Reported by 1 outlet

Timeline

1. original reporting

   DoppelCart fraud network uses 119,000 fake shops to steal credit cards

   bleepingcomputer.com · 35d ago · September 8th, 2026

   A massive operation dubbed “DoppelCart” uses more than 119,000 domains to run a network of fake e-shops that steal payment card details. Most of the domains are in the .SHOP top-level domain, accounting for 2.72% of all sites on the TLD. German cybersecurity startup Nebty discovered DoppelCart and describes it as the largest publicly documented fake-shop cluster by domain count, far surpassing the second-largest, “ BogusBazaar ,” which operated a network of 75,000 sites that recorded an estimated 850,000 fraudulent transactions. The company's latest scans show that more than 105,000 DoppelCart shops are still active. Nebty CEO Benedikt Scheungraber told BleepingComputer that 96% of the shops confirmed to be part of DoppelCart share identical build files and resolve to 27 commerce backends. The sites impersonate legitimate businesses by copying product catalogs, descriptions, branding, and images, sometimes loading assets directly from the real company’s servers. Scheungraber says that the shops mimic 44,182 different brands, with a median of two clones for each. However, some brands like SodaStream, Velasca, CurrentBody, Daniel Wellington, Dreame, Horze, MOVA, and SPARK PAWS received more attention, with over 30 shops each. The fake sites advertise big discounts of up to 65% in many cases to lure bargain-hunting shoppers. One of the fraudulent DoppelCart shops Source: BleepingComputer When testing several checkout pages in the DoppelCart cluster, Nebty found code that collect

2. mentioned by www.bleepingcomputer.com

   DoppelCart: 119,000 coordinated fake e-commerce sites to collect credit card data. This is not an opportunistic attack

   www.bleepingcomputer.com · 35d ago · September 8th, 2026