Disclaimer: This article is written strictly for educational, research, and cybersecurity awareness purposes. The author does not condone, encourage, or promote any illegal activities, including financial fraud or carding. All information and screenshots were gathered from open and publicly accessible sources to analyze threat vectors and improve defensive security mechanisms.

Short version: zdmarket.at under ZeroDay Market is not a forum curiosity. It is a ready-made supermarket for other people's data on the clear web. The storefront is built around trading in other people's payment data and add-ons.

Shops with this kind of storefront are common across the web. They share the same core: cards and data around them, geo and bank filters, dated bases, auto-delivery and a forum for show. Addresses and names change, the layout repeats: catalog, search, piece goods, lookups, documents and related services.

ZeroDay is interesting as a typical example. It does not hide in onion, it lives on a regular domain and shows counters, news and statuses. Below is structure plus defense takeaways.

Why do markets like this keep growing?

The rise is not random. It mirrors a shift from amateur carding to scalable data operations:

  • Fresh, structured data. Unlike noisy Telegram channels and old dumps - constantly refreshed batches, searchable, split by base and ready to use.

  • Low entry barrier. Simple signup and $1-5 tags make goods available even to rookies. A dollar for Fullz (complete sets of personally identifiable information, including SSN and DOB) is mass market now.

  • Direct seller-to-buyer sales. No middlemen and waiting. Faster deals, higher turnover.

  • Filters built for targeting. BIN, bank, geo, ZIP, bundle makeup from email to SSN and IP. Precise matching to victim and antifraud.

Freshness, cheapness, speed and precision - that combo makes ZeroDay dangerous.

Storefront

Header like any regular shop: ZERO DAY, Catalog, Cards, Fullz, Orders, Support, Wallet, Forum. Bottom: a footer with Navigation, a links column to related forums, Platform with Online status, user counter and crypto rates. Read the user count as the shop's own claim - there is no way to verify it from outside, and shadow darkmarkets always paint their numbers flattering.

Homepage news is routine upkeep of a live shop: forum launch, maintenance done, sales back again, card upload fixed. Cybercrime moved out of the back alleys into neat storefronts like this long ago, and ZeroDay is a typical specimen: a tidy interface with other people's data traded inside.

Catalog

All categories runs two screens: banking, CC Fullz, BINs, crypto, databases, mail, FTP/SMTP, Full info, hosting, ID Creator, Lookup/BG, phones, then RDP, docs, SSH, Tax, Utility Bills, VCC, VoIP. Core is cards and Fullz; around them - recon, docs, cashout and fuel. That lineup is no accident: it is the full cycle of a shadow darkmarket, where the same hands first steal the data, then recon the owners, set up drops and cash out. A catalog this wide means the place works the entire cybercrime chain at once instead of trading one thing.


Inside a category there are its own subcategories: 221 items across all shops at once, filters by popularity, category, shop and price. The rows are almost all USA Full info SSN+DOB in different bundles: DL, ACN, RTN, Employer, SIN, ZIP. Prices from $1, counters in the thousands and tens of thousands. That cheapness lies: every row is a real person whose data already leaked and now sells wholesale. The buyer sees a dollar item; on the other end there are someone else's loans, fake tax returns and months of bank disputes.

Cards

Standart claims 27 million cards - read that as search scope, not live stock: counters in places like this are always padded. BIN, geo, bank, exp, base and price filters plus bundle checkboxes from name to SSN are a constructor for shaping a card so antifraud stays quiet. Rows at $1.75 from banks in several countries are old stock, but old still works for small test charges and account linkups. Regular is smaller on the counter, around 18 thousand at capture, but meaner: EXTRA tags Email/Phone/Address, shop-tied bases with dates. Rows at $5 from big US banks are fresh drops, hence dearer. A fresh card is usually a live one, and every such supply wave turns into fraudulent charges on other people's accounts a couple weeks later. That is how cybercrime turns stolen bases into cash.

Top Bases

Essence 4,637, Ember 63, Solar 3,515, Amber 83, Ash, Ocean, Romeo near 3k, Nova. Geos US, IT, CA, FR, EC, GB, AU. Codenames OPTION, HUMBLE near 8.5k, BIRD, BURDEN, LOCAL near 8.5k and more. One base equals one supply drop: name, date, count, geos. Buyers stalk fresh, sellers exploit it by jacking up prices on new drops. The scheme is simple and cynical: the newer the leak, the better the chance the owner has not blocked the card yet. So every such storefront drags a trail of victims who learn about it from their statements.

