Threat IntelligenceOct 30, 2026

Scammers rebuild fake shopping sites within hours of a takedown

Scammers quickly replace fake shopping and ticketing sites after takedowns using reused infrastructure.

Scammers are rapidly rebuilding fake shopping and ticketing websites within hours of their removal, often using reused code and infrastructure. These sites are designed to harvest payment card details, personal information, and even identity documents. The attackers leverage bulk domain registration and compromised websites to maintain operations, quickly rerouting traffic to new domains if one is blocked.

AI summary of the linked source. Not reviewed by an editor. How this works

Read at source

Vendor Watch

Run Akamai?

Get an email when a new story names Akamai, usually within the hour.

Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch works Privacy

The lesson from this incident

Full lesson

Scammers are demonstrating sophisticated resilience by rebuilding fraudulent shopping and ticketing websites within hours of removal, exploiting bulk domain registration and compromised infrastructure to stay operational. The root issue lies in inadequate incident response coordination and consumer security awareness — takedowns alone are insufficient when attackers can instantly reroute traffic to new domains using pre-built, reusable code. These sites harvest payment card details, personal information, and identity documents, making the financial and reputational harm to victims severe. The speed of reconstruction highlights that reactive takedown strategies must be paired with proactive consumer education, payment fraud detection, and systemic infrastructure monitoring to have lasting effect.

What helps against this

How we list vendors

Akamai research

Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.
For exampleDataminr Threat Intelligence CrowdStrike Falcon Adversary Intelligence Defused TF all options
DNS filtering and secure web gateway
Users cannot reach known-malicious sites, and malware cannot phone home.
For exampleZscaler Internet Access Palo Alto Networks Prisma Access Quad9 DNS all options
Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
For exampleAbnormal AI Abnormal Inbound Email Security Microsoft Defender for Office 365 Cloudflare Email Security all options

Entities

Akamai (vendor)