The 119,000 fake shops quietly stealing shoppers' card details
A German security firm says 'DoppelCart' is now the largest fake-store network ever documented, cloning real brands and skimming payment data live at checkout.
Key points
- Researchers at German security startup Nebty have named a fake-shop network called DoppelCart that runs across more than 119,000 web addresses.
- Around 105,000 of those fake stores are still online, and most sit on the .SHOP domain ending, making up 2.72% of all sites there.
- The sites impersonate 44,182 real brands, with SodaStream, Daniel Wellington, CurrentBody and SPARK PAWS among those cloned more than 30 times each.
- Checkout pages siphon card numbers, security codes, addresses and the one-time code sent by the shopper's bank, sending everything to the criminals in real time.
- DoppelCart is now larger than the previous record holder, BogusBazaar, which ran 75,000 sites and clocked an estimated 850,000 fraudulent transactions.
A sprawling fake-shop operation is impersonating tens of thousands of real brands to hoover up shoppers' card details, and it's bigger than anything researchers have catalogued before.
The network, nicknamed DoppelCart, was discovered by German cybersecurity startup Nebty and first reported by BleepingComputer. It runs on more than 119,000 web addresses. Most end in .SHOP, and DoppelCart alone accounts for 2.72% of every site using that domain ending. Around 105,000 of the fake stores were still live at Nebty's most recent scan.
What is DoppelCart actually doing?
It's a giant network of fake online shops that copy real ones, pocket your money and steal your card details at the checkout. Shoppers think they're buying a bargain from a brand they recognise. They're not.
Nebty says the shops mimic 44,182 different brands, with a typical brand cloned twice. Some are hit far harder. SodaStream, Velasca, CurrentBody, Daniel Wellington, Dreame, Horze, MOVA and SPARK PAWS each have more than 30 imposter stores running in their name.
The fake sites lift product catalogues, descriptions and branding straight from the genuine businesses, sometimes loading images directly from the real company's own servers. Discounts of up to 65% are dangled to pull in bargain hunters.
How does the card theft work?
When Nebty tested checkout pages across the network, it found code quietly copying every field a shopper types in: card number, expiry date, three-digit security code, cardholder name, email and physical address. The data is streamed to the criminals' servers in real time using WebSockets, a technology that holds a live connection open between the browser and a remote computer.
The nastier part is what happens next. The checkout code can also grab the one-time confirmation code your bank texts you to approve a payment. With that in hand, the criminals can push a fraudulent charge through the bank's own security check. Multi-factor authentication, the extra verification step banks layer on top of a password, only protects you if the code goes somewhere the attacker can't see. On a DoppelCart page, it doesn't.
We covered how stolen card data moves from reader to criminal in our piece on physical card skimmers from 15 August. The real-time WebSocket relay DoppelCart uses is the digital equivalent: no delay, no middleman, no chance for the bank to flag an unusual export.
How big is this compared to past scams?
DoppelCart is now the largest publicly documented fake-shop cluster by domain count, according to Nebty, well clear of the previous record holder.
| Network | Fake sites | Notes |
|---|---|---|
| DoppelCart | 119,000+ | 105,000 still active; 44,182 brands cloned |
| BogusBazaar | 75,000 | ~850,000 fraudulent transactions estimated |
Nebty chief executive Benedikt Scheungraber told BleepingComputer that 96% of confirmed DoppelCart shops share identical build files and connect back to just 27 shared commerce servers. That's a strong sign of one operator, or one small crew, running the whole show.
Should you worry if you shop online?
Yes, but a few habits help. Check the web address carefully before typing your card in. A brand you know will link to its real site from its own social media accounts, not from a discount ad you clicked in passing.
Some DoppelCart shops even display the real brand's genuine support email, so shoppers who never receive an order end up complaining to a company that never took the payment. If your order doesn't arrive, check your bank statement first, then call your card issuer to dispute the charge and ask for the card to be reissued.
Nebty says it tried to reach the main hosting provider behind DoppelCart and got no reply. The firm has published a searchable database so brands can find sites impersonating them and push for takedowns. Sixty-six thousand active fake shops is a lot of ground to recover.