Fullz: search and storefront

Fullz Database is precise search, not storage: first and last name, state, city, ZIP, age, DL, base; Has SSN, DOB, MMN, DL, Phone, Email, Account, Routing, Credit Report flags and more. An empty “No fullz found” reply is normal: the filter targets a specific person. It looks like a service, but in substance it is a targeting tool - dossier first, then a call “from the bank” in the victim's own language. The people whose data lands here are usually the last to know.


And this is the USA Full info SSN+DOB+DL+ACN+RTN storefront: 70 rows in a NAME/CITY/STATE/ZIP/DOB/PRICE table, Buy and +Cart buttons, $2-3 tags. The category header carries refund terms: returns only for invalid data - the shop warranties the “quality” of other people's lives. A full US profile costs less than coffee, yet it can do thousands in damage: loans, tax refunds, accounts. Cheap Fullz creates longer problems than a pricey card - a card gets reissued in a day, while an SSN plus DOB stays with a person for years.

Piece-goods feed

NON VBV and NON MSC $6-85, CC FULLZ $25, DL LOOKUP $10, CR/CS LOOK $15, SITES+BIN $110, TRONADDR and BTC addresses $120, BTC OSINT $145, POLYBOT $190, USA-189PCS $350. And strikingly cheap: USA FULL INFO $1, SSN $3, IP+FULL $4. Data is collected at scale, profit comes from turnover: it does not matter that an item costs a dollar - thousands of sales make a grown-up cash register. Anyone buying this for a dollar becomes the end of that chain, not an outside observer: using other people's data is the same cybercrime, just from someone else's computer.

Databases: whole dumps

The Databases filter returns 26 results: Ukrainian Databases, DATABASE USA, Canada Ontario, AU, crypto leads, Yahoo, Stripe Merchant 2026, Finland, Singapore and more. Prices $20-900, each item piece goods of 1-4 copies. These are no longer single rows but whole dumps: buy the base and take it apart yourself. For victims this is the worst scenario: data scatters across hands and pops up in dozens of places at once. One leak turns into years of spam, “bank security” calls and loan applications. Shops and services whose bases shine here end up answering to customers for phishing in their name.

Real document: templates and selfies

The Real document branch holds 58 items: DL & ID Templates at $10, Passport Templates at $18, ID CARD + SELFIES at $10, driver license with selfie at $10, passport with selfie at $9, USA DL & ID at $20, utility-bill bundles at $25, bank card templates, EU licenses at $20-30, Tax Forms at $15, USA PASSPORT at $10. Plus UKR REAL DOCS and SSN sets. All of it serves one purpose: tying another person's card to a “new identity” to slip past automated KYC. The lesson for people is simple and unpleasant: a selfie with your ID sent through an SMS link ends up in catalogs like this. Documents cannot be reissued like a card - a passport leak echoes for years.

Lookup/BG: recon

The Lookup/BG storefront: SSN+DOB Lookup (31 items), DL lookup (17), CR/CS lookup (9), BG+SSN+DOB (13), each with a View button. Below, Reviews with scores and dates - the shop's reputation. The description lists Full info, SSN+DOB, DL, documents and passports by country. Recon like this is usually priced in tens of dollars per check; here it is cheaper at $10-15. Same play as collectors in reverse: dossier first, strike second, so they can talk to a bank in the victim's language. The service is cheap, conveyor-grade and works against regular people - which is exactly why demand holds.

Cashout and fuel, briefly

NON VBV and NON MSC pitched as easier without 3-D Secure, work through banking, VCC, drops, Apple Pay over NFC threads and wallet.dat. A separate hook is non-VBV BIN selections: issuers and shops without 3DS land in these lists first, and such selections hit where verification is weaker. Fuel is RDP, proxies, SMTP, mail bases, VoIP: hacked servers, geo-matched proxies, mailers and numbers for bank-impersonation calls. I will not detail how that gets used - that crosses into how-to territory. The mechanics is enough to grasp: this whole infrastructure exists for one thing, reaching other people's money before the owner comes around.

Autoescrow: automatic deal guarantor

Escrow Deals are guarantor-backed trades: a list at 10, 123 and 232 USD, Not Confirmed and Confirmed statuses, Buyer and Seller roles, a Create New Escrow button. Each deal lives on a timeline with start and deadline dates. The guarantor here is not nobility but business: trust is the currency of the shadow darkmarket, without it turnover stalls. The platform takes its cut from every deal, so it is vitally interested in brisk trade.


