You find a product you want for 65% off. The site looks polished, the branding feels familiar, and the deal seems hard to pass up. That could be exactly the trap.
Cybersecurity company Nebty has linked about 119,000 domains to a called DoppelCart. The sites impersonate legitimate businesses and can steal payment details at checkout, including one-time bank verification codes.
BleepingComputer reports that more than 105,000 DoppelCart shops were active in Nebty’s latest scans, while Nebty says the majority of the cluster remains online. So, before you jump on a huge discount from a store you do not recognize, take a closer look at who is really behind the checkout page.
FAKE RENTAL LISTING SCAMS CAN COST YOU THOUSANDS
NEW! 𩺠Free CyberGuy LIVE class: Get Better Healthcare With AI Saturday, September 26 at 11 a.m. ET / 8 a.m. PT
Kurt “CyberGuy” Knutsson will show you five practical ways AI can help you organize your health history, remember important appointment details, understand complicated medical information, research prescriptions and prepare smarter questions for your doctor. No technical experience is needed.
Save your free spot at CyberGuyLive.com.
Nebty discovered DoppelCart while investigating fake shops that targeted several of its customers. Researchers noticed that stores impersonating different companies shared technical characteristics. They began following those connections through publicly available website scans.
The investigation eventually grew to roughly 119,000 associated domains. Nebty says that, to its knowledge, DoppelCart represents the largest publicly documented fake-shop cluster when measured by associated domains.
The company also makes an important point about attribution. Shared infrastructure does not prove that one person or organization controls every DoppelCart store.
Even so, the technical overlap is striking. Nebty CEO Benedikt Scheungraber told BleepingComputer that 96% of the confirmed shops shared identical build files and resolved to 27 commerce backends.
Most of the domains connected to DoppelCart use the .shop top-level domain. Nebty’s September 2026 data included 118,787 distinct .shop domains linked to the cluster out of 4,361,908 .shop domains in the company’s snapshot. That’s 2.72%, or roughly one out of every 37 domains in that particular data set.
However, that number needs some context. Nebty says the snapshot represents domains listed in the .shop DNS zone. It does not tell us how many legitimate or fraudulent stores were operating at the same moment.
For comparison, researchers previously documented BogusBazaar, a fake-shop operation involving more than 75,000 domains. Nebty cautions that observation periods and counting methods differ between investigations, so the numbers are not perfectly comparable.
We reached out to GMO Registry, which operates the .shop domain, for comment but did not hear back before our deadline.
The days when every scam website looked like somebody threw it together in five minutes are long gone. DoppelCart sites can copy product catalogs from real companies along with descriptions, branding and other material.
In some cases, researchers found fake stores loading assets directly from the legitimate company’s servers. That creates a real problem for shoppers.
You may recognize the brand. The products look right. Nothing on the page immediately screams scam because much of the material came from the real business in the first place.
Scheungraber says Doppe
