You find the thing you have been eyeing, 60% off. The photos are the brand's own photos. The product text is the brand's own text. The checkout looks like every checkout you have ever used. Nothing on that page is wrong, and that is exactly the problem: the whole page was copied. In September 2026 researchers published a map of about 119,000 domains running fake shops built this way.
Some of the scams I write about here come find you in a text message. This one waits for you to go looking for a bargain.
What did the researchers actually find?
A German security firm called nebty published a study of a cluster of fake shops it named DoppelCart. The numbers, from an export dated 5 September 2026:
- 119,012 entries in the database classified as confirmed. Merging
wwwand non-wwwversions leaves 118,996 distinct domains, which nebty rounds to 119,000. - 118,787 of them end in
.shop. Out of 4,361,908.shopdomains examined, that is 2.72 percent, or as nebty puts it, roughly one in every 37. - 44,182 brands are mimicked, with a median of two clones each, according to the write-up in The Hacker News. Malwarebytes gives the same figure as "more than 44,000".
For scale, the best-known earlier network of this kind, BogusBazaar, was reported by SRLabs at more than 75,000 domains. So this one is bigger.
One honest caveat, and nebty states it themselves: "confirmed" here means membership in the cluster, worked out from shared infrastructure and shared site characteristics. It is not proof that one group runs every single domain, and a snapshot of a domain zone does not tell you how many of those shops were open for business at the same moment. A big number is not the same as 119,000 live tills.
Why won't the storefront tell you anything?
Because the storefront is not theirs. These shops copy the real business's product catalog, its descriptions and its branding, and in some cases they load the images straight from the real company's own servers. nebty describes it neatly: each clone copies a real brand's photos and page text, then undercuts its prices. Malwarebytes reports discounts advertised at up to 65% off.
Then the part that makes me wince. The clone republishes the real brand's own support email address. So when the charge goes wrong, the customer writes to the brand, and the brand has no order, no record and no idea. The victim is out the money and the impersonated business is out its reputation. 😅
Malwarebytes also lists brands with 30 or more clone shops each: SodaStream, Velasca, CurrentBody, Daniel Wellington, Dreame, Horze, MOVA and SPARK PAWS. Notice something about that list? These are not the household names that phishing usually targets. They are mid-sized brands, the kind you might only buy from once, which means you have no memory of what their real site looked like.
What happens when you hit "Pay"?
This is the part worth being precise about, so here is what Malwarebytes reports and nothing more. The fraudulent checkout pages collect cardholder data and send it to attacker-controlled servers in real time. That may include card numbers, expiry dates, CVVs, billing information, and even one-time confirmation codes issued by banks. Capturing a code in real time can help the criminals complete a payment while you are still clicking through the checkout.
Read that as "may include", because that is how the researchers wrote it. Not every clone is set up the same way. But the design goal is clear enough: your card details, while you are still on the page.
So what can you actually check?
Here I am giving you my own framing, not the researchers'. None of the four studies below does WHOIS or domain-age analysis of this cluster, so this is not "the experts recommend an age check". It is simply what is left to look at once you accept that the page itself is worthless as evidence.
- Read the domain, not the page. Not the tab title, not the logo: the exact text between
https://and the first slash. A clone lives on its own address, something likebrandname-outlet[.]shop, even when the page is pixel-perfect. - Check when the domain was registered. A shop with a long history and a domain registered eleven days ago is a mismatch worth stopping on. Age is a clue, never a verdict, and I have written about what a domain's age actually tells you in more detail.
- Look at where it is hosted. A "boutique" that sits on a free site builder is not proof of anything, but it is a mismatch between the story and the plumbing.
- Check the blocklists. Google Safe Browsing and VirusTotal will catch the ones that have been reported. They will miss the ones registered this week, which is the honest limitation I wrote up in what Google's dangerous-sites list catches.
- Find the real shop yourself. Search the brand name, go to the site you find that way, and see whether the same product at the same discount exists there. If the deal only exists on the link you were sent, the deal is the bait.
What does IP Tracker show you here?
IP Tracker is my free Chrome extension. You paste a domain or an email address, and it does the boring lookups in one go: the registration date and registrar from WHOIS, the DNS records, the hosting platform behind the address, Google Safe Browsing's verdict, how many security vendors flag it on VirusTotal, and community abuse reports on the IP. Fifty checks a day, no account, no tracking.
For a suspected fake shop, the useful part is the mismatch hunting. An established brand with a domain that is three weeks old. A "flagship store" served from a free builder subdomain. A blocklist hit that settles it in a second. None of that is a guarantee, and I would rather you treat it as five facts you did not have before you typed your card number.
What it can't do
This post would be dishonest without this section, so here are the real limits.
- The lookalike check will not catch most of these. IP Tracker compares a domain against roughly 125 heavily impersonated brands: banks, couriers, payment services, big tech, government, crypto, streaming. This cluster impersonates 44,182 brands. Velasca and SPARK PAWS are not on my list and were never going to be. If you check one of these clone shops, the lookalike detector will say nothing, and that silence means nothing.
- It is not a spelling trick. These domains do not need to look like the brand's real address at all, so the letter-swap detection I built for homoglyph domains has nothing to bite on. A clone can live at any name that sounds shoppable.
- A clean result is a missing signal. Fresh domains have no reports yet. VirusTotal showing zero detections on a five-day-old shop is the expected result, not a reassuring one.
- It cannot see the checkout. Nothing in the extension inspects what a payment form does with your data. It looks at the domain and its infrastructure, full stop.
- It does not stop anything. It surfaces signals. You decide.
To summarize
- ✓ The storefront is copied, so it proves nothing. HTTPS and a padlock prove nothing either.
- ✓ Read the exact domain before you read anything else on the page.
- ✓ A steep discount plus a young domain plus a brand you rarely buy from is three mismatches, not one.
- ✓ Find the real shop through a search instead of through the link you were sent.
- ✓ "Nothing found" is a missing signal, not a green light.
Of course, the cheapest check is still the oldest one: if the price makes no sense, the shop probably does not either. Happy shopping, carefully. 😉
Sources
- nebty, DoppelCart: 119,000 Domains in What May Be the Largest Documented Fake-Shop Network (primary research, export dated 2026-09-05).
- The Hacker News, ThreatsDay: 200 Android Flaws, Browser-Built Phishing, 119K Scam Shops + 23 More Stories (10 September 2026).
- Pieter Arntz, Malwarebytes Labs, More than 100,000 fake stores are out to steal your card details (9 September 2026).
- Stefan Dasic, Malwarebytes Labs, Inside a network of 20,000+ fake shops (18 March 2026), background on an earlier operation.