As reported by BleepingComputer, German cybersecurity firm Nebty has uncovered DoppelCart—a coordinated network of over 119,000 fake e-commerce domains designed to harvest payment card data and personally identifiable information from unsuspecting shoppers. With more than 105,000 shops still active at the time of reporting, DoppelCart is now the largest publicly documented fake-shop cluster by domain count, dwarfing the previous record holder, BogusBazaar.

Threat Alert: As reported by BleepingComputer, German cybersecurity firm Nebty has uncovered DoppelCart—a coordinated network of over 119,000 fake e-commerce domains designed to harvest payment card data and personally identifiable information from unsuspecting shoppers.

Why DoppelCart Matters

The scale alone is staggering—DoppelCart domains account for 2.72% of all sites on the entire .SHOP top-level domain. But what makes this operation particularly dangerous is its industrialized consistency. According to Nebty, 96% of confirmed DoppelCart shops share identical build files and resolve to just 27 commerce backends. This isn't a scattered collection of opportunistic scammers; it's a centrally managed fraud platform with a shared technology stack, which means takedowns and infrastructure disruption could theoretically cascade—but only if hosting providers and registrars cooperate.

The fact that 44,182 brands are being impersonated means this isn't just a consumer problem—it's a enterprise brand protection and fraud team problem.

Each fake shop copies real product catalogs, branding, and even images—sometimes hotlinking directly from the legitimate company's servers. Some display the real brand's support email, so victims who never receive their orders end up contacting the genuine company, creating reputational damage, customer service burden, and potential liability exposure for brands that had nothing to do with the transaction.

The Technical Threat Model

The checkout pages in DoppelCart shops capture a full suite of sensitive data: card numbers, expiration dates, CVV codes, cardholder names, emails, phone numbers, and physical addresses. What elevates this beyond simple card skimming is the use of WebSocket-based real-time exfiltration to command-and-control infrastructure. This architecture suggests the operators can act on stolen data immediately—potentially using it for parallel transactions or account takeover before the victim or their bank detects fraud.

Critically, the checkout code can also intercept one-time passcodes (OTPs) sent by banks for 3D Secure / SCA verification. If the attacker can relay or input these codes in real time, they can potentially authorize transactions that would normally be blocked by strong customer authentication. This effectively neutralizes a key consumer protection layer.

Who Is Affected

  • Consumers: Bargain-hunting shoppers lured by discounts of up to 65% are the primary victims, facing card fraud, identity exposure, and potential unauthorized transactions.
  • Brands: 44,182 companies face impersonation, with some (SodaStream, Daniel Wellington, Dreame, CurrentBody, and others) receiving 30+ clone shops each. Reputational damage, customer trust erosion, and support overload are immediate consequences.
  • Payment processors and acquiring banks: Fraudulent transactions flowing through DoppelCart generate chargebacks, disputes, and compliance risk.
  • Registrars and hosting providers: The .SHOP TLD and the unnamed main hosting provider face scrutiny for enabling infrastructure that constitutes a significant percentage of their ecosystem.

Broader Implications

DoppelCart exposes a structural weakness in the domain registration and hosting ecosystem: there is no meaningful friction preventing bad actors from registering tens of thousands of domains with near-identical infrastructure for fraud. The fact that Nebty's outreach to the primary hosting provider went unanswered illustrates the accountability gap. Until registrars, hosting providers, and TLD operators face regulatory or financial consequences for enabling this scale of abuse, operations like DoppelCart will continue to proliferate.

Additionally, the WebSocket-based C2 and OTP interception capabilities signal that these operators are investing in real-time fraud enablement, not just passive data theft. This raises the sophistication bar and suggests the network may be connected to organized carding communities that monetize stolen data through coordinated cash-out operations.

Shield53 Recommendations

For Brands and E-commerce Teams

Shield53 Recommendations
Actively monitor for brand impersonation: Use Nebty's searchable database and commercial brand protection platforms (e.g., MarkMonitor, CSC, Corsearch) to detect clone shops early. Set up automated alerts for new domains combining your brand name with .SHOP and other TLDs.
Deploy takedown workflows: Establish pre-negotiated relationships with registrars and hosting providers for rapid takedowns. Document your trademark registrations and have legal templates ready for DMCA and UDRP/URS proceedings.
Educate customers: Publish clear guidance on how to verify legitimate stores. Warn about deep discounts that seem too good to be true. Use your owned channels—email, social, website banners—to raise awareness during high-shopping periods.
Monitor for hotlinked assets: Check server logs for unauthorized image or catalog file hotlinking, which DoppelCart shops use to mimic legitimate storefronts. Block or watermark these assets.

For Consumers and Security Awareness Teams

  • Verify the domain URL carefully before entering payment information—look for misspellings, unusual TLDs, or lack of HTTPS.
  • Be skeptical of discounts significantly below market price, especially from unfamiliar stores.
  • Use virtual card numbers or single-use payment tokens where available to limit exposure.
  • Enable transaction alerts on all payment cards and report unauthorized charges immediately.

For Financial Institutions

  • Flag transactions originating from .SHOP domains with known DoppelCart infrastructure indicators as high-risk.
  • Review 3D Secure / SCA flows for WebSocket-based interception vulnerabilities—ensure OTP delivery channels are not easily relayed.
  • Share fraud signals and IoCs with industry partners to accelerate detection and takedown of shared infrastructure.