Scammers rebuild fake shopping sites within hours of takedown

Akamai's Fraud and Abuse Report 2026 describes a retail scam using over 1,200 look-alike .shop domains on a single IP to harvest card numbers, expiry dates and security codes. Replacement sites appear within hours of a takedown thanks to reused phishing kits and shared payment infrastructure.

• Over 1,200 .shop domains on one IP harvested card numbers and CVV codes
• 26.6% of login attempts in July–August 2026 were high or critical risk
• 8.3% of account creation attempts in 2025 were linked to suspected fraud
• Replacement scam sites appear within hours of a takedown