You find the thing you have been eyeing, 60% off. The photos are the brand's own photos. The product text is the brand's own text. The checkout looks like every checkout you have ever used. Nothing on that page is wrong, and that is exactly the problem: the whole page was copied. In September 2026 researchers published a map of about 119,000 domains running fake shops built this way.

Some of the scams I write about here come find you in a text message. This one waits for you to go looking for a bargain.

What did the researchers actually find?

A German security firm called nebty published a study of a cluster of fake shops it named DoppelCart. The numbers, from an export dated 5 September 2026:

For scale, the best-known earlier network of this kind, BogusBazaar, was reported by SRLabs at more than 75,000 domains. So this one is bigger.

One honest caveat, and nebty states it themselves: "confirmed" here means membership in the cluster, worked out from shared infrastructure and shared site characteristics. It is not proof that one group runs every single domain, and a snapshot of a domain zone does not tell you how many of those shops were open for business at the same moment. A big number is not the same as 119,000 live tills.

Why won't the storefront tell you anything?

Because the storefront is not theirs. These shops copy the real business's product catalog, its descriptions and its branding, and in some cases they load the images straight from the real company's own servers. nebty describes it neatly: each clone copies a real brand's photos and page text, then undercuts its prices. Malwarebytes reports discounts advertised at up to 65% off.

Then the part that makes me wince. The clone republishes the real brand's own support email address. So when the charge goes wrong, the customer writes to the brand, and the brand has no order, no record and no idea. The victim is out the money and the impersonated business is out its reputation. 😅

Malwarebytes also lists brands with 30 or more clone shops each: SodaStream, Velasca, CurrentBody, Daniel Wellington, Dreame, Horze, MOVA and SPARK PAWS. Notice something about that list? These are not the household names that phishing usually targets. They are mid-sized brands, the kind you might only buy from once, which means you have no memory of what their real site looked like.

A copied page is a perfect page. The logo is right because it is the real logo. The photos are right because they are the real photos. Judging a shop by how it looks is judging the scammer's copy-paste skills, not their honesty.

What happens when you hit "Pay"?

This is the part worth being precise about, so here is what Malwarebytes reports and nothing more. The fraudulent checkout pages collect cardholder data and send it to attacker-controlled servers in real time. That may include card numbers, expiry dates, CVVs, billing information, and even one-time confirmation codes issued by banks. Capturing a code in real time can help the criminals complete a payment while you are still clicking through the checkout.

Read that as "may include", because that is how the researchers wrote it. Not every clone is set up the same way. But the design goal is clear enough: your card details, while you are still on the page.

"Not flagged" is not the same as "safe". A brand-new fake shop can be clean on every blocklist simply because nobody has reported it yet. Every check below gives you a signal for your own judgment, never a verdict.

So what can you actually check?

Here I am giving you my own framing, not the researchers'. None of the four studies below does WHOIS or domain-age analysis of this cluster, so this is not "the experts recommend an age check". It is simply what is left to look at once you accept that the page itself is worthless as evidence.

  1. Read the domain, not the page. Not the tab title, not the logo: the exact text between https:// and the first slash. A clone lives on its own address, something like brandname-outlet[.]shop, even when the page is pixel-perfect.
  2. Check when the domain was registered. A shop with a long history and a domain registered eleven days ago is a mismatch worth stopping on. Age is a clue, never a verdict, and I have written about what a domain's age actually tells you in more detail.
  3. Look at where it is hosted. A "boutique" that sits on a free site builder is not proof of anything, but it is a mismatch between the story and the plumbing.
  4. Check the blocklists. Google Safe Browsing and VirusTotal will catch the ones that have been reported. They will miss the ones registered this week, which is the honest limitation I wrote up in what Google's dangerous-sites list catches.
  5. Find the real shop yourself. Search the brand name, go to the site you find that way, and see whether the same product at the same discount exists there. If the deal only exists on the link you were sent, the deal is the bait.

What does IP Tracker show you here?

IP Tracker is my free Chrome extension. You paste a domain or an email address, and it does the boring lookups in one go: the registration date and registrar from WHOIS, the DNS records, the hosting platform behind the address, Google Safe Browsing's verdict, how many security vendors flag it on VirusTotal, and community abuse reports on the IP. Fifty checks a day, no account, no tracking.

For a suspected fake shop, the useful part is the mismatch hunting. An established brand with a domain that is three weeks old. A "flagship store" served from a free builder subdomain. A blocklist hit that settles it in a second. None of that is a guarantee, and I would rather you treat it as five facts you did not have before you typed your card number.

What it can't do

This post would be dishonest without this section, so here are the real limits.

To summarize

Of course, the cheapest check is still the oldest one: if the price makes no sense, the shop probably does not either. Happy shopping, carefully. 😉

Sources