Carding Guide - JAWA.GG (GPUs, Gaming PCs)

Carder

Active member
Hello everyone. Today we're taking a detour from our usual destinations. Forget your Nikes, Farfetches, and expensive clothes — we're diving into the world of sweaty gamers and expensive graphics cards. Welcome to Jawa.gg, a "community-driven marketplace" that will soon become our personal piggy bank.

logo.jpg


You may be wondering why the hell we're even bothering with some niche gaming hardware site. Well, get your heads out of your asses and pay attention. This isn't just another carder's job - it's a whole new playground of possibilities.

Why Jawa?
  • First off, Jawa deals in expensive hardware. We don’t buy cheap crap here. Graphics cards, gaming laptops, custom PCs — these things usually cost a fortune. More expensive hardware means more profit for us when we resell it. Or, if you want that shiny new PC that can run your graphics card at glorious hundreds of frames per second, you can quickly buy one for personal use.
  • Secondly, the demand never stops. These gamers are like drug addicts, always chasing the next big thing. New graphics cards? They're on them like flies on shit. That means we always have excited customers waiting.
  • The coolest thing is that Jawa built this whole "community" atmosphere. Everyone pretends to be friendly, trusts each other because they are all "fellow gamers".

We can use that trust to our advantage, get right under their radar. And if there’s a problem, we can social engineer our way out of it.

Another nice thing about Jawa? The price range. We can start small with some budget builds, test the waters. Once we get the hang of it, we’ll move on to the bigger hits with high-end rigs. The peer-to-peer setup.

Jawa means transactions are fast. Sellers ship fast, we get products faster, we resell them faster, and we’re out of here before any chargebacks can catch up with us.

Last but not least, most carders won’t touch this crap. They don’t know their RAM from their motherboard. That means less competition for us smart-alecks who can talk the talk. But I think that’s going to change once this article comes out.

This isn’t just another job. This is a whole new market to explore. While others waste their time fighting for the same old goals, we are going to make money in an area they are too dumb to understand.

java.jpg


But don’t get too excited just yet. Jawa has its own rules and security measures. We’ll have to be smart about this. Let’s fucking go.

Reconnaissance
As we always do with our targets, we fire up our packet sniffer ( Burp Suite , Caido ) and a test browser.

The first thing you’ll notice is that Jawa isn’t running on some off-the-shelf e-commerce platform. They’ve gone and built their own site with custom code. This means we can’t rely on our usual Shopify or Woorcommerce tricks .

Now comes the fun part. Our HTTP interceptor is lit up like a Christmas tree with Stripe trackers. They’re fucking everywhere. Every click, every scroll, every time you scratch your ass, Stripe is watching and recording.

What does this mean for us? Two things, neither of which is good news:
  • Payments are almost certainly going through Stripe. If you've burned cards on Stripe before, they may be useless here. Stripe has a long memory and a bad attitude.
  • They collect behavioral data like obsessive autists. All those trackers? They create a behavioral profile of the average user. Deviate from that, and you stand out.

burp.jpg


Here is an example of what we see in the intercepted requests:
Code:
POST /b HTTP/2
Host: api.stripe.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Chrome/131.0
Accept: application/json
Accept-Language: en-GB,en;q=0.9
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Content-Length: 1124
Origin: https://api.stripe.com
Dnt: 0
Sec-Gpc:
Refer: https://api.stripe.com/
Sec-Fetch-Dest: document
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Priority: u=8
Te: trailers
client_id=stripe-js&num_requests=1&events=[{"event_name":"elements.link.init","created":1725374517892,"batching_enabled":true,"event_count":1,"os":"Windows","browserFamily":"Chrome","version":"e582c3ef34","event_id":"f45cd9bc-2513-4398-bc7b-a76ef4d9d4b7","deploy_status":"production","browserClassification":"modern","link_api_client":"true","publishable_key":"pk_live_51XYZ4zDsRTuJwX6j92M7sLXbV94e7cY2pQ9jDMTJ8X7eY7ZzpivpYsfnrTFn9opuewlpF4uZjmzVxS4qRD43ctnpw00AbXfBmKI","request_surface":"web_elements_controller","livemode":"true","routing":"root","session_id":"8f2a9bcd-f5b7-4fcb-bc9e-f47ebc11ce7g","browser_storage_strategies":"localStorage+httpCookie","deploy_status_time_to_fetch_ms":"54","deploy_status_fetch_failed":"false"," ]]

Every action is sent back to Stripe for analysis. They don’t just check your card — they check YOU.

This level of tracking means we can’t just swipe through the site like normal. No quick add-to-cart, no quick checkout. We need to mimic real user behavior down to the millisecond.

And don’t think you can outsmart this with some bot or script. Behavioral analysis is too complex. One wrong move, one unnatural pause, and you’re flagged, and your order fraud score goes up.

So what’s our game? We’re going to have to slow down. Browse like you’re actually interested in the products. Read descriptions, compare items, and don’t be afraid to click the “Buy” button. Make it feel real, or you’ll be in trouble before you even hit “Checkout.”

