DoppelCart: 119k+ fake .SHOP storefronts steal payment cards (Nebty)
BleepingComputer (8 September 2026) covers German firm Nebty’s report on DoppelCart, a fake e-shop cluster of more than 119,000 domains (mostly .SHOP; Nebty says ~2.72% of that TLD), with more than 105,000 still active in latest scans. About 96% of confirmed shops share identical build files and resolve to 27 commerce backends; they impersonate ~44,182 brands (median two clones each; some brands >30 clones) and advertise discounts up to ~65%. Checkout pages collect PAN, expiry, CVV, name, email, phone and address over WebSockets to C2 in real time, and can relay bank OTPs. Victims sometimes email the real brand’s support address shown on the fake shop. Nebty built a searchable brand-abuse database and said the main hosting provider did not respond. Distinct from BogusBazaar (~75k sites). Wire: BleepingComputer; research: Nebty.
- Exploited in Australia?
- unknown
- Patch to
- Warn finance/procurement about unsolicited deep .SHOP discount storefronts; brand owners: monitor Nebty-style clone inventories and takedown; banks: watch OTP-relay patterns