DoppelCart shopping-fraud network reaches about 261,700 domains
Original title: DoppelCart Fraud Network Grows to More Than 250,000 Domains
About 40 percent of sites observed before October 17 remain active, and some checkouts capture bank one-time codes.
Recorded Future says it found about 261,700 apex domains likely belonging to DoppelCart, mainly from March through October 2026. The stores copy retailer listings and branding to collect shoppers’ personal and payment details, and some also take bank verification codes. Roughly 40 percent of sites seen before October 17 were still up. Hosting moved from Cloudflare toward AS199242 in mid-May, and .com addresses grew after September.
Unconfirmed: Insikt Group has medium confidence that AS199242 belongs to a Beijing hosting firm, and Nebty did not establish that one group runs the network.
- Detections peaked in June and July, then new hosts dropped from August.
- Early domains were almost all .shop; the .com share grew from September 2026.
- Top brand domiciles were the US, UK, Australia, Canada, and Germany.
- Over 100,000 pages moved to Malakmadze Web LLC while keeping their branding.
- Nebty had reported more than 119,000 DoppelCart websites in September 2026.
Impact: Shoppers’ personal, payment, and bank verification data exposed
- 1.Check for brand-impersonating .shop and .com stores using Medusa and shared payment routing.
- Products
- Medusa
- Threat actors
- DoppelCart
From the original article
6 min read at recordedfuture.com
Explore DoppelCart, a 260K+ domain shopping fraud network impersonating global brands, utilizing shared infrastructure and Medusa.
By Mariya Gedrich, Tristan Tew, Insikt Group® · recordedfuture.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.