Akamai’s Fraud and Abuse Report 2026 describes a routine that favors the scammers: when a counterfeit store is pulled offline, the operators can have a replacement running within hours. One retail scam in the report used more than 1,200 look-alike .shop domains that all pointed to a single IP address. The findings arrive just as holiday shoppers begin hunting for deals.
Tech news in one quick read: Get the most interesting stories in startups, tech and programming, each with a short TLDR, in one daily email from TLDR.
We may earn a commission if you sign up.
Akamai announced the report, titled AI-Driven Digital Deception, on October 29, 2026, and Help Net Security summarized it a day later. The top-line numbers describe a fraud market that is growing and speeding up. Online scam detections roughly doubled, from about 3.2 million to about 6.4 million, and passed traditional phishing for the first time in the first quarter of 2026. The average lifespan of a phishing attack fell from 48 days in the fourth quarter of 2025 to 22 days in the second quarter of 2026.
One IP address behind 1,200 .shop storefronts
According to the Help Net Security summary of the report, the retail scam reused the same HTML, JavaScript and payment-page designs across its domains, with checkout forms built to collect card numbers, expiry dates and security codes. Because every address resolved to the same infrastructure, the domains worked as spare entrances to one operation: block or remove one, and another could keep feeding the same collection system. A parallel ticket scam impersonated official ticketing and hospitality portals for a major sporting event, and some of its checkouts asked for passport or ID details on the pretext of ticket delivery or event access.
The pattern is not confined to one campaign. Stefan Dasic, a senior malware research engineer at Malwarebytes, described a network of more than 20,000 fake shops, most of them on .shop, that resolved to only 36 IP addresses in a March 2026 analysis. His write-up says that when one site is flagged or taken down, another takes its place, and that the shared server clustering is also a weakness, since disrupting a small number of servers could take thousands of storefronts offline.
A bigger cluster surfaced in September. The German startup Nebty identified more than 119,000 domains tied to a network called DoppelCart, most of them on .shop, and said 96% of the confirmed shops shared identical build files and resolved to 27 commerce backends, BleepingComputer reported. Nebty added that its attempts to contact the main hosting provider drew no response.
Dormant domains and visitor-based cloaking
Akamai says the operators register look-alike domains in bulk and leave them dormant for weeks or months so the addresses build a clean reputation before any shopper sees them. Some sites change what they display depending on the visitor. Security scanners may be served harmless content while real victims see the fraud, with location and browser data deciding which page appears. Attackers also place phishing pages on compromised legitimate websites to borrow their standing, and reused phishing kits, hosting and payment infrastructure are what let replacement sites appear within hours of a takedown.
The 22-day average phishing lifespan in Akamai’s October 29 announcement is consistent with that picture. Sites that die faster are cheap to replace when the kit, the hosting and the payment plumbing stay in place, so a shorter lifespan does not necessarily mean fewer victims.
Stolen logins after the checkout page
Card numbers typed into a fake checkout are only one product. Akamai says credentials exposed in scams and breaches are tested automatically against other services, and reused passwords can open saved payment methods, reward points and personal details. In a 30-day sample covering July and August 2026, the company classified 26.6% of recorded login attempts as high or critical risk, and 40% of that risky traffic was account verification requests, the probes attackers use to learn whether an email address has an account before trying credential stuffing. Commerce had the highest share of total login attempts at 41.1%.
Fake accounts feed the same economy. Akamai linked 8.3% of account creation attempts in 2025 to suspected fraud, from welcome-bonus abuse to small test transactions that confirm a stolen card works before larger purchases.
Patrick Sullivan, Akamai’s chief technology officer for security strategy, said the fight against fraud “is no longer just an isolated financial function.”
Spotting a storefront before it disappears
Shoppers cannot see an IP address, but the payment request is visible. The FTC’s guidance on avoiding scams lists cryptocurrency, wire transfers, payment apps and gift cards as the routes scammers push, and says anyone pressuring a buyer to pay or hand over personal information is a scammer. A discount store that insists on one of those methods, or a ticket checkout that wants a passport number, trips both warnings at once.
What the public summaries leave open is how many of the 1,200 domains were ever removed and how quickly the successors appeared. Help Net Security’s write-up does not link the full report, so the within-hours timing rests on Akamai’s description of the pattern rather than a published takedown log.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
Tech news in one quick read: Subscribe to TLDR →
We may earn a commission if you sign up.
More from Morning Overview
- The NSA says three phone features should be off whenever you aren’t using them
- Hurricane Hunter radar shows four warning signs that a tropical cyclone is about to strengthen, a University of Miami study found
- Tropical Storm Rachel is dumping up to 12 inches on four Mexican states on its way to major hurricane strength
- The FTC says Lens.com doubled the price shoppers saw in Google ads
