting. High anonymity, but pricey.
• Virmach: US-based but accepts crypto with minimal info required. Use with caution.

Remember, no provider is 100% bulletproof.

Your OPSEC practices matter just as much as your choice of provider.

For demonstration purposes, we will be carding a VULTR server, as I'm a cheap fuck and I don't want to spend $$$ just to demo it for you. Don't be like me, lmao.

Start by signing-up for Vultr. Add your card and add funds. For Vultr specifically, make sure you don't put in prepaid cards as it will trigger the security block to restrict your account from adding more cards/funds.

Pick the server you plan to deploy. If you plan to use the server long-term make sure to pick a server not in Five Eyes countries.
Instead of doing password, we will be doing SSH, as it's more secure, impossible to bruteforce, and much more seamless to sign in with since you won't need to keep remembering passwords.

Setting Up SSH Keys:

For Windows:

1. Download and install PuTTY and PuTTYgen.
2. Open PuTTYgen and click "Generate".
3. Move your mouse randomly to generate entropy.
4. Save both the public and private keys.

For Mac/Linux:

1. Open Terminal.
2. Run: ssh-keygen -t ed25519 -C "[email protected]" You can use any email on this as it's not important.
3. Enter a strong passphrase (don't skip this step, it's crucial).

Once you've generated a key, you will get two parts: the private and the public key.
The public key is what you will use on any servers you will spin up. That public key is only unlockable by your private key, so make sure to keep your private key safe.

Now adding SSH keys before spinning up the servers depend on each provider. But for VULTR we have this:

Click the plus sign to add a new key.

Once you're done and you've successfully launched the server it will be available to access. go back to your dashboard and copy the server IP.

Connecting to Your Server

With your SSH keys set up and server launched, it's time to connect. Use a VPN or Tor to keep your real IP hidden.

Windows users, you'll need PuTTY. Enter your server's IP in the Host Name field. Go to SSH settings and point it to your private key file.
First-time connection will trigger a security alert - make sure the fingerprint matches before accepting.
You'll then need to enter your username (usually "root" for new servers) and your key's passphrase if you set one.

For Mac/Linux, it's simpler. Open Terminal and type:

ssh -i /path/to/your/private_key username@server_ip

Replace the path, username, and IP with your actual details. Verify the fingerprint on first connection. Enter your passphrase if you have one.
Once connected, you'll see the server's command line. You're now in your own secured server.

Hardening Your Server

Once you've got SSH access, it's time to lock that shit down:

1. Update and Upgrade:

sudo apt update && sudo apt upgrade -y

2. Install a firewall (UFW is easy):

sudo apt install ufw
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow ssh
sudo ufw enable

3. Install Fail2Ban to block brute-force attempts:

sudo apt install fail2ban
sudo systemctl enable fail2ban
sudo systemctl start fail2ban

4. Disable root login and password authentication:

Edit /etc/ssh/sshd_config:​

Then restart SSH: sudo systemctl restart sshd​

​

PermitRootLogin no
PasswordAuthentication no

5. Set up automatic security updates:

sudo apt install unattended-upgrades
sudo dpkg-reconfigure -plow unattended-upgrades

Now that you've got your server up and running, let's talk some basic OPSEC. T
his isn't just extra shit to do - it's what keeps your operation clean.

If you're planning to do some really illegal shit, never connect from your home IP when SSHing your server.
Either use VPN or TOR. This gives you another layer of protection should the hosting provider rat you out. If the provider offers full disk encryption, use it.
Remember to always keep your guard up even when dealing with your own server, as the moment you get lazy is when you get fucked.


Once you've followed everything so far and you've hardened your server properly, you're now free to do any shit you want with your server; and the possibilities are endless.
On my next writeup I'll guide you to running an undetectable Onion service website on your server. And in the future I'll more about what amazing things you can use the server to help your carding operation.
But that's for another day. See you.

 

[pimpolho]

Another suggestion: Could you talk about how darkweb sites work on the surface with complete security, such as the CrdPro, Cracked, Nulled, Doxbin, Darknetarmy, Crimemarket, Atmkings, StashPatrick site... It has the basic things like ideal hosts that you already commented on this post, but there is the part about traffic encryption, where to buy domains safely, which anti-whois to use, cleaning metadata from website files, which captcha to use, how to keep evidence away, etc.