You find a product you want for 65% off. The site looks polished, the branding feels familiar, and the deal seems hard to pass up. That could be exactly the trap.
Cybersecurity company Nebty has linked about 119,000 domains to a fake shopping operation called DoppelCart. The sites impersonate legitimate businesses and can steal payment details at checkout, including one-time bank verification codes.
BleepingComputer reports that more than 105,000 DoppelCart shops were active in Nebty's latest scans, while Nebty says the majority of the cluster remains online. So, before you jump on a huge discount from a store you do not recognize, take a closer look at who is really behind the checkout page.
FAKE RENTAL LISTING SCAMS CAN COST YOU THOUSANDS
NEW! 🩺 Free CyberGuy LIVE class: Get Better Healthcare With AI Saturday, September 26 at 11 a.m. ET / 8 a.m. PT
Kurt "CyberGuy" Knutsson will show you five practical ways AI can help you organize your health history, remember important appointment details, understand complicated medical information, research prescriptions and prepare smarter questions for your doctor. No technical experience is needed.
Save your free spot at CyberGuyLive.com.
Nebty discovered DoppelCart while investigating fake shops that targeted several of its customers. Researchers noticed that stores impersonating different companies shared technical characteristics. They began following those connections through publicly available website scans.
The investigation eventually grew to roughly 119,000 associated domains. Nebty says that, to its knowledge, DoppelCart represents the largest publicly documented fake-shop cluster when measured by associated domains.
The company also makes an important point about attribution. Shared infrastructure does not prove that one person or organization controls every DoppelCart store.
Even so, the technical overlap is striking. Nebty CEO Benedikt Scheungraber told BleepingComputer that 96% of the confirmed shops shared identical build files and resolved to 27 commerce backends.
Most of the domains connected to DoppelCart use the .shop top-level domain. Nebty's September 2026 data included 118,787 distinct .shop domains linked to the cluster out of 4,361,908 .shop domains in the company's snapshot. That's 2.72%, or roughly one out of every 37 domains in that particular data set.
However, that number needs some context. Nebty says the snapshot represents domains listed in the .shop DNS zone. It does not tell us how many legitimate or fraudulent stores were operating at the same moment.
For comparison, researchers previously documented BogusBazaar, a fake-shop operation involving more than 75,000 domains. Nebty cautions that observation periods and counting methods differ between investigations, so the numbers are not perfectly comparable.
We reached out to GMO Registry, which operates the .shop domain, for comment but did not hear back before our deadline.
The days when every scam website looked like somebody threw it together in five minutes are long gone. DoppelCart sites can copy product catalogs from real companies along with descriptions, branding and other material.
In some cases, researchers found fake stores loading assets directly from the legitimate company's servers. That creates a real problem for shoppers.
You may recognize the brand. The products look right. Nothing on the page immediately screams scam because much of the material came from the real business in the first place.
Scheungraber says DoppelCart shops mimic 44,182 different brands, with a median of two clones for each brand.
Some brands received much more attention. Researchers found more than 30 shops apiece targeting companies including SodaStream, Velasca, CurrentBody, Daniel Wellington, Dreame, Horze, MOVA and SPARK PAWS.
This is where the scam can catch you. Most of us shop around before spending money online. Finding the same product at a dramatically lower price can feel like a great deal. DoppelCart stores take advantage of that reaction.
Researchers found fake shops advertising discounts as high as 65%. Of course, a steep discount does not automatically mean you're looking at a scam. Real stores run clearance sales every day.
Still, if you've never heard of the retailer and its price beats everyone else by a mile, spend another minute checking who you're buying from. CyberGuy has a full guide on the warning signs worth checking before buying from an unfamiliar website: Tips to help you tell if an online store is real or a scam.
'THE ODYSSEY' STREAMING SCAM COULD STEAL YOUR BANK INFO
The real danger starts when you decide to check out. Nebty tested several checkout pages tied to the DoppelCart cluster and found code collecting:
According to the researchers, those fields can be transmitted through WebSockets to command-and-control infrastructure in real time. So, an attacker may receive the information while you're still sitting on the checkout page.
The technique has similarities to web skimming, where malicious code captures payment information as a shopper types it into an online checkout page. We've previously broken down how that kind of attack works and why shoppers may see no obvious warning: Web skimming attacks target major payment networks.
This is the part I find especially concerning. Many of us have been trained to see a verification code from our bank as an extra layer of protection. DoppelCart can potentially turn that security step against you.
Nebty found that the checkout code can relay the one-time confirmation code issued by a victim's bank. Attackers may then try to use the code to get past protections surrounding a fraudulent transaction.
So, don't automatically enter a bank code simply because a checkout page asks for it. Read the bank's message carefully. Look at the merchant and transaction details if they're included.
If something does not match the purchase you're making, stop the transaction and contact your bank through its official app or the number printed on your card.
