SecurityHeroblog
Security Basics20views

One More Locker in the Hallway — 119,000 Fake Online Shops

An investigation found that the discount shopping sites you see in ads lifted their photos, their product descriptions, and even their customer service numbers straight from the real brands. 119,000-plus confirmed addresses, 44,000 brands whose names were stolen. Here's what to look at before you type a card number into a checkout page.

Lockers stand in a long row down a school hallway. Mine is the fourth from the left on the third floor, and I have the number memorized.

One day another locker appears next to it. Same color, same handle. The number plate on the door matches, and even the homeroom teacher’s name on the label is real. There is exactly one difference.

It has no back panel.

When I open the door and put my wallet in, the wallet does not stay inside the locker. It falls straight through the opening in the back — into the hands of someone standing in the hallway on the other side. Right up to the moment I close the door, I know nothing.

An investigation published this week says this is happening at enormous scale on online shopping sites. This post rides that locker all the way to the end.

First, what happens on my side

A brand discount link shows up in a social media feed or a search ad. I tap it and the page looks well built. The product photos are clean, the descriptions read naturally. There is even a padlock icon in the address bar. But the price is far below list.

I add it to the cart and move to the checkout page. I type the card number, then the expiration date, then the three digits on the back of the card (the CVC). I fill in my name, phone number, and shipping address. Finally I copy over the one-time confirmation code my bank texted me — a temporary password that disappears once it is used — into that screen.

The payment goes through. But no order confirmation email arrives. Neither does the item.

FACT Here is the nastiest part of the scheme. The customer service contact listed on the site is the real brand’s real contact number. If I call in anger, the person who picks up is not the scammer but an actual employee of the real company. And they tell me no such order exists. I find out where I got hit only after calling the real company.

It is the same as the homeroom teacher’s name on the locker label. If I run to the staff room to report my things missing, the teacher says they never assigned a locker like that.

FACT As for where the values typed into the checkout page go, BleepingComputer reported that the card number, expiration date, CVC, name, email, phone number, and address — along with the one-time confirmation code sent by the bank — are collected and passed in real time to an attacker server. This detail does not appear in the public material from the firm that ran the investigation; it is only in that report. So the most we can say right now is not “this is so,” but “this was reported.”

INFERRED If the report is right, the leak is not structured to happen after the pay button is pressed — it is already happening while you type. Which would mean pressing cancel does no good. A locker with no back panel does not care whether the door is closed or not.

Why this works — because it was lifted wholesale from the real thing

It is best to drop the assumption that fake shopping sites look shoddy.

FACT These shