Millions of fake online stores linked to DoppelCart could harvest shoppers' payment data
Cybersecurity firm Nebty identified about 119,000 domains operating under the DoppelCart fake-shop network, which mimics real brands and steals checkout information, including one-time bank codes.
Nebty’s latest investigation uncovered an extensive fake-shop cluster called DoppelCart, linking about 119,000 domains, the majority of which are.shop addresses. Researchers found that 96 % of confirmed sites share identical build files and point to 27 common commerce backends, allowing them to replicate the look and product listings of 44,182 different brands. Discounts advertised can reach 65 %, enticing shoppers to proceed to checkout where malicious code harvests full payment details and one-time bank verification codes via WebSockets.
Victims may also be redirected to bogus customer-service pages that display the legitimate company’s contact information, causing confusion and complaints for the real brand. Nebty attempted to contact the primary hosting provider for these sites but received no response, and the.shop registry did not comment. The firm advises consumers to verify URLs, scrutinize extreme discounts, and use credit-card protections when shopping online.
Why it matters
Consumers risk having their payment and personal data stolen by sophisticated fake stores that look like real retailers.
In this story
