DoppelCart Fraud Network Uses 119,000 Fake Shops to Steal Credit Card Data

Massive Fake Shop Operation Discovered

German cybersecurity startup Nebty identified "DoppelCart," a large-scale fraud operation utilizing over 119,000 domains to host fake e-commerce shops. This network is described as the largest publicly documented fake-shop cluster by domain count, exceeding previous operations like "BogusBazaar."

The majority of these domains are within the .SHOP top-level domain, representing 2.72% of all sites on that TLD. Nebty's latest scans indicate that more than 105,000 DoppelCart shops remain active.

Impersonation Tactics and Data Theft

DoppelCart shops impersonate 44,182 different brands by replicating product catalogs, descriptions, branding, and images, sometimes loading assets directly from legitimate company servers. Some brands, including SodaStream and Daniel Wellington, have over 30 cloned shops.

The fake sites attract shoppers with advertised discounts of up to 65%. During checkout, the sites collect sensitive payment card information, including card numbers, expiration dates, security codes, cardholder names, email addresses, phone numbers, and physical addresses. This data is transmitted in real time via WebSockets to command-and-control servers.

Bypassing Security and Victim Impact

The checkout code can also relay one-time confirmation codes issued by banks, potentially allowing attackers to bypass security measures. Victims who do not receive their purchases may contact the legitimate companies, as some fake stores display the impersonated brand’s actual support address.

Nebty attempted to contact the main hosting provider for DoppelCart sites but received no response. The company has created a searchable database to assist brands in identifying and addressing DoppelCart impersonation.