Global Fraud Network DoppelCart Targets Shoppers via 119,000 Fake E-Shops

SEPT. 8, 2026 — A massive international fraud operation known as DoppelCart has established a sprawling network of more than 119,000 counterfeit e-commerce domains designed to harvest credit card details and sensitive personal information from unsuspecting shoppers. The scheme, which spans multiple countries, primarily utilizes the .SHOP top-level domain to mimic legitimate retail sites, creating a deceptive digital landscape that intercepts payment data during online transactions.

The operation represents one of the largest coordinated efforts of its kind in recent years, leveraging the sheer volume of fake storefronts to overwhelm detection systems and maximize data theft. Cybersecurity analysts describe the network as highly sophisticated, with each domain designed to replicate the appearance of genuine retailers, complete with product listings, shopping carts, and checkout processes. Once a victim enters payment information, the data is immediately captured by the operators rather than processed for legitimate goods.

DoppelCart's infrastructure relies heavily on the .SHOP extension, a domain type that has become a focal point for this specific campaign. While the domains are registered globally, the targets of the fraud are international, affecting shoppers across North America, Europe, and Asia. The timing of the operation's exposure coincides with a period of heightened online retail activity, suggesting the criminals timed their deployment to capitalize on increased consumer spending.

The primary objective of the network is financial gain through the theft of payment credentials. Stolen credit card numbers, expiration dates, and security codes are likely being sold on dark web marketplaces or used directly for unauthorized purchases. Beyond financial data, the operation also collects other sensitive information, including names, addresses, and email addresses, which can be utilized for identity theft or further phishing campaigns.

Law enforcement agencies and cybersecurity firms have identified the scale of the threat as critical, noting that the sheer number of active domains makes traditional takedown efforts difficult. The decentralized nature of the network allows operators to quickly replace shut-down sites with new ones, maintaining the flow of stolen data even as individual domains are taken offline.

As investigations continue, questions remain regarding the full scope of the financial damage and the identity of the individuals behind the DoppelCart network. Authorities have not yet announced arrests or identified specific suspects, leaving the origin of the operation under wraps. The discovery of over 119,000 fake domains raises concerns about how many other similar networks may be operating undetected within the global digital marketplace.

Consumers are advised to exercise extreme caution when visiting unfamiliar e-commerce sites, particularly those using less common domain extensions. Experts recommend verifying the legitimacy of online stores through independent reviews and secure payment methods before entering any financial information. The incident serves as a stark reminder of the evolving tactics employed by cybercriminals in the digital age.