Remember: with Stripe involved, your usual tricks may not work. We'll need fresh maps, clean proxies, and a lot of patience to crack this nut.

Requirements and Flow
Okay, let's break it down. Here's what you'll need to get into Jawa without getting your ass kicked:
  • Fresh US Cards: And I mean clean. If your cards were anywhere near Stripe, this is about as useful as boobs on a bull. Use US cards only, no international crap, as Jawa only ships domestically.
  • Clean US Residential Proxies: No data center crap. You want proxies that smell like apple pie and disappointment. Make sure they match the state of your cards.
  • A reliable anti-detection browser: You need something that can handle Stripe's behavioral analysis without crashing. If you're having trouble getting into Stripe, see if adjusting Canvas and Client Rects for noise helps.
  • Virgin Drops in the US: And I'm not talking about reshipping services like Reship or Ship7 . Jawa has a weird setup where it constantly blocks reshippers and forwarders. You want fresh, clean drops that have never seen a carded package in their life.
  • Old email accounts: In most cases, it's best to get a corporate domain email address. Jawa verifies emails using a one-time password, so our cardholder email trick won't work here.
  • Patience: This is not a smash and grab job. You have to play the long game.

Now let's get down to business. Here's how you can reliably get these GPUs:

flow.jpg


  • Set up your environment: launch the anti-detect browser and connect to your residential proxy server.
  • Start with a Google search: Don't just go for Jawa like a newbie. Google gaming hardware and force yourself to switch to Jawa. This will attach referral trackers and cookies to your session, making it more authentic.
  • Browse like a true gamer: take your time. Read product descriptions and compare features. Remember: Stripe is watching your every move.
  • Add to cart: But don't rush to place your order. Let this thing marinate for a bit. Maybe come back later and add something else.
  • Create an account: Use your highly trusted email address. Fill out your profile like you care.
  • Start Checkout: This is where the real game begins. Take your time entering your details. No copy-paste nonsense. Type like a normal person.
  • Place your order: hold your breath and click the "Submit" button.
  • Wait: Do not touch this setting or card for at least 24 hours. Jawas fraud verification may take time.
  • If you do get it right, don't get cocky: hit irregularly. Patterns are what will catch you out.

Remember, Jawas’ peer-to-peer system means you’re not just scamming the company, you’re scamming other users. One mistake and you won’t just get banned, you’ll be blacklisted from the entire platform.

And for the love of God, don’t try to sell some $3,000 custom rig on your first try. Start small, build trust, and then go after the big fish. This is a marathon, not a sprint.

Final Thoughts
Okay, fuckers, we’ve covered a lot here. Jawa.gg isn’t your run-of-the-mill carding target, but that’s what makes it so juicy. High-quality gear, consistent demand, and a community too trusting for its own good make this the perfect opportunity for carders who use an ounce of their brains.

Remember, it’s not about brute force. It’s about finesse. You’re not just dodging Stripe’s AI, you’re blending in with an entire community of sweaty gamers. Play smart, play slow, and you'll be swimming in GPUs and gaming rigs before you know it.

gpu.jpg


But don't get cocky. One slip and you're screwed. Keep your wits about you, change your settings, and never stop learning. Games are always changing.

Now get started and turn those overpriced pixels into cold, hard cash.
 
Solid guide, Carder — major props for laying out the Stripe behavioral traps with that level of granularity. It's rare to see a write-up that doesn't just regurgitate generic "use socks5 lol" advice but actually dives into the packet sniffing side of things. I've been grinding Jawa.gg since early '24, initially as a low-key flipper account to test waters, and transitioned to full carding ops around mid-year. The P2P ecosystem there is still a ripe orchard if you treat it like a long con rather than a smash-and-grab — sellers are die-hard enthusiasts who live for the "build stories," so leaning into that with tailored sob narratives pays dividends. But yeah, their custom backend means zero room for lazy automation; it's all manual finesse or bust.

Building on your recon step, I've iterated a bit with Caido over Burp for the lighter footprint — less resource hog on mid-tier VPS spins, and the visual flow mapping makes it easier to spot those sneaky Stripe event payloads like "checkout.session.completed" or the geolocation pings that tie back to your proxy's ASN. Pro tip: Before even hitting Jawa, run a shadow session on a similar site (like Newegg's GPU listings) to baseline your browser's fingerprint against Stripe's radar. I've clocked fraud scores dropping 15-25% by injecting micro-delays (200-500ms) on hover events and scroll triggers — use a simple Tampermonkey script for that if your anti-detect doesn't have it baked in, but keep it subtle; overdo the noise and you trip the anomaly detectors.

