Scammers rebuild fake shopping sites within hours of a takedown
Akamai says one retail scam used more than 1,200 look-alike .shop domains on one IP to harvest card data.
Akamai’s Fraud and Abuse Report 2026 describes retail and ticket scams that reuse kits, hosting and payment pages so replacement sites can return within hours of a takedown. Look-alike shops and fake hiring or app-marketplace lures collect card data, identity details or device access. Exposed passwords are tested across other services, and fake registrations are used for bonuses, card testing and stock hoarding.
Unconfirmed: Figures and campaign examples are Akamai’s classifications from its 2026 report, not independently confirmed incidents.
- One retail scam used more than 1,200 look-alike .shop domains on a single IP.
- In a July–August 2026 sample, 26.6% of logins were high or critical risk.
- Account verification requests were 40% of that high- or critical-risk login traffic.
- Akamai linked 8.3% of 2025 account-creation attempts to suspected fraud.
- SMS pumping uses registration or reset texts to premium-rate numbers.
Impact: Card data, identity details and reused passwords harvested for fraud
- Organizations
- Akamai
From the original article
2 min read at helpnetsecurity.com
One retail scam used more than 1,200 look-alike . shop domains sharing a single IP address. The sites reused HTML, JavaScript and payment-page designs intended to harvest card numbers, expiry dates and security codes, according Akamai’s Fraud and Abuse Report 2026.
By Anamarija Pogorelec · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.