As cited
Copy frozen at (site build).
threat intel
Scammers rebuild fake shopping sites within hours of a takedown
Scammers operate networks of over 1,200 lookalike .shop domains sharing a single IP address to harvest payment card data through fake retail and ticketing sites. These fraudulent operations reuse common HTML, JavaScript, and payment page templates to impersonate legitimate shopping and event portals. According to Akamai's Fraud and Abuse Report 2026, takedowns of such sites result in rapid rebuilds using similar infrastructure.
Why it matters: E-commerce and event platforms need to monitor for lookalike domain registrations and implement payment verification controls; payment processors and card networks must detect and block fraudulent checkout flows targeting their customers.
- Source published
- First seen by Cybersecurity Tracker