DoppelCart fraud network uses 119,000 fake shops to steal credit cards

A fraud operation called DoppelCart uses more than 119,000 domains to operate fake online shops that steal payment-card details. Most domains use the .SHOP top-level domain, representing 2.72% of all sites on that domain.

German cybersecurity startup Nebty describes DoppelCart as the largest publicly documented fake-shop cluster by domain count. Its scans found that more than 105,000 shops remain active. The company says 96% of confirmed DoppelCart shops share identical build files and resolve to 27 commerce backends.

• The shops copy product catalogs, descriptions, branding, and images from legitimate businesses.
• Nebty says they mimic 44,182 brands, with a median of two clones per brand. Some brands have more than 30 shops each.
• Discounts of up to 65% are used to attract shoppers. Checkout code sends cardholder data over WebSockets to a command-and-control (C2) system and can relay a bank-issued one-time confirmation code.

Benedikt Scheungraber, Nebty's CEO, told BleepingComputer that some sites display legitimate support addresses, directing victims to the impersonated companies. Nebty also created a searchable database to help companies identify DoppelCart impersonation and brand abuse.