You find a product you want for 65% off.
asserted
you → find → %
The site looks polished, the branding feels familiar and the deal seems hard to pass up.
asserted
deal → look → ?
Cybersecurity company Nebty has linked about 119,000 domains to a fake shopping operation called DoppelCart.
asserted
Nebty → link → operation
The sites impersonate legitimate businesses and can steal payment details at checkout, including one-time bank verification codes.
asserted
sites → impersonate → codes
BleepingComputer reports that more than 105,000 DoppelCart shops were active in Nebty's latest scans, while Nebty says the majority of the cluster remains online.
asserted
majority → report → cluster
So, before you jump on a huge discount from a store you do not recognize, take a closer look at who is really behind the checkout page.
asserted
who → jump → page
Free CyberGuy LIVE class: Get Better Healthcare With AISaturday, September 26 at 11 a.m. ET / 8 a.m. PT
Kurt "CyberGuy" Knutsson will show you five practical ways AI can help you organize your health history, remember important appointment details, understand complicated medical information, research prescriptions and prepare smarter questions for your doctor.
asserted
you → get → doctor
No technical experience is needed.
asserted
experience → need → ?
Save your free spot at CyberGuyLive.com
What is DoppelCart?
asserted
DoppelCart → save → CyberGuyLive.com
Nebty discovered DoppelCart while investigating fake shops that targeted several of its customers.
asserted
that → discover → customers
Researchers noticed that stores impersonating different companies shared technical characteristics.
asserted
stores → notice → characteristics
They began following those connections through publicly available website scans.
asserted
They → begin → scans
The investigation eventually grew to roughly 119,000 associated domains.
asserted
investigation → grow → domains
Nebty says that, to its knowledge, DoppelCart represents the largest publicly documented fake-shop cluster when measured by associated domains.
asserted
DoppelCart → say → domains
The company also makes an important point about attribution.
asserted
company → make → attribution
Shared infrastructure does not prove that one person or organization controls every DoppelCart store.
asserted
person → share → store
Nebty CEO Benedikt Scheungraber told BleepingComputer that 96% of the confirmed shops shared identical build files and resolved to 27 commerce backends.
asserted
% → tell → backends
DoppelCart has swallowed a huge piece of the .shop domain
Most of the domains connected to DoppelCart use the .shop top-level domain.
asserted
DoppelCart → swallow → domain
Nebty's September 2026 data included 118,787 distinct .shop domains linked to the cluster out of 4,361,908 .shop domains in the company's snapshot.
asserted
data → include → snapshot
However, that number needs some context.
asserted
number → need → context
Nebty says the snapshot represents domains listed in the .shop DNS zone.
asserted
snapshot → say → zone
It does not tell us how many legitimate or fraudulent stores were operating at the same moment.
asserted
stores → tell → moment
For comparison, researchers previously documented BogusBazaar, a fake-shop operation involving more than 75,000 domains.
asserted
researchers → document → domains
Nebty cautions that observation periods and counting methods differ between investigations, so the numbers are not perfectly comparable.
asserted
numbers → caution → investigations
We reached out to GMO Registry, which operates the .shop domain, for comment but did not hear back before our deadline.
asserted
which → reach → deadline
Why DoppelCart fake shops can look so convincing
The days when every scam website looked like somebody threw it together in five minutes are long gone.
asserted
somebody → look → minutes
DoppelCart sites can copy product catalogs from real companies along with descriptions, branding and other material.
asserted
sites → copy → descriptions
In some cases, researchers found fake stores loading assets directly from the legitimate company's servers.
asserted
stores → find → servers
That creates a real problem for shoppers.
asserted
That → create → shoppers
You may recognize the brand.
uncertain
You → recognize → brand
The products look right.
asserted
products → look → ?
Nothing on the page immediately screams scam because much of the material came from the real business in the first place.
asserted
much → scream → place
Scheungraber says DoppelCart shops mimic 44,182 different brands, with a median of two clones for each brand.
asserted
shops → say → brand
Some brands received much more attention.
asserted
brands → receive → attention
Researchers found more than 30 shops apiece targeting companies including SodaStream, Velasca, CurrentBody, Daniel Wellington, Dreame, Horze, MOVA and SPARK PAWS.
asserted
Researchers → find → SodaStream
That 65% discount can be the hook
This is where the scam can catch you.
asserted
scam → catch → you
Most of us shop around before spending money online.
asserted
Most → shop → money
Finding the same product at a dramatically lower price can feel like a great deal.
asserted
Finding → find → deal
DoppelCart stores take advantage of that reaction.
asserted
stores → take → reaction
Researchers found fake shops advertising discounts as high as 65%.
asserted
Researchers → find → %
…and 83 more, not listed.
The Aporia
