498/69 Thursday, September 10, 2026
Researchers from Nebty detected a fake online store network named DoppelCart, which is linked to more than 119,000 domains. The network impersonates legitimate stores and brands to steal personal information and payment card data. According to scans disclosed by the researchers, more than 105,000 fake stores in the network remain active, increasing the likelihood that users may encounter imitation websites through search results or online advertisements. The reported number of domains represents the size of the detected network, not the number of victims.
The fake websites copy product listings, descriptions, logos, and images from legitimate stores. Some sites load images directly from the brand owners’ servers while offering large discounts to encourage purchases. Analysis of some checkout pages found that the fake sites can collect card numbers, expiration dates, security codes, cardholder names, and contact information before sending the data through WebSocket to a command-and-control (C2) server in real time. The fake websites can also relay one-time passwords issued by banks, which attackers may use to bypass security measures during transactions.
Online shoppers should verify domain names against official brand channels before entering personal information or payment card details. They should not rely solely on product images, logos, or discounts as proof that a website is trustworthy. If users have entered card details on a suspicious website, they should immediately contact the card-issuing bank to suspend the card and review transactions they did not authorize, while preserving evidence of the website and the purchase. For business owners, Nebty has published a database for checking brand impersonation, which can be used to identify and coordinate takedown requests for related fake websites.