DoppelCart Fraud Network Expands to 261,700 Suspected Shopping Domains
A vast network of fake storefronts remains online
About 40% of the suspected DoppelCart storefronts observed before October 17, 2026, were still active. That's the number that should get your attention. Hosts being detected for the first time have slowed down since the summer peak, but the sites already built are still up and taking orders. That pattern points to operators maintaining what they have rather than racing to build more. Fake shop networks like this one tend to be durable because a live storefront with a steady trickle of victims is worth more to its operator than a fresh domain that hasn't been seen yet.
Recorded Future identified approximately 261,700 unique apex domains likely tied to the network, using proprietary methods primarily between March and October 2026. Detections began appearing in the thousands in January, climbed in March and peaked in June and July. New host detections dropped sharply from August. Read those dates together and the shape is clear: a steady build-out over the first half of the year, a plateau, then a fall-off in new activity. Whether that fall-off reflects a change in strategy or simply the limits of what researchers can see is a separate question, and the source doesn't settle it.
That decline alone doesn't show the operation has wound down. Many previously registered domains remain online, and a sharp drop in new detections says more about the pipeline of fresh infrastructure than about the sites already serving shoppers. Here's the thing: a network can stop growing and still do damage for months, as long as its existing storefronts keep getting clicks. The scale and persistence also make the network's shared storefront patterns useful signals for retailers tracking brand impersonation, which is a point we'll come back to.
Reading the detection timeline
The timeline is worth reading closely, because detection numbers are never a clean measure of activity. Researchers only see what their methods can catch, and the methods can change, get better, or hit blind spots. The rise from thousands of detections in January to a peak in June and July tracks a period of heavy registration and expansion. The sharp drop from August is harder to interpret. It could mean operators stopped registering new domains. It could also mean they got more careful about how they expose new sites, or that the detection approach stopped keeping pace. (And this is the part most people overlook: a falling curve on a chart is not the same thing as a falling threat.)
So what does the cumulative chart actually tell you? It tells you the network grew large enough to be a serious problem, and that it did so in a relatively short window. Roughly a third of the year's activity was concentrated around the peak months, which suggests a burst of setup work rather than a slow, steady campaign. Bursts like that are common in this type of fraud. Operators register many domains quickly, test which ones attract traffic, and keep the productive ones running while the rest fade. Given that picture, the 40% still-active figure reads less like a surprise and more like the expected outcome of a network built to last.
How the storefronts target shoppers
DoppelCart sites imitate legitimate retailers' branding, product images, listings and descriptions. That's the core trick. A shopper who lands on one of these pages sees what looks like a familiar store, with recognizable logos and product photos, and has little reason to question it. Many use .shop domains, which are cheap and easy to register and give the sites a plausible storefront feel. They also advertise steep discounts, including offers of 65% off, to draw shoppers into checkout. A deal that good is meant to short-circuit the part of your brain that asks whether something is too good to be true.
The checkout pages send personal and payment details to attacker controlled servers in real time. That means the theft happens as the shopper types, not after the order goes through, so there's no moment where the victim gets a confirmation that something went wrong. Some also collect one time verification codes sent by banks. That detail matters a lot. A card number alone is often not enough to complete a fraudulent transaction, but a card number plus a live one time code can let criminals authorize payments while the shopper believes they're completing a genuine purchase. The victim isn't handing over a stolen card. They're approving the theft themselves, without realizing it.
Who exposed the network and what's still unknown
The network was first exposed in September 2026 by German cybersecurity company Nebty, which reported more than 119,000 websites. That's a striking count, and it's the kind of figure that tends to spread quickly once it's published. Researchers connected storefronts through shared designs, code and infrastructure, though those similarities don't establish that a single criminal organization runs the entire cluster. Shared templates and hosting habits are common across fraud operations, and they can also be borrowed, copied or reused by unrelated actors. Treat the link between sites as strong evidence of common tooling, and as weaker evidence of common ownership, until someone shows more.
Later reporting by Malwarebytes and BleepingComputer described the payment data and verification code theft. That independent coverage matters because it confirms the mechanics rather than relying on a single source's account. Still, the public record leaves gaps. The reporting describes what the sites do, but the source material here doesn't say who sits behind them, how the proceeds move, or how many shoppers have been affected. Anyone who tells you those answers are settled is ahead of the evidence.
Implications for retailers and the wider risk
For retailers, the practical signal is the reuse of storefront designs and infrastructure across many domains. If you're working in brand protection or e-commerce security, this is where your effort pays off. A single fake site is hard to spot in isolation. A cluster of lookalikes sharing the same design choices, code patterns and hosting footprints is much easier to flag, and it gives you a way to find sites you haven't seen yet. What this means for you is that monitoring should focus on patterns rather than individual domain names, since operators can swap domains cheaply and keep the underlying template.
With a substantial share still active, monitoring those patterns remains relevant even as new host growth slows. That's the outlook I'd take from this. The slowdown in new detections is a reasonable thing to watch, but it's a weak reason to relax. Live sites keep collecting card data and verification codes, and the damage accrues to shoppers and the brands being impersonated, whether or not the network is still expanding. Expect the problem to persist in the form of a maintained, aging infrastructure rather than a dramatic new wave. That's harder to headline, and it's exactly why it tends to get less attention than it deserves.
