DoppelCart Fraud Network Grows to More Than 250,000 Domains

Summary

This article examines DoppelCart, a large-scale shopping fraud network encompassing approximately 261,700 suspected domains identified by Recorded Future. These fraudulent storefronts copy legitimate retailers’ branding and product listings to deceive shoppers into disclosing personal and payment information, with some also capturing bank-issued verification codes to authorize fraudulent transactions. This research highlights the network’s widespread impersonation of US brands, evolving hosting infrastructure, and use of shared payment-routing configurations and the Medusa e-commerce platform. With approximately 40% of observed DoppelCart websites remaining active, understanding these patterns can help retailers identify brand impersonation and help consumers recognize fraudulent shopping sites.

Background

In September 2026, German cybersecurity company Nebty exposed DoppelCart, a large-scale online shopping fraud network with over 119,000 websites. The fraudulent storefronts copy legitimate retailers’ product listings, images, and descriptions to deceive shoppers into entering payment information.

Researchers identified shared website designs, code, and infrastructure across thousands of suspicious storefronts, eventually linking the domains to the DoppelCart cluster. Most websites used .shop web addresses, and many advertised steep discounts, including offers of 65% off, to attract shoppers. Although the websites shared technical characteristics, Nebty cautioned that the findings did not establish whether a single criminal organization operated the entire network.

According to subsequent reporting by Malwarebytes and BleepingComputer, fraudulent checkout pages transmit shoppers’ personal and payment information to attacker-controlled servers in real time. Some also capture one-time verification codes issued by banks, potentially allowing criminals to authorize transactions while victims believe they are completing legitimate purchases.

Domains Discovered by Recorded Future

Primarily between March and October 2026, Recorded Future used proprietary methods to identify approximately 261,700 unique apex domains that are likely part of the DoppelCart fraud network. Based on our collections, a few thousand DoppelCart detections began appearing in January 2026 and increased during March. Our detections peaked during the months of June and July, with a sharp drop-off in new hosts starting in August.

While new host growth mostly plateaued thereafter, a drop-off in new detections is not necessarily an indicator that operations are abating. More likely, it reflects that many previously registered domains remain active, and that operators may have shifted their focus to maintaining existing infrastructure rather than expanding it. Based on data from Recorded Future® Web Scans, approximately 40% of suspect websites in this cluster observed prior to October 17, 2026, remain active.

Figure 1: Total DoppelCart domains between January 2026 and October 2026, identified via content-based Recorded Future web detections (Source: Recorded Future)

Insikt Group also observed that at first, DoppelCart domains almost exclusively used .shop top-level domains (TLDs). However, starting in September 2026, .com domains began to account for a larger share of total observed TLDs, suggesting a possible shift or diversification in hosting tactics, techniques, and procedures (TTPs).

Figure 2: Number of .shop and .com TLDs found in the DoppelCart domains identified via content-based Recorded Future web detections (Source: Recorded Future)

Victimology Breakdown

Using Recorded Future HTML Content Analysis to view DoppelCart detections, Insikt Group analyzed brands that were actively impersonated. Based on the domiciles of the impersonated brands, the top countries targeted by DoppelCart in our dataset were the United States (US), the United Kingdom (UK), Australia, Canada, and Germany, with the overwhelming majority of impersonated brands being from the US.

Figure 3: Top targeted geographies based on the domiciles of impersonated brands, within a sample of DoppelCart domains identified by Recorded Future content-based detection (Source: Recorded Future)

In terms of sectors, retail and e-commerce were highly represented, as expected. Where Recorded Future was able to attribute more granular sectors to the targeted brands, we found that fashion, food and beverage, publishing, luxury goods, sports, consumer electronics, and cosmetics brands were among the most represented on the fraudulent websites.

