Scammers Rapidly Rebuild Fake Shopping Sites Within Hours of Takedowns
Cybercriminals are demonstrating remarkable agility, rebuilding compromised or blocked fake shopping and ticketing websites within hours of their removal, according to Akamai's latest Fraud and Abuse Report.
Scammers are exhibiting an alarming level of efficiency in their operations, capable of reconstituting fake online storefronts and ticketing portals mere hours after they are taken down. This rapid rebuilding capability, detailed in Akamai's Fraud and Abuse Report 2026, highlights the persistent and adaptive nature of online fraud.
One particularly concerning retail scam involved the use of over 1,200 look-alike .shop domains, all hosted on a single IP address. These fraudulent sites were designed to mimic legitimate e-commerce platforms, reusing identical HTML, JavaScript, and payment page layouts. The primary objective was to harvest sensitive payment card details, including numbers, expiry dates, and security codes, from unsuspecting shoppers.
A similar tactic was observed in a scam targeting fans of a major sporting event. Multiple websites impersonating official ticketing and hospitality portals were created, all funneling stolen payment and personal information to a common collection system. In some instances, these fake checkout flows even requested passport or identity document details under the guise of verifying ticket delivery or event access, further escalating the potential for identity theft.
The strategy of using numerous domains linked to a single IP address provides criminals with multiple entry points into their operation. If one domain is identified and blocked or removed by authorities or hosting providers, others can continue to direct stolen data to the shared collection infrastructure. This resilience allows the fraudulent operation to persist, feeding data that can be used for various forms of financial fraud, account takeovers, and broader identity abuse.
Beyond e-commerce and ticketing, the report also details other evolving scam tactics. One documented campaign leveraged paid social media advertisements to direct consumers to a counterfeit app marketplace. Upon visiting, users were enticed to download a malicious application that not only collected sensitive information but also abused device permissions for further exploitation. Recruitment scams have also become more sophisticated, with fake hiring content appearing across multiple social platforms, leading individuals to phishing forms designed to capture personal details under the guise of job applications.
Attackers are employing advanced techniques to evade detection and maintain their operations. They often register look-alike domain names in bulk and leave them dormant for extended periods, allowing the domains to build a seemingly clean reputation before a scam is launched. Furthermore, some sites dynamically alter their content based on visitor information, presenting harmless material to automated security scanners while displaying the fraudulent offer to genuine targets. This personalization, often based on location or browser data, makes automated detection significantly more challenging.
The report also touches upon the exploitation of credentials obtained from previous data breaches. Automated programs systematically test these exposed credentials across various services. When users reuse passwords, attackers can gain access to existing accounts, including saved payment methods, loyalty points, or personal information. They can then alter account details and recovery settings, making it difficult for the legitimate owner to regain control, effectively turning compromised passwords into unauthorized purchases and further fraud.
This rapid rebuilding and adaptive nature of scam operations underscore the need for continuous vigilance from both consumers and cybersecurity professionals. The ability of these criminal enterprises to quickly pivot and re-establish their infrastructure after takedowns presents a significant and ongoing challenge in the fight against online fraud.