A well-known brand name, 65 percent off, an address ending in .shop: many fake online shops currently look like this. In September 2026 the German security company nebty attributed around 119,000 domains to a single network of identically built shops. Meanwhile the Bavarian consumer advice centre warns about costume shops that appear for Oktoberfest on the same principle.
What is known about the DoppelCart network
On 7 September 2026 nebty, a brand protection provider, published a report on a network of copied online shops and named it DoppelCart. By its own account the report describes the export of 5 September 2026 with page captures up to 4 September. nebty classifies 118,996 distinct domains as belonging to the network, 118,787 of them ending in .shop. Measured against 4,361,908 .shop domains examined, that is 2.72 percent, or roughly every 37th domain.
According to the report, the shops take over product names, descriptions and images from the genuine suppliers. In one case the descriptions were copied word for word, in another the page loaded its graphics directly from the brand’s image server. Advertised discounts of 65 percent come on top. Some shops display the copied brand’s genuine support address. Anyone who receives nothing then complains to a company that never saw the order.
Further details come from the trade publication BleepingComputer, citing nebty and its chief executive. More than 105,000 of the shops were recently still reachable, and 44,182 brands were copied, with a median of two clones per brand. 96 percent of the confirmed shops share the same build files.When testing several checkout pages, nebty found code that collects card number, expiry date, security code and contact details. According to BleepingComputer, each field is transmitted in real time to a server run by the criminals. The bank’s confirmation code can be relayed the same way.We have not examined this code ourselves.
What our own list shows
The nebty figure cannot be recalculated from outside, so we counted in our own data. On 3 October 2026 at 10:51 UTC we retrieved the 200 most recently checked entries of the public fake shop list (check dates 25 September to 3 October 2026). 164 come from a data feed, and for 162 of those the Austrian consumer platform Watchlist Internet is recorded as the source. 36 were confirmed by an automatic rule of our check. These entries have not been reviewed by hand.
- Two kinds of .shop names. Of the 54 .shop entries from the feed, 44 consist of a string of letters without a recognisable word, four to eight characters long. We made this assignment by hand. The 35 .shop entries from the automatic rule look different: a brand or business name, often with an added word. We counted the additions in a second retrieval at 19:22 UTC: 11 of the 36 rule entries carried “store”, “official” or “hq”, see Fake brand outlets.
- Traces of a kit. For 34 of these 35 shops the site icon lies in the same folder structure, and the file name often still carries the name of the copied brand. This matches the description by nebty. We have not checked whether the shops belong to DoppelCart.
- Age of the domains. For 87 domains ending in .com and other endings we queried the registration date via the public RDAP service. 74 of them were registered in 2026. On the reference date 13 were at most 30 days old, 31 at most 90 days and 66 at most 180 days. The median is 121 days. Eight domains were older than one year.
The count has limits. It applies to our data. It says nothing about fake shops as a whole. Our data depends on what Watchlist Internet reports and what our checks processed in those days. The interface returns at most 200 entries, so a longer period could not be analysed. For .shop the registry cut off our age query with a rate limit after a few answers, and for .de and .at this route is not available. The age figures apply only to the 87 domains mentioned.
What the .shop ending says about a shop
The ending says little about a shop. Anyone can register it. By nebty’s calculation, 2.72 percent of the .shop domains examined belong to DoppelCart. A good 97 percent were not attributed to this network. Whether they stand out in other ways, the figure does not say.
Conversely, a familiar ending offers no protection. In our analysis, 79 of the 200 confirmed fake shops end in .com and 20 in .de. What matters to networks is that many addresses can be created in a short time. Which ending currently allows that can change.
How to recognise a cloned shop
A clone looks like the original because it is made of the original’s material. The differences are in the address, the age and the details about the operator. None of these features proves fraud on its own.
- Brand name plus an added word. The address reads something like brand-official.example or brandstore.example. The Austrian fact-checking site Mimikama, which wrote about the nebty report, names “official” and “store” as typical additions. Search for the brand yourself and compare the address with the shop the manufacturer links on its own site.
- Domain only a few weeks old. Watchlist Internet treats a recent registration date as a pointer, because operators register new addresses after a takedown. You can find the domain age via a WHOIS query or in our shop check. A brand that has existed for years rarely sells through an address from last month.
- The same texts in many places. Copy a distinctive sentence from the product description into a search engine. If it appears word for word in the manufacturer’s shop and in other shops with similar addresses, you are dealing with copies.
- A large discount on the whole range. nebty cites 65 percent, the Bavarian consumer advice centre cites 60 percent for traditional costumes along with the line “only a few items left”. Any retailer has the occasional offer. Half price on everything is unusual.
- Legal notice missing or belonging to someone else. Under Section 5 of the German Digital Services Act (DDG) a shop must state name, address and an email address. Clones leave out the legal notice or take over the details of the genuine brand. If the company in the legal notice does not fit the shop’s address, ask the company, using a number you looked up yourself.
- Advertising as the only way in. You arrived through an ad on a social network and cannot find the shop by searching for the brand. The Bavarian consumer advice centre describes this as the usual route to the costume shops.
The general warning signs are on the page Spotting a fake shop. How fakes of well-known brands appear before sale days is described in Fake brand outlets. Reviews help little with a clone, because they often belong to the genuine brand, see Checking shop experiences and reviews.
Dirndls, firewood, gifts: the range follows the calendar
Shops built from a kit can be switched to a new range quickly. On 7 September 2026 the Bavarian consumer advice centre warned about fake shops and supposed costume workshops around Oktoberfest. The shops tell a story of a family business and handcraft in a Bavarian village.According to the centre the goods come from China or not at all, and anyone who withdraws is told to send the dirndl, a traditional Bavarian dress, back there. Its spokesperson Simone Bueb says (our translation): “Fraudsters today design online shops so professionally that at first glance hardly any difference can be seen.”
The German police crime prevention service (ProPK) describes the same pattern across the year: it has repeatedly been seen that fraudsters “react promptly to current trends and set up matching ads or fictitious shops” (our translation).In autumn that means fuel, covered in the article Fake shops for firewood, pellets and heating oil. Before Christmas, toys and electronics follow, see Christmas gifts and fake shops.
Before buying and after entering card details
- Reach the shop via the brand.
Type the brand name into the search or address bar yourself and do not follow a link from an ad. That takes you to the manufacturer’s shop or to a retailer it names.
- Check the address before you type anything.
Enter the domain in the shop check. You see how old it is, whether the legal notice fits a registered company and whether the address is on a warning list. The browser protection shows a notice when you open a listed page.
- Card details entered: call your bank.
According to BleepingComputer, each field of the checkout form is transmitted in real time to a server run by the criminals. Have the card blocked and tell the bank if you entered a confirmation code. On reversing a charge, see Credit card and chargeback.
- Secure the evidence.
Screenshots of the shop, the offer and the order summary, plus emails and the bank statement. How to do this is explained under Securing evidence.
- Report the shop and file a police report.
The online police station of your German federal state is listed under Reporting offices. You can send us the address via Report a shop, and we will check it for the list.
Three checks before you buy
Before you buy, look at the age of the domain, at the word added to the brand name and at the legal notice. The .shop ending is common among such networks and says little on its own. If doubts remain, buy from the manufacturer or from a retailer you know.
