DoppelCart now spans nearly 119,000 fake stores: checkout pages steal card data

Security firm Nebty says it has documented DoppelCart, a fake-shop network spread across 118,787 .shop domains. That works out to 2.72% of the .shop domains Nebty examined and, by Nebty’s count, makes it the largest fake-shop network ever publicly documented by number of domains.

Avast Free Antivirus Download

Nebty says the sites mimic 44,182 brands by copying product catalogs, logos, and images. In some cases, they even pull photos from the real retailers’ own infrastructure. The median brand showed up twice in the network, while some were cloned more than 30 times.

The technical overlap is hard to miss. Nebty researchers said 96% of the confirmed shops used identical build files and traced back to just 27 backends. On the payment side, the checkout pages are built to grab card numbers , expiration dates, CVVs, billing details, and even one-time bank codes through WebSockets.

If you buy things online often, this matters. Nebty says the operators lean on the usual trust signals, HTTPS, polished branding, and discounts as high as 65%, to get shoppers to drop their guard.

By Nebty’s estimate, DoppelCart is already larger than BogusBazaar, which was tied to roughly 75,000 sites. Add in reports of a 790% year-over-year jump in fake online store scams in Q1 2025, plus 80,000 fake stores spotted during the 2024 holiday season, and the pattern looks pretty clear: automation is speeding this up.

So far, there’s no public attribution, no statement from law enforcement, and no public response from the .shop registry, though some takedowns have worked. The practical advice is simple enough: check the URL carefully, be skeptical of ads and sponsored links, search the domain along with words like “scam” or “reviews,” use payment methods that include buyer protection, and stop right away if a checkout you don’t recognize asks for extra verification.

Nebty’s findings are available online.