Answer

Card testing log analysis is the review of payment authorization records and web server logs to find card testing: repeated low-value authorization attempts sent in a short window. The work produces counts, time series, and per-IP and per-ASN breakdowns. Analysts use those numbers to decide if a burst of declines is an attack or normal noise.

Log fields that matter

  • Timestamp with time zone, from a clock synced to NTP.
  • Amount and currency. Card testing uses small amounts, often under $1.
  • Response code and decline reason from the processor.
  • AVS and CVV result codes.
  • Card BIN and last four digits. Never the full PAN.
  • Client IP, ASN, and country.
  • User agent, device fingerprint, and session ID.
  • Email domain and account age, when a login precedes the attempt.

Patterns in the logs

  • Attempts per IP climb from single digits to hundreds within minutes.
  • One device fingerprint submits cards from many BINs.
  • Decline rate above 70 percent on the $0 to $1 bucket.
  • Sequential or near-sequential last-four values.
  • CVV mismatch codes repeat on the same IP with different PANs.
  • Traffic arrives from cloud ASNs and residential proxies in the same hour.
  • Bursts start between 01:00 and 05:00 local time for the merchant.

Metrics that separate noise from an attack

  • Authorization attempts per minute, split by IP, ASN, and BIN.
  • Decline rate by amount bucket.
  • Distinct cards per device fingerprint per hour.
  • Share of first-seen BINs in the last 24 hours.
  • Median time between attempts from one IP.

Retention and compliance

PCI DSS limits storage of sensitive authentication data. Do not keep CVV, CVC, or full track data after authorization. Store a keyed hash of the PAN and the last four digits. Set a retention window and delete raw gateway payloads at the end of it. Logs that hold full PANs expand PCI scope and raise breach cost.

Limits of the method

Authorization logs show what the processor returned, not intent. A high decline rate can come from a broken checkout form, an expired terminal, or a bad promotion. Compare the burst against the deploy log and the error tracker before you label it card testing.