A deal card: $10 amount, 5% service fee, $10.50 total for the buyer, USD currency, Timeline, Description, Cancel Deal and Deal ID. All proper, like a regular marketplace - except the goods are stolen. Funny and sad at once: cybercrime now has its own UX, support and deal guarantor. That is exactly what hooks newcomers - it feels “fair”, forgetting there is no fairness between accomplices: rips and exits are business as usual here.

Wallet: how it is topped up

Top Up Balance takes BTC, LTC, TRX, USDT TRC20 and USDT ERC20. Invoices History shows 15 invoices from $10 to $50, Expired and Completed statuses, creation and expiry dates. Crypto only - bank chargebacks do not exist here by design, and that is the flip side of “convenience”. There is nowhere to dispute, nobody to complain to - money leaves for good in both directions. Incidentally, that is why such platforms' wallets are a favorite target for analysts: whole networks get unraveled along top-up chains.

Forum

Community Forum: 10 threads, 16 posts, 9 categories. Announcements, Rules, empty Support, Escrow, Bug Bounty, then live: Cards 5/12, Full Info, Bank Drops, Crypto. Empty disputes and escrow with a live sales feed is normal for a young market-attached forum: fights run through tickets while the forum warms up. Activity sits exactly where the money is - cards, Fullz, cashout. The forum here is no hobby club but a trust storefront: reviews, disputes and “verified” sellers exist to make the newcomer open his wallet sooner.

So what, and what to do

For regular cardholders: your data there is a couple-dollar row tagged with bank and state. Then small test charges, then big ones, plus spam and bank-impersonation calls. For Americans separately: SSN plus DOB plus DL means tax fraud, fake refunds, loans - sums the victim sometimes learns about years later. Separate low-limit online card, 3DS on, push for every charge, email on a unique password with app 2FA, credit freeze where available, weekly statement checks. Do not send SSN, ID photos or selfies with documents over messengers and SMS links - only inside the bank app.

For banks and shops: non-VBV BIN lists are a direct signal who gets hit first. Fresh 5-8k bases mean a chargeback wave in weeks. Ignoring that is negligence by now: if your BIN shines in non-VBV selections, you are attacked first. For companies: bases, SMTP and cPanel showing up in such places mean phishing in your name. You answer either way.

How not to get burned, and how to stay ahead

The first marker of such storefronts is fake respectability: counters, reviews, guarantor, support. It is all tinsel: reviews get padded, the guarantor belongs to the same platform, and “sellers” routinely ask for top-ups bypassing escrow - the classic rip. The second marker is clones: popular shops have dozens of phishing doubles that clean out the carders themselves. Ironic, but telling: in the shadow darkmarket even their own get robbed.

Staying ahead takes ordinary hygiene: read cybersecurity news, check your email in breach-search services, switch on bank alerts for every transaction, and never follow links from SMS. Three things to know: crypto payments are irreversible, purchased data never leaves circulation, and any involvement - from buying “out of curiosity” to reselling - is complicity with real prison terms. Curiosity costs more here than it seems.

Defense takeaways

ZeroDay is not a unique project. It is a tuned conveyor: filters, dated bases, auto-delivery, deal guarantor, forum for show. Dollar Fullz, whole dumps, ten-dollar recon, selfie docs and work through drops and crypto - a standard set for storefronts of this type. These sites are not one-offs: shut one down and the selections move to the next with the same sellers and bases. So treat it soberly: not as exotic, but as background risk of digital life. The meaning of the model is easy to read: some list other people's cards at five dollars, others offer SSNs at three, others take it apart. Such a setup runs on the use of other people's data, not on its own product. The sensible response is do not use such places, do not promote them, and if data leaked, replace cards and report. Forewarned is forearmed. For defenders, the key takeaways are: treat any appearance of your BINs in non-VBV selections as an early-warning indicator and prioritize 3DS and step-up authentication on those routes; feed fresh base names, vendor handles and wallet top-up patterns into fraud monitoring and share them with industry peers and law enforcement; and rehearse the victim-notification and card-reissue playbook in advance, because the window between a fresh base drop and a mass cashout wave is measured in days. Keep redacted records of what you observe in public sources - screenshots with personal data removed, base names, price shifts - so the next analyst can track the same actors across mirrors.