DoppelCart network of 119,000 fake shops identified

Cybersecurity firm Nebty has identified a massive network of fraudulent online retailers dubbed ‘DoppelCart’. The cluster consists of approximately 119,000 domains, making it one of the largest documented fake-shop networks by domain count.

The fraudulent sites mimic more than 44,000 legitimate brands by copying product catalogs, descriptions, branding, and images. In some instances, the fake stores even pull product images directly from the original companies’ infrastructure to increase credibility. To entice victims, these shops often advertise discounts of up to 65%.

Technically, the operation is highly efficient; researchers found that 96% of the confirmed shops shared identical build files and utilized only 27 different ecommerce backends. The fraudulent checkout pages are designed to steal credit card details, including card numbers, CVVs, and billing information. Using WebSocket connections, the attackers transmit this data to controlled servers in real time, allowing them to capture one-time bank authentication codes while the victim is still completing the transaction.