Akamai report: scammers rebuild fake shopping sites within hours; 1,200+ look-alike .shop domains on one IP
Akamai's Fraud and Abuse Report 2026 describes how fraud operators keep scam infrastructure alive by registering look-alike domains in bulk and replacing taken-down sites within hours. One retail scam used more than 1,200 look-alike .shop domains on a single IP address, reusing HTML, JavaScript and payment-page designs to harvest card numbers, expiry dates and security codes. A ticket scam impersonated ticketing and hospitality portals for a major sporting event, and some checkouts requested passport or ID details. The report also covers credential stuffing, account-opening abuse and SMS pumping.
Detalhes técnicos
- Look-alike domains are registered in bulk and left dormant for weeks or months to build a clean reputation before a scam launches.
- Cloaking: sites show harmless content to automated scanners and the fraudulent offer to intended victims, based on location and browser information.
- Phishing pages are hosted on compromised, reputable websites.
- Reused phishing kits, hosting and payment infrastructure let replacement sites appear within hours of a takedown.
- A paid social media advert led to a counterfeit app marketplace that delivered a malicious app abusing device permissions.
- Recruitment scams on four major social platforms led to phishing forms collecting sensitive data.
- Credential stuffing: in a 30-day sample across July and August 2026, 26.6% of login attempts were high or critical risk, and account verification requests made up 40% of that traffic.
- 8.3% of account creation attempts in 2025 were linked to suspected fraud, used for bonus abuse, card testing and stock hoarding.
- SMS pumping: automated registration or password-reset requests trigger messages to premium-rate international numbers, sometimes with rogue telecom carriers sharing the revenue.
Remediação
The article does not give specific remediation guidance.
Linha do tempo
-
Akamai report: scammers rebuild fake shopping sites within hours; 1,200+ look-alike .shop domains on one IP
ler a análise desta fonte ocultar
Akamai's Fraud and Abuse Report 2026 describes how fraud operators keep scam infrastructure alive by registering look-alike domains in bulk and replacing taken-down sites within hours. One retail scam used more than 1,200 look-alike .shop domains on a single IP address, reusing HTML, JavaScript and payment-page designs to harvest card numbers, expiry dates and security codes. A ticket scam impersonated ticketing and hospitality portals for a major sporting event, and some checkouts requested passport or ID details. The report also covers credential stuffing, account-opening abuse and SMS pumping.
Technical Details
- Look-alike domains are registered in bulk and left dormant for weeks or months to build a clean reputation before a scam launches.
- Cloaking: sites show harmless content to automated scanners and the fraudulent offer to intended victims, based on location and browser information.
- Phishing pages are hosted on compromised, reputable websites.
- Reused phishing kits, hosting and payment infrastructure let replacement sites appear within hours of a takedown.
- A paid social media advert led to a counterfeit app marketplace that delivered a malicious app abusing device permissions.
- Recruitment scams on four major social platforms led to phishing forms collecting sensitive data.
- Credential stuffing: in a 30-day sample across July and August 2026, 26.6% of login attempts were high or critical risk, and account verification requests made up 40% of that traffic.
- 8.3% of account creation attempts in 2025 were linked to suspected fraud, used for bonus abuse, card testing and stock hoarding.
- SMS pumping: automated registration or password-reset requests trigger messages to premium-rate international numbers, sometimes with rogue telecom carriers sharing the revenue.
Remediation
The article does not give specific remediation guidance.