A German cybersecurity and brand protection startup is exposing the largest known network of fake online shops that steal sensitive personal and financial information from customers.
Nebty says the network, known as DoppelCart, accounts for 2.72% of all .shop domains in its September 2026 snapshot.
According to the firm, DoppelCart runs roughly 119,000 domains, linked by shared infrastructure and recurring features in their shop software.
Nebty CEO Benedikt Scheungraber says 96% of confirmed sites share identical build files and resolve to just 27 commerce backends. He adds that the shops mimic 44,182 brands by copying product catalogs, descriptions, branding and images, sometimes loading assets directly from legitimate company servers.
Nebty finds that the checkout pages collect card numbers, expiration dates, security codes, cardholder names, emails, phone numbers and addresses.
The data is transmitted in real time over WebSockets to attackers, including one-time bank confirmation codes.
Says the startup,
“Much of these stores’ credibility comes from the businesses they copy. In the examples we examined, visitors see real product names, detailed descriptions and original material from the affected brands. Shoppers who already know the products encounter plenty that looks familiar.
In one fake shop we examined, product descriptions had been copied word for word from the legitimate online store. The copy even included detailed explanations of product features and construction. Comparing the archived HTML with the original store shows how thoroughly this content was reproduced…
The archived offers combine copied original material with advertised discounts of 65%. Familiar product presentations and an apparent price advantage are used to make the offer look attractive.”
Follow us on X, Facebook and Telegram
Don’t Miss a Beat – Subscribe to get email alerts delivered directly to your inbox
 
Disclaimer: Opinions expressed at The Daily Hodl are not investment advice. Investors should do their due diligence before making any high-risk investments in Bitcoin, cryptocurrency or digital assets. Please be advised that your transfers and trades are at your own risk, and any losses you may incur are your responsibility. The Daily Hodl does not recommend the buying or selling of any assets including cryptocurrencies, nor is The Daily Hodl an investment advisor. Please note that The Daily Hodl participates in affiliate marketing.
Generated Image: Midjourney
