A German security company has traced roughly 119,000 web domains to a single fake shop operation, which it believes is the largest of its kind ever documented in public. The stores look like the online shops of real brands, because their product pages have been copied from them, and the shoppers who order from them get nothing.
The company, Nebty, calls the cluster DoppelCart. It published its investigation this week along with a searchable database of every domain it found, so that businesses can check whether their own name is being used.
One in every 37 shop domains
The number is easier to grasp as a proportion. Nebty counted 118,787 distinct domains in the cluster under the .shop ending alone. Set against the 4,361,908 registered .shop domains in the snapshot it examined this month, that is 2.72 percent, or about one domain in every 37.
For comparison, the best known earlier case, a network called BogusBazaar that researchers described in 2024, involved a little over 75,000 domains.
The investigation started small. Nebty was removing fake shops that imitated several of its customers and kept running into the same providers and the same technical patterns. Using publicly available website scans, it connected a few thousand domains, and the trail kept going. Behind tens of thousands of different shop names it found the same foundation: shared infrastructure and recurring features in the shop software. In total the company archived 106,095 pages as evidence.
Copied catalogs, borrowed credibility
What makes the stores convincing is that almost nothing on them is invented. A visitor is looking at product names that exist, at descriptions written by the brand and at the brand's own photographs. In one store Nebty examined, the descriptions matched the genuine retailer's word for word, down to explanations of how the products are constructed. In another, the page loaded its product graphics and icons straight from the real brand's own image server.
A shopper who already knows the products has little reason for doubt, especially when the price is lower than usual.
The victims are not only the buyers. Nebty's customers report a steady flow of complaints about orders that never arrived, from people who are convinced they bought from the real company. Some of the fake shops make this worse by listing the genuine store's support address as their own contact. To a buyer that looks like one more sign of authenticity. When the parcel fails to appear, the complaint lands in the inbox of a business that never received the order or the money, and its staff are left to explain what happened.
Most of it is still online
Nebty says the takedowns it has carried out against individual stores in the cluster have held, with the removed shops staying offline. The bulk of the network, however, is still up.
The database it has published can be searched by brand name or by domain. It covers confirmed members of the cluster and also lists domains that are only suspected, ones that have since gone dead and ones the researchers looked at and excluded. Nebty is inviting corrections, on the grounds that a dataset this large needs to be open to scrutiny.
For shoppers the practical advice is old but still valid. Go to a retailer through an address already known to be right, not through an advertisement or a search result. Treat an unusually deep discount on a familiar brand as a reason to look twice at the address bar. And anyone who has entered card details on a store that then went silent should call their card issuer before waiting for a refund that will not come.