DoppelCart creates another headache after the purchase. Some fake shops display the real company's legitimate customer support address.
Now imagine you place an order and nothing arrives. You find the support information on the site and contact the business demanding to know where your purchase went.
The company you're calling may have no idea what you're talking about because you never bought anything from it. Nebty says legitimate businesses have received complaints from shoppers over orders those businesses never processed.
The scammer gets the payment information. Meanwhile, the legitimate company gets the angry customer and has to explain that somebody copied its store.
Nebty says it tried to contact the main hosting provider associated with DoppelCart sites but received no response. Want to see whether a brand or website appears in the DoppelCart investigation? Search Nebty's DoppelCart database at investigations.nebty-id.com/doppelcart.
APPLE PAY TEXT SCAM THREATENS $8,250 LOSS IN 35 MINUTES
A professional-looking site no longer gives you enough information to decide whether a retailer deserves your trust. Instead, slow down when you're shopping somewhere unfamiliar.
Look at the domain in your browser before entering payment information. A fake site may use a recognizable company name inside a completely different domain. If you're trying to buy directly from a well-known brand, find its official website independently. Also, don't let the padlock or HTTPS fool you. HTTPS tells you a website encrypts the connection. It does not prove the seller behind the site is legitimate. Scammers can encrypt websites too.
A 65% discount can make you want to buy before the deal disappears. That's when I would slow down. Check the product on the company's official website or compare it with a retailer you already know. If the price difference looks unusually large, investigate the seller.
Search the store's name before buying. Look beyond reviews displayed on the website itself. Search for independent complaints or reports that connect the domain to scams. Then check the company's contact information. A cloned website can look impressive while having very little legitimate history behind it.
The Federal Trade Commission recommends paying by credit card when possible for online purchases because credit cards provide protections when a transaction goes wrong. Some issuers also let you use virtual card numbers for online purchases. Availability varies by issuer. A virtual number can keep your primary card number away from the merchant and may let you shut down the virtual number if something goes wrong.
Don't treat a one-time verification code as a routine box to fill in. Read the message your bank sends. If the merchant or transaction looks unfamiliar, do not enter the code. Contact your card issuer through a trusted channel instead.
Check whether your bank or card issuer lets you receive notifications when purchases hit your account. Alerts can help you spot an unfamiliar transaction quickly. Do not ignore a small charge simply because the amount looks harmless. Any transaction you don't recognize deserves a closer look.
Strong antivirus software can help warn you about known malicious websites and dangerous links. Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android & iOS devices at Cyberguy.com
However, no program catches every newly created fake shopping site. That means your own judgment still plays an important role when a store you've never heard of suddenly offers the deal of the year.
Act quickly if you think you purchased from a DoppelCart site or another fake retailer. The FTC recommends contacting the financial institution you used to make the payment as soon as possible.
Use the number on the back of your card, your bank's official app or its official website. Tell the issuer that you entered your card information on a suspected fraudulent website. Ask whether the card should be locked or replaced with a new number. If you also entered a one-time verification code from your bank, tell them that too.
Review your recent transactions and continue watching the account. If you paid the fake retailer, tell your issuer that you believe the transaction involved a scam. Also report any other charges you do not recognize. The FTC recommends asking the card issuer or bank whether it can reverse the fraudulent transaction and return your money.
If the fake store asked you to create an account and you reused a password from somewhere else, change that password on the other accounts. Give important accounts unique passwords. A password manager can help generate and store strong passwords without forcing you to remember every one.
Remember what DoppelCart checkout pages can collect. The people behind the operation may have your contact information along with payment details. Be suspicious of unexpected bank warnings, delivery messages or refund offers connected to the purchase. Scammers sometimes target people who already lost money and then pose as someone who can help recover it. Go directly to your bank or the company's official website rather than clicking a link in an unexpected message.
If you downloaded a file, installed software or gave the suspicious site additional access to your device, update your security software and run a scan with strong antivirus software. If all you did was type card information into the fake checkout, focus first on protecting the payment account and watching for fraudulent transactions.
Report suspected fraud to the Federal Trade Commission at ReportFraud.ftc.gov. Reports can help authorities identify fraud patterns and investigate scam operations.
What bothers me most about DoppelCart is how convincing these fake stores can look. You may recognize the products and the branding because scammers copied them from a real business. For me, that changes how I look at a bargain from a store I don't know. If the price seems unusually low, I want to know exactly who I'm buying from before I enter my card information. Take a minute to check the web address and search for the retailer on your own. That small pause could save you from having to replace your card or deal with fraudulent charges later.
Have you ever landed on an online store that looked completely legitimate but something made you suspicious, and what tipped you off? Let us know by writing to us at Cyberguy.com.
Sign up for my FREE CyberGuy Report
Copyright 2026 CyberGuy.com. All rights reserved.
