Recorded Future has linked approximately 261,700 suspected domains to DoppelCart, a large fake online shopping network that copies genuine retailers to steal shoppers' payment details. The cyber threat intelligence firm's Insikt Group said about 40% of the suspect websites it observed before 17 October 2026 were still active.

The fake storefronts copy legitimate retailers' branding, product listings and images, then send the personal and payment information shoppers enter at checkout to attacker-controlled servers in real time. Recorded Future said some of the sites also capture one-time verification codes issued by banks, which can let criminals authorise transactions while victims believe they are completing a genuine purchase.

How the network grew

Recorded Future said it identified the domains mainly between March and October 2026. Detections began appearing in small numbers in January, rose through March, and peaked in June and July before new detections fell sharply from August. The firm said the drop in new hosts does not necessarily mean the operation is shrinking, as many previously registered domains remain active and the operators may have shifted to maintaining existing infrastructure rather than expanding it.

The network was first exposed in September 2026 by German cybersecurity company Nebty, which linked around 119,000 domains to the cluster. Recorded Future's wider scan more than doubled that count. Most of the domains originally used .shop web addresses, but the firm said .com domains began to account for a larger share from September 2026, suggesting a change in the operators' tactics.

Who is being impersonated

Based on the home countries of the impersonated brands, the most targeted countries were the United States, the United Kingdom, Australia, Canada and Germany, with the overwhelming majority of impersonated brands based in the US. Retail and e-commerce brands were the most represented, and among the sectors Recorded Future could identify, fashion, food and beverage, publishing, luxury goods, sports, consumer electronics and cosmetics featured most often.

The researchers also traced a change in hosting. The sites used Cloudflare for domain name system hosting until around the middle of May 2026, when more than 100,000 pages moved to an autonomous system routed through Malakmadze Web LLC, a web provider based in Georgia. Recorded Future said it assesses with medium confidence that the address blocks are assigned to a Beijing-based hosting company.

Shared checkout code links the shops

In a sample of DoppelCart pages scanned in the last 90 days, the researchers found an embedded payment-routing setting in about half of them, mostly labelled with Chinese-language rule names. The pages also carried website identifiers in a format used by Medusa, an open-source e-commerce platform, and every page embedded a Medusa publishable key. Recorded Future said it assesses with high confidence that the threat actors behind the cluster are using Medusa to run the storefronts.

Nebty had cautioned when it first published its findings that shared infrastructure does not prove a single criminal organisation controls every DoppelCart store, and Recorded Future's figures describe suspected domains rather than confirmed fraudulent businesses.

How shoppers can stay safe

Recorded Future advised consumers to reach retailers through web addresses they already know, and warned that familiar branding, genuine product images and HTTPS do not guarantee a shop is legitimate. Anyone who suspects they entered card details on a fake store should contact their card issuer promptly, discuss replacing or monitoring the card, and keep the store's address, screenshots, order confirmations and any correspondence. Retailers were advised to monitor for brand impersonation and pursue takedowns of sites that remain live.