A network of counterfeit online stores that copies real retailers to harvest shoppers' card details is more than twice the size first reported. Recorded Future's Insikt Group says in new research that it has identified about 261,700 unique domains it assesses are likely part of the DoppelCart fraud network, and that roughly 40% of the sites it observed before October 17 were still online.
When German security company Nebty first exposed DoppelCart in September, it counted more than 119,000 sites. We covered that disclosure in 118,000 fake shops steal cards and bank one-time codes. The storefronts copy legitimate retailers' product listings, images and descriptions, lure buyers with steep discounts such as 65% off, and send whatever is typed at checkout to attacker-controlled servers. Some also capture the one-time verification codes banks send to approve a payment, which can let criminals authorise their own transactions while the victim thinks they are finishing a purchase.
Growth peaked in summer, but the sites did not go away
Insikt Group says a few thousand DoppelCart detections appeared in January 2026, rose in March and peaked in June and July, before new hosts dropped off sharply in August. The researchers caution that the slowdown is not necessarily a sign the operation is winding down. Their reading is that operators may have shifted from building new sites to maintaining the large number already registered.
The domain mix is changing too. The early sites almost all used the .shop top-level domain, but from September 2026 .com addresses made up a growing share, which Recorded Future says suggests a possible shift or diversification in tactics.
Judged by where the impersonated brands are based, the most targeted countries were the United States, the United Kingdom, Australia, Canada and Germany, with US brands the overwhelming majority. Fashion, food and beverage, publishing, luxury goods, sports, consumer electronics and cosmetics brands were among the most copied.
Chinese-language payment rules and a shared shop platform
The technical findings say the most about how the network is run. Between March and May, the sites used Cloudflare for DNS. From mid-May, existing and new sites began coming from AS199242, routed through a Georgian provider, Malakmadze Web LLC, and more than 100,000 pages made that move while keeping their branding. Insikt Group assesses with medium confidence that the address space is assigned to a Beijing-based hosting company.
In a sample of pages scanned in the last 90 days, about half carried an embedded payment routing configuration, mostly with Chinese-language rule names. Translated, they include "European buyers, small amounts go via TKS" and "Tier 1 to 2 brands do not use the Europe channel". The website ID lists inside those rules were identical across pages, which suggests every site inherits one central list.
Those IDs are in a format used by the open-source Medusa e-commerce platform, and every page also embeds a Medusa publishable key, nearly always unique per domain. Insikt Group assesses with high confidence that the operators behind the most recent sites use Medusa to manage their storefronts. Nebty, for its part, has cautioned that the shared technical traits do not prove a single criminal group runs the whole network.
Check the address before you type a card number
- Shoppers: reach retailers through addresses you already know rather than ads or search results. Familiar branding, real product photos and HTTPS do not prove a store is genuine. If you think you paid a fake shop, contact your card issuer at once and keep the site address, screenshots and order emails.
- Retailers and brands: monitor for storefronts copying your catalogue, pursue takedowns of live sites, and tell customers publicly which domains are yours and where to report fakes.
DoppelCart works because it borrows the one thing shoppers are taught to trust, a brand they recognise. At a quarter of a million domains and with tens of thousands still live, takedowns alone will not keep pace, which puts the burden back on the moment a buyer decides whether a bargain is real.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.