The 119,000 fake shops quietly stealing shoppers' card details
A German security firm says 'DoppelCart' is now the largest fake-store network ever documented, cloning real brands and skimming payment data live at checkout.
Key points
- Researchers at German security startup Nebty have named a fake-shop network called DoppelCart that runs across more than 119,000 web addresses.
- Around 105,000 of those fake stores are still online, and most sit on the .SHOP domain ending, making up 2.72% of all sites there.
- The sites impersonate 44,182 real brands, with SodaStream, Daniel Wellington and CurrentBody among those cloned more than 30 times each.
- Checkout pages siphon card numbers, security codes, addresses and even the one-time code sent by the shopper's bank, sending it to the criminals in real time.
- DoppelCart is now larger than the previous record holder, BogusBazaar, which ran 75,000 sites and clocked an estimated 850,000 fraudulent transactions.
A sprawling fake-shop operation is impersonating tens of thousands of real brands to hoover up shoppers' card details, and it is bigger than anything researchers have catalogued before.
The network, nicknamed DoppelCart, was discovered by German cybersecurity startup Nebty and first reported by BleepingComputer. It runs on more than 119,000 web addresses. Most end in .SHOP, and DoppelCart alone accounts for 2.72% of every site using that domain ending.
Around 105,000 of the fake stores were still live at Nebty's most recent scan.
What is DoppelCart actually doing?
It is a giant network of fake online shops that copy real ones, take your money, and steal your card details at the checkout. Shoppers think they are buying a bargain from a brand they recognise. They are not.
Nebty says the shops mimic 44,182 different brands, with a typical brand cloned twice. Some are hit far harder. SodaStream, Velasca, CurrentBody, Daniel Wellington, Dreame, Horze, MOVA and SPARK PAWS each have more than 30 imposter stores running in their name.
The fake sites lift product catalogues, descriptions, branding and images straight from the genuine businesses. In some cases they even load the pictures directly from the real company's own servers. Discounts of up to 65% are dangled to pull in bargain hunters.
How does the card theft work?
When Nebty tested checkout pages across the network, they found code quietly copying every field a shopper types in.
That includes the card number, expiry date, three-digit security code, the name on the card, and the shopper's email, phone number and address. The data is streamed to the criminals' servers in real time using a technology called WebSockets, which keeps a live connection open between the browser and a remote computer.
Here is the nastier part. The checkout code can also grab the one-time confirmation code that your bank texts you to approve a payment. With that code, the criminals can push a fraudulent charge through the bank's own security check.
Multi-factor authentication, the extra step banks add on top of a password, only helps if the code goes to the right place. When the fake site is the one asking for it, the second factor is just another field to steal.
How big is this compared to past scams?
DoppelCart is now the largest publicly documented fake-shop cluster by domain count, according to Nebty. The previous record was held by a network called BogusBazaar, which ran 75,000 sites and racked up an estimated 850,000 fraudulent transactions.
| Network | Fake sites | Notes |
|---|---|---|
| DoppelCart | 119,000+ | 105,000 still active; 44,182 brands cloned |
| BogusBazaar | 75,000 | ~850,000 fraudulent transactions estimated |
Nebty's chief executive Benedikt Scheungraber told BleepingComputer that 96% of the confirmed DoppelCart shops share identical build files and connect back to just 27 shared shop-running servers. That is a strong sign of one operator, or one small crew, running the whole show.
What should ordinary shoppers do?
If a deal looks too good, check the web address carefully before typing your card in. A brand you know will almost always link to its real site from its own social media accounts, not from a discount ad you clicked in passing.
Some fake DoppelCart shops even display the real brand's genuine support email. Shoppers who never receive their order end up complaining to a company that never took the payment. If your order never arrives, check your bank statement first, then call your card issuer to dispute the charge. Ask for the card to be cancelled and reissued.
Nebty says it tried to reach the main hosting company behind DoppelCart and got no reply. The firm has published a searchable database so brands can find sites impersonating them and push for takedowns.
