119,000 fake shops share the same checkout code, and that's the tell

A fraud network called DoppelCart runs more than 119,000 fake online shops, all built to steal payment card details. It was uncovered by the German cybersecurity startup Nebty, and reported by BleepingComputer.

The scale is the headline number, but the pattern underneath it is what makes the network findable at all. Nebty's CEO, Benedikt Scheungraber, told BleepingComputer that 96% of the confirmed DoppelCart shops share identical build files and resolve to just 27 commerce backends. Over 105,000 of the shops are still active. Most sit on the .SHOP top-level domain, where they account for 2.72% of every site on that TLD.

One template, thousands of storefronts

The shops copy product catalogs, descriptions, branding and images from real businesses, sometimes pulling the assets straight from the legitimate company's own servers. Nebty counted 44,182 different brands impersonated, a median of two fake shops per brand. A handful drew far more attention: SodaStream, Velasca, CurrentBody, Daniel Wellington, Dreame, Horze, MOVA and SPARK PAWS each had more than 30 clones. Discounts up to 65% are the bait that gets a shopper to click through.

The same repetition that makes the network cheap to run is what makes it detectable. Thousands of storefronts built from the same handful of backends leave a fingerprint that no single site would show on its own.

What the checkout page actually does

Nebty tested checkout pages across the cluster and found code harvesting card numbers, expiration dates, security codes, cardholder names, emails, phone numbers and physical addresses. Each field is sent over WebSockets to a command-and-control server in real time. The checkout code can also relay the one-time confirmation code a bank sends to verify a purchase, which attackers can use to get around that same security check.

Some of the fake stores display the impersonated brand's real support address. A shopper who never receives an order ends up contacting the genuine company, not the scammer, which quietly shifts the cleanup work onto the brand being copied.

Where this stands

Nebty tried to contact the main hosting provider for the DoppelCart sites and got no response. Separately, the company built a searchable database so brands can check whether they are being impersonated.

This is the kind of pattern Flggd watches for: not a single fake shop, but the shared build files and backend infrastructure that link tens of thousands of them together.

What is not known

• Which hosting provider or providers are involved is not named in the source.
• No estimate of total financial losses or victim count is given, unlike the 850,000 fraudulent transactions reported for the smaller BogusBazaar network.
• It is not stated whether any DoppelCart operators have been identified or face legal action.
• The source does not say which country or countries the operation is based in.