[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fb-uomF0-MYjNntoUWLYhPbuzzGxMrCDabiaGR8xlatY":3},{"article":4,"iocs":43,"watch_terms":44,"solutions":45,"lesson":139},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"55260ab6-de15-460d-904d-7f1b429f8c84","Scammers rebuild fake shopping sites within hours of a takedown","scammers-rebuild-fake-shopping-sites-within-hours-of-a-takedown-9c066f","One retail scam used more than 1,200 look-alike .shop domains sharing a single IP address. The sites reused HTML, JavaScript and payment-page designs intended to harvest card numbers, expiry dates and security codes, according Akamai’s Fraud and Abuse Report 2026. A ticket scam used a similar setup. Several websites impersonating official ticketing and hospitality portals for a major sporting event were designed to route payment and personal information to the same collection system. Some checkout … More → The post Scammers rebuild fake shopping sites within hours of a takedown appeared first on Help Net Security.","Scammers are rapidly rebuilding fake shopping and ticketing websites within hours of their removal, often using reused code and infrastructure. These sites are designed to harvest payment card details, personal information, and even identity documents. The attackers leverage bulk domain registration and compromised websites to maintain operations, quickly rerouting traffic to new domains if one is blocked.","Scammers quickly replace fake shopping and ticketing sites after takedowns using reused infrastructure.","https:\u002F\u002Fwww.helpnetsecurity.com\u002F2026\u002F10\u002F30\u002Fakamai-fake-account-abuse-report\u002F","https:\u002F\u002Fimg.helpnetsecurity.com\u002Fwp-content\u002Fuploads\u002F2026\u002F06\u002F18102132\u002Fscams-1500-2.webp","2026-10-30T05:30:26+00:00","2026-10-30T06:00:16.626478+00:00",7,[17],{"name":18,"type":19},"Akamai","vendor","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":20,"icon":22,"name":23,"slug":24},null,"Threat Intelligence","threat-intelligence",[26,31,36,41],{"category":27},{"id":28,"icon":22,"name":29,"slug":30},"02371804-cf6d-4449-98de-f1a2d4d9b266","Tools","tools",{"category":32},{"id":33,"icon":22,"name":34,"slug":35},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":37},{"id":38,"icon":22,"name":39,"slug":40},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":42},{"id":20,"icon":22,"name":23,"slug":24},[],[18],{"controls":46,"vendors":133},[47,75,104],{"slug":24,"name":48,"problem":49,"products":50},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[51,59,67],{"vendor_slug":52,"vendor_name":53,"vendor_logo":54,"product_slug":55,"product_name":56,"url":57,"description":58},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",{"vendor_slug":60,"vendor_name":61,"vendor_logo":62,"product_slug":63,"product_name":64,"url":65,"description":66},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",{"slug":76,"name":77,"problem":78,"products":79},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",[80,88,96],{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"zscaler","Zscaler","\u002Fvendor-logos\u002Fzscaler.png","zscaler-internet-access","Zscaler Internet Access","https:\u002F\u002Fwww.zscaler.com\u002Fproducts-and-solutions\u002Fzscaler-internet-access","Cloud secure web gateway with DNS security, inspection and data protection.",{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","prisma-access","Prisma Access","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fsase\u002Faccess","Cloud-delivered SASE: zero trust access to private apps and secure web gateway.",{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"quad9","Quad9","\u002Fvendor-logos\u002Fquad9.png","quad9-dns","Quad9 DNS","https:\u002F\u002Fwww.quad9.net\u002F","Free, privacy-focused DNS resolver that blocks malicious domains using threat intelligence feeds.",{"slug":105,"name":106,"problem":107,"products":108},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[109,117,125],{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-office-365","Microsoft Defender for Office 365","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365","Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-email-security","Cloudflare Email Security","https:\u002F\u002Fwww.cloudflare.com\u002Fsase\u002Fproducts\u002Femail-security\u002F","Email filtering for phishing and business email compromise.",[134],{"slug":135,"name":18,"logo_path":136,"roles":137},"akamai","\u002Fvendor-logos\u002Fakamai.png",[138],"reported_by",{"slug":140,"title":141,"body":142,"framework_refs":143,"framework_notes":151},"fake-shopping-sites-resurrect-within-hours-of-takedown","Fake Shopping Sites Resurrect Within Hours of Takedown","Scammers are demonstrating sophisticated resilience by rebuilding fraudulent shopping and ticketing websites within hours of removal, exploiting bulk domain registration and compromised infrastructure to stay operational. The root issue lies in inadequate incident response coordination and consumer security awareness — takedowns alone are insufficient when attackers can instantly reroute traffic to new domains using pre-built, reusable code. These sites harvest payment card details, personal information, and identity documents, making the financial and reputational harm to victims severe. The speed of reconstruction highlights that reactive takedown strategies must be paired with proactive consumer education, payment fraud detection, and systemic infrastructure monitoring to have lasting effect.",[144,145,146,147,148,149,150],"CIS Control 17: Incident Response Management","CIS Control 14: Security Awareness and Skills Training","MITRE ATT&CK T1566: Phishing","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","GDPR Article 32","PCI DSS Requirement 6","NIS2 Article 21(2)(b)",{"GDPR Article 32":152,"NIS2 Article 21(2)(b)":153,"PCI DSS Requirement 6":154,"MITRE ATT&CK T1566: Phishing":155,"CIS Control 17: Incident Response Management":156,"CIS Control 14: Security Awareness and Skills Training":157,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":158},"Harvesting payment card details, personal information, and identity documents without consent represents a data breach risk that GDPR Article 32 obligates organisations to prevent through appropriate technical and organisational security measures.","NIS2 requires incident handling capabilities including rapid response to cyber threats; the hours-long gap between takedown and site resurrection demonstrates the need for the continuous monitoring and coordinated incident response NIS2 mandates for essential and important entities.","Fake checkout pages that steal payment card details underline the importance of PCI DSS Requirement 6, which mandates secure development, anti-phishing controls, and protection of payment pages from skimming and spoofing attacks.","These fake shopping sites are a form of spear-phishing via malicious URLs designed to harvest credentials and payment data, making T1566 directly applicable for detection and mitigation guidance.","Scammers rebuild within hours because current takedown processes are slow and uncoordinated; a structured incident response plan with defined escalation paths and registrar partnerships would dramatically reduce the window of victim exposure.","Victims fall for fake shopping sites due to insufficient ability to identify fraudulent web properties; regular, targeted consumer and employee training on spotting scam indicators directly reduces the pool of potential victims.","Compromised websites used as infrastructure to host scam pages indicate weak access controls on legitimate hosting accounts; enforcing strong authentication for hosting and domain management would limit attacker reuse of those assets."]