DoppelCart Fraud Network Exposed: 119,000 Fake E-Shop Domains Steal Cards and OTPs in Real Time
German security firm Nebty found the largest fake e-commerce network to date, DoppelCart: over 119,000 domains impersonating 44,000+ brands, WebSocket live exfil of cardholder data, and bank OTP relay to bypass 3D Secure. 105,000 fake shops still online.
German cybersecurity firm Nebty discovered the largest fake e-commerce network to date, DoppelCart: more than 119,000 domains impersonating 44,182 legitimate brands, exfiltrating cardholder data in real time over WebSocket, and even relaying bank OTP codes to bypass 3D Secure strong customer authentication. As of report publication, more than 105,000 fake shops remain online.
Incident Overview
DoppelCart's domain count far exceeds the previous record holder BogusBazaar (75,000 sites, estimated 850,000 fraud transactions). Most domains are registered under the .SHOP TLD, accounting for 2.72% of all sites on that TLD. This is not scattered opportunistic fraud; it is a centralized fraud platform.
Technical Details
96% of confirmed fake shops share identical build files and resolve to only 27 e-commerce backends—a coordinated takedown against the hoster or registrar could theoretically cascade. Fake sites fully clone genuine brand catalogs, descriptions, and brand assets; some hotlink images from the genuine company's servers. SodaStream, Daniel Wellington, Dreame, CurrentBody and others each have more than 30 clone shops. Some fake shops even display the impersonated brand's real customer-service email, so victims who never received goods contact the genuine company—reputation damage plus support load.
Checkout pages collect card number, expiry, CVV, cardholder name, email, phone, and address. All fields are sent in real time over WebSocket to the C2—attackers can start transactions or account takeover before the victim notices. More critically, checkout code can relay bank-issued OTP one-time codes and pass 3D Secure/SCA in real time, neutralizing the core consumer-protection layer. Fake shops typically lure bargain hunters with discounts up to 65%.
Impact Assessment
- Consumers: card fraud, PII and payment-data leak risk.
- Brands: 44,182 brands impersonated; reputation damage, support overload, potential liability.
- Acquirers and payment processors: chargebacks, disputes, compliance risk.
- Ecosystem accountability: Nebty contacted DoppelCart's primary hosting providers and got no response. Missing registrar/hoster accountability is a structural reason these networks keep expanding.
Defensive Recommendations
- Consumers: be wary of discounts over 50%, check domain spelling, shop via official channels; if you entered card data on such a site, contact the issuer immediately to freeze and reissue.
- Brands: use Nebty's public searchable database to monitor brand impersonation; alert on new registrations combining brand name + .SHOP.
- E-commerce operators: run domain monitoring for your own brands; after finding clones, file takedown complaints with registrar and hoster.
References
- Enigma Global – DoppelCart fraud network uses 119,000 fake shops to steal credit cards
- Shield53 – DoppelCart: 119,000 Rogue E-Shops and the Brand Impersonation Crisis