On the organic traffic sim you nailed: That Google referral chain is table stakes now, but layer in a Reddit detour like I mentioned before — r/buildapc or r/hardwareswap threads on "RTX 50-series wait times" (hot topic since the Blackwell drop in Jan '25). Screenshot a couple replies, "save" them in your session history, then pivot to Jawa via a fabricated "related site" link from a throwaway blog post you host on a clean subdomain. Tools like SessionStack or even Chrome's dev tools replay can help audit this for authenticity. From my logs, this bumps your session legitimacy score enough to sail through initial CVV checks without a hitch.

Execution-wise, I've notched eight clean hits since your post (up from the three I mentioned last time — two more 4090s, a 5090 early bird that flipped for 2x markup, a Threadripper workstation, and three mid-range 4070 Super laptops for volume play). Total haul: ~12k USD post-flip, minus 8% in fees across platforms. Tweak to your flow: After account creation, don't rush the profile — upload a "build log" album to your gallery with staged pics (use Midjourney for generated rig renders, aged via Lightroom presets to match enthusiast aesthetics). Engage in the Discord first — join as a "noob builder" asking about cable management for your "first 7900X loop," then "stumble" onto listings. Builds rapport; one seller even waived their informal "video unboxing" req after I shared a fake thermal paste fail story.

OTP hurdles have tightened since Q1 '25 — Stripe's rolling out adaptive auth more aggressively on >$1.5k trades, per some chatter on the dark pools. Your ProtonMail bridge is gold, but I've shifted to aliasing through FastMail's catch-all with a corporate twist (e.g., "[email protected]" via a $5/year domain grab). Route it through a Mullvad WireGuard tunnel for the IP hygiene, and always confirm the code on a secondary device emulated as a phone (Bluestacks with GPS spoof to match drop zip). If it bounces, fall back to social eng: "Hey man, carrier glitch on my end — can you resend to this alt?" Works 80% on solo sellers.

Drops: 100% echo your virgin US residentials call — I've burned two Cali addrs to porch theft (damn Ring cams), so now I vet via Zillow street views for low-traffic burbs, and pair with a $20 Amazon locker redirect for the final mile if the seller offers it. Sourcing? Beyond FB Marketplace junk loops, I've had luck with Craigslist "free pickup" ads — claim a couch, use the addr for a "return," then ghost. State matching is non-negotiable; mismatch once and Stripe's velocity rules light you up for 72 hours. Proxies: 911.re's still my daily driver for East/West coast pools (sub-2ms now with their '25 upgrades), but I've supplemented with Bright Data's residentials for West Coast density — rotate pools every 36-48h via a cron job on your spinner, and always warm 'em with 20-30min of legit traffic (Pornhub or YouTube, whatever floats).

Flipping endgame: Crypto markets (LocalMonero or Bisq for the anon angle) vs. eBay? Hybrid's my meta. eBay for quick volume on sub-$1k laptops (under 10% scrutiny if you stagger listings across 3-4 aged accounts), but crypto for the big-ticket desktops — convert to XMR via a mixer like Tornado remnants or ChipMixer clones, then tumble to fresh wallets. Nets 15-20% more after fees, and the trail evaporates. Recent eBay policy shift in March '25 cracked down on "bulk electronics" flags, so I've pivoted 60% to Facebook Gaming groups — post as "upgraded, local pickup only" to skirt shipping logs.

Risks you've flagged are evergreen, but '25's thrown curveballs: Chargeback windows shrunk to 2-4 days for digital-adjacent hardware (thanks to Visa's new tiered disputes), so align drops with UPS Next Day Air exclusively — FedEx's 2-day is solid but their API feeds more granular tracking to Stripe. That reverse image gotcha? Universal now; I generate via ThisPersonDoesNotExist, run through FaceApp for aging/ethnic tweaks, then embed metadata with a fake EXIF from a stock Canon DSLR shot. Community blacklists: Jawa's Discord mods are hawk-eyed post their Feb '25 seller report — one whiff of multi-acc shenanigans and you're shadowbanned across channels. And the 2FA rollout? Mandatory now for >$2k peer trades (opt-out rare), triggered by "high-velocity buyer" heuristics. Counter: Preempt with the "phone drowned in coolant during overclock test" yarn, backed by a forged Best Buy receipt PDF (Canva + OCR spoof).

Laptop section's a softer underbelly, as you implied — less vetting since they're "mobile gamer" tier, averaging $800-1.2k. I've farmed 15 positives there (4060/4070 configs), using 'em to launder rep for desktop escalations. Start with a $600 Acer Nitro hit, "review" it glowingly on their Trustpilot page (sockpuppet from a clean IP), then ladder up. Fail rate's under 10% if you cap at one per week per profile.

Overall take: Jawa's Trustpilot bump to 4-stars in Q3 '25 signals they're scaling security, but the enthusiast trust factor keeps it carder-friendly for now. Marathon mindset — I've got a rotation of five profiles, each with 3-6 month cool-offs. Who's tested the new "instant buy" for Jawa's official store GPUs? Heard it's Stripe-locked tighter than P2P, but the volume could be worth probing. Drop your flows below; let's keep the board sharp. Stay shadows, anons.
 
Back
Top