Figure 4: Top targeted sectors of impersonated brands, within a sample of DoppelCart domains identified by Recorded Future content-based detection (Source: Recorded Future)

Technical Analysis

While observing the DoppelCart cluster from March to May 2026, we found that the websites used Cloudflare for domain name system (DNS) hosting. Around the middle of May, we observed that existing and new websites began originating from AS199242, routed through Malakmadze Web LLC, a web provider based in Georgia. Within our dataset, over 100,000 pages were observed making this transition while retaining their primary branding. Analysis of the pages that were live before and after the DNS change showed minor changes in the document object model (DOM) structure, but retained several unique fingerprints in their content.

RIPE database records show that the address blocks behind the autonomous system name (ASN) are assigned to RASHOST. Insikt Group assesses with a medium degree of confidence that AS199242 is assigned to a Beijing-based hosting company, with Georgian registry members as the upstream source. Furthermore, Insikt Group found that prior to mid-May 2026, the majority of our detected DoppelCart domains were behind Cloudflare; the shift to Malakmadze Web LLC began after that point and coincided with a sharp increase in detections.

Insikt Group analyzed a sample set of DoppelCart web pages scanned by Recorded Future within the last 90 days. We identified an embedded payment routing configuration (_payment_routing) present in approximately half of those DOMs, the majority of which are labeled with Chinese-language rule names. These include the following:

• “欧洲买家小额走 TKS”: "European buyers, small amounts go via TKS," routed to the “tks” channel.
• “欧洲小额”: "Europe, small amounts," routed to the tks channel.
• “一二线”: "Tier 1–2," which keeps a listed set of websites on the iframe checkout.
• “一二线不走欧通道”: "Tier 1–2 do not use the Europe channel," applied to a listed set of websites.
• “一二线品牌不走欧通道”: "Tier 1–2 brands do not use the Europe channel," applied to a listed set of websites.
• “测试”: "Test," routed to the “tks” channel for a single website.

Notably, the 一二线 rules and the 不走欧通道 exclusion rules contain explicit lists of website IDs in their website conditions. Every list is a subset of the same large set of IDs, and that set is identical across the pages, so the pages appear to inherit one central list. It is possible that these website ID values correspond to identifiers of specific “high-tier” websites on the operator backend. The IDs themselves are 26-character universally unique lexicographically sortable identifiers (ULIDs), a format that encodes the creation time in its first ten characters and is used by the Medusa open-source e-commerce platform. Decoded, the listed IDs date from late March to early September 2026; if these are indeed unique website identifiers, that would indicate this particular cluster began in March 2026. In addition to website IDs, Insikt Group observed that every page embeds a Medusa Publishable Key in its storefront configuration object, where nearly all of the values are unique per domain. As such, Insikt Group assesses with a high degree of confidence that the threat actors within the most recent 90 days in our dataset are using Medusa to manage the storefronts.

Mitigations

For Consumers:

• Verify storefronts before entering payment information and access retailers through known web addresses. Remember that familiar branding, authentic product images, and HTTPS do not guarantee legitimacy.
• Respond promptly to suspected exposure. Contact the card issuer, report the suspected fraud, and discuss replacing or monitoring the affected card. Preserve the storefront address, screenshots, order confirmations, and correspondence to support an investigation.

For Retailers:

• Businesses operating online storefronts and consumer brands should monitor brand impersonation and pursue takedowns for websites that remain live.
• To catch fraudulent storefronts early, customers can use Malicious Site Monitoring, part of Recorded Future Digital Risk Protection, which tracks visual and page content signals, to detect and act on these threats throughout the attack lifecycle.
• To understand how that exposure changes over time, defenders can analyze observations across the Recorded Future® HTML Content Analysis dataset in the Recorded Future Intelligence Platform.
• Warn customers about confirmed impersonation by publishing alerts through official websites and customer communication channels when fraudulent storefronts are identified. Explain how customers can verify legitimate shopping channels and where to report suspected fraud.

About Insikt Group^®

Recorded Future’s Insikt Group, the company’s threat research division, comprises analysts and security researchers with deep government, law enforcement, military, and intelligence agency experience. Its mission is to produce intelligence that reduces risk for customers, enables tangible outcomes, and prevents business disruption.