DoppelCart fraud network runs 119,000+ fake shops impersonating 44,182 brands to steal payment card details

German cybersecurity startup Nebty uncovered DoppelCart, the largest publicly documented fake-shop network by domain count: more than 119,000 domains (118,787 on .shop per one report) impersonating 44,182 brands, with checkout pages relaying card details and…

German cybersecurity startup Nebty has uncovered DoppelCart, described in both reports as the largest publicly documented fake-shop network by domain count. The network runs more than 119,000 fake e-commerce domains, mostly on the .SHOP TLD; the later report specifies 118,787 .shop domains, equal to 2.72% of the TLD population examined - a slight discrepancy in totals between the two reports. Over 105,000 shops remain active, impersonating 44,182 brands and advertising discounts of up to 65%. Fraudulent checkout pages connect to attacker-controlled C2 servers over WebSockets and relay card numbers, expiration dates, CVVs, cardholder names, contact/billing details and bank one-time confirmation codes in real time, potentially bypassing bank security controls and allowing criminals to complete payments while victims are still checking out. 96% of confirmed shops share identical build files and resolve to just 27 commerce backends. DoppelCart surpasses BogusBazaar, the previously largest documented fake-shop cluster, which had 75,000 sites and an estimated 850,000 fraudulent transactions. Some stores display the impersonated brand's real support address, sending victims to the impersonated company; SodaStream, Daniel Wellington and CurrentBody each have more than 30 clone shops. Nebty launched a searchable database to help brands detect DoppelCart impersonation and abuse.

• Nebty identified 118,787 .shop domains (2.72% of the TLD population examined); the other report describes the network as more than 119,000 domains, mostly on the .SHOP TLD - the largest publicly documented fake-shop network by domain count.
• 105,000+ shops remain active, impersonating 44,182 brands with advertised discounts of up to 65%.
• 96% of confirmed shops share identical build files and resolve to 27 commerce backends.
• Checkout code exfiltrates card numbers, expiration dates, CVVs, cardholder names, contact/billing details and bank one-time confirmation codes to attacker-controlled C2 servers over WebSockets in real time, potentially bypassing bank…
• DoppelCart surpasses BogusBazaar, the previously largest documented fake-shop cluster, with 75,000 sites and an estimated 850,000 fraudulent transactions.
• SodaStream, Daniel Wellington and CurrentBody each have more than 30 clone shops; some stores display the real brand's support address, sending victims to the impersonated company.
• Nebty launched a searchable database to help brands detect DoppelCart impersonation and abuse.