Recorded Future Identifies 261,700 Suspected DoppelCart Domains
Summary
Recorded Future identified about 261,700 suspected DoppelCart domains. Its analysis found a hosting shift, shared payment-routing configurations and evidence of Medusa storefront use; the shops impersonate retailers to collect payment data, with about 40% still active.
Key points
- Recorded Future identified about 261,700 unique apex domains likely associated with DoppelCart, primarily between March and October 2026; about 40% of observed suspect sites remained active as of October 17.
- More than 100,000 pages shifted from Cloudflare to infrastructure routed through AS199242 and Malakmadze Web LLC around mid-May, while retaining their branding.
- About half of the sampled page DOMs contained an embedded _payment_routing configuration, with rules routing transactions by buyer region or website group.
- Unique Medusa Publishable Keys and shared website-ID lists provided evidence of Medusa use; Insikt Group assessed this with high confidence.
- The storefronts copy legitimate retailers to solicit personal and payment information. The article also cites reporting that some capture bank-issued verification codes.
- Earlier research cited in the article cautioned that shared website characteristics did not establish that one criminal organization operated the entire network.
- The article advises consumers to use known retailer addresses and contact card issuers after suspected exposure; it recommends retailers monitor impersonation and notify customers.
Article Details
- Attack Vectors
- Fraudulent storefronts impersonate legitimate retailers by copying their branding, product listings, images, and descriptions.
- Fraudulent checkout pages collect shoppers’ personal and payment information and transmit it to attacker-controlled servers; some also capture bank-issued one-time verification codes.
- The storefronts use embedded payment-routing configurations to direct checkout activity through different channels.
- The network uses a large number of domains, with observed websites shifting from predominantly .shop domains toward more .com domains starting in September 2026.
- Defensive Notes
- Consumers should verify storefronts and access retailers through known web addresses; familiar branding, authentic product images, and HTTPS do not guarantee legitimacy.
- Anyone who suspects their information was exposed should promptly contact their card issuer, report suspected fraud, and discuss replacing or monitoring the affected card. Preserve the storefront address, screenshots, order confirmations, and correspondence.
- Retailers and consumer brands should monitor for brand impersonation and pursue takedowns of fraudulent websites that remain live.
- Retailers should publish alerts through official websites and customer communication channels when impersonation is confirmed, explaining how customers can verify legitimate shopping channels and report suspected fraud.
MITRE ATT&CK
Threat Actors
Vendors
CloudflareWhile observing the DoppelCart cluster from March to May 2026, we found that the websites used Cloudflare for domain name system (DNS) hosting.Malakmadze Web LLCAround the middle of May, we observed that existing and new websites began originating from AS199242, routed through Malakmadze Web LLC, a web provider based in Georgia.
Products
Countries
Australiacountries targeted by DoppelCart in our dataset were the United States (US), the United Kingdom (UK), Australia, Canada, and Germany, with the overwhelming majority of impersonated brands being from the US.Canadatargeted by DoppelCart in our dataset were the United States (US), the United Kingdom (UK), Australia, Canada, and Germany, with the overwhelming majority of impersonated brands being from the US.GeorgiaAround the middle of May, we observed that existing and new websites began originating from AS199242, routed through Malakmadze Web LLC, a web provider based in Georgia.GermanyDoppelCart in our dataset were the United States (US), the United Kingdom (UK), Australia, Canada, and Germany, with the overwhelming majority of impersonated brands being from the US.United Kingdombrands, the top countries targeted by DoppelCart in our dataset were the United States (US), the United Kingdom (UK), Australia, Canada, and Germany, with the overwhelming majority of impersonated brands beingUnited Statesof the impersonated brands, the top countries targeted by DoppelCart in our dataset were the United States (US), the United Kingdom (UK), Australia, Canada, and Germany, with the overwhelming majority of
Industries
consumer electronicsthe targeted brands, we found that fashion, food and beverage, publishing, luxury goods, sports, consumer electronics, and cosmetics brands were among the most represented on the fraudulent websites.Cosmeticswe found that fashion, food and beverage, publishing, luxury goods, sports, consumer electronics, and cosmetics brands were among the most represented on the fraudulent websites.FashionWhere Recorded Future was able to attribute more granular sectors to the targeted brands, we found that fashion, food and beverage, publishing, luxury goods, sports, consumer electronics, and cosmetics brands were amongFood and BeverageFuture was able to attribute more granular sectors to the targeted brands, we found that fashion, food and beverage, publishing, luxury goods, sports, consumer electronics, and cosmetics brands were among the mostLuxury goodsmore granular sectors to the targeted brands, we found that fashion, food and beverage, publishing, luxury goods, sports, consumer electronics, and cosmetics brands were among the most represented on the fraudulentPublishingto attribute more granular sectors to the targeted brands, we found that fashion, food and beverage, publishing, luxury goods, sports, consumer electronics, and cosmetics brands were among the most represented onRetail and e-commerceIn terms of sectors, retail and e-commerce were highly represented, as expected.Sportssectors to the targeted brands, we found that fashion, food and beverage, publishing, luxury goods, sports, consumer electronics, and cosmetics brands were among the most represented on the fraudulent websites.