{"id":377362,"date":"2026-09-09T10:16:00","date_gmt":"2026-09-09T17:16:00","guid":{"rendered":"https:\/\/cms-articles.softonic.io\/en\/?p=377362"},"modified":"2026-09-09T10:16:33","modified_gmt":"2026-09-09T17:16:33","slug":"doppelcart-now-spans-nearly-119000-fake-stores-checkout-pages-steal-card-data","status":"publish","type":"post","link":"https:\/\/cms-articles.softonic.io\/en\/doppelcart-now-spans-nearly-119000-fake-stores-checkout-pages-steal-card-data\/","title":{"rendered":"DoppelCart now spans nearly 119,000 fake stores: checkout pages steal card data"},"content":{"rendered":"

Security firm Nebty says it has documented DoppelCart, a fake-shop network<\/a> spread across 118,787 .shop domains<\/strong>. That works out to 2.72% of the .shop domains Nebty examined and, by Nebty\u2019s count, makes it the largest fake-shop network ever publicly documented by number of domains.<\/p>\n

\r\n
\r\n
\r\n
\r\n \"Avast\r\n <\/div>\r\n
\r\n Avast Free Antivirus<\/span>\r\n Download<\/a>\r\n <\/div>\r\n
\r\n <\/path><\/path><\/text><\/svg>\r\n <\/div>\r\n <\/div>\r\n
\r\n <\/span>\r\n <\/div>\r\n
\r\n \r\n <\/div>\r\n <\/a>\r\n <\/div>\r\n<\/div>\n\n\n\n

Nebty says the sites mimic 44,182 brands<\/strong> by copying product catalogs, logos, and images. In some cases, they even pull photos from the real retailers\u2019 own infrastructure. The median brand showed up twice in the network, while some were cloned more than 30 times.<\/p>\n\n

The technical overlap is hard to miss. Nebty researchers said 96%<\/strong> of the confirmed shops used identical build files and traced back to just 27 backends. On the payment side, the checkout pages are built to grab card numbers , expiration dates, CVVs, billing details, and even one-time bank codes through WebSockets.<\/p>\n\n

If you buy things online often<\/a>, this matters. Nebty says the operators lean on the usual trust signals, HTTPS, polished branding, and discounts as high as 65%<\/strong>, to get shoppers to drop their guard.<\/p>\n\n

By Nebty\u2019s estimate, DoppelCart is already larger than BogusBazaar, which was tied to roughly 75,000 sites<\/strong>. Add in reports of a 790% year-over-year jump in fake online store scams in Q1 2025, plus 80,000 fake stores spotted during the 2024 holiday season, and the pattern looks pretty clear: automation is speeding this up.<\/p>\n\n

So far, there\u2019s no public attribution<\/strong>, no statement from law enforcement, and no public response from the .shop registry, though some takedowns have worked. The practical advice is simple enough: check the URL carefully, be skeptical of ads and sponsored links, search the domain along with words like \u201cscam\u201d or \u201creviews,\u201d use payment methods that include buyer protection, and stop right away if a checkout you don\u2019t recognize asks for extra verification.<\/p>\n\n

Nebty\u2019s findings are available online.<\/p>","protected":false},"excerpt":{"rendered":"

Security firm Nebty says it has documented DoppelCart, a fake-shop network spread across 118,787 .shop domains. That works out to 2.72% of the .shop domains Nebty examined and, by Nebty\u2019s count, makes it the largest fake-shop network ever publicly documented by number of domains. Nebty says the sites mimic 44,182 brands by copying product catalogs, … Continue reading “DoppelCart now spans nearly 119,000 fake stores: checkout pages steal card data”<\/span><\/a><\/p>\n","protected":false},"author":9349,"featured_media":377361,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":"","wpcf-pageviews":0},"categories":[1015],"tags":[],"usertag":[],"vertical":[],"content-category":[],"class_list":["post-377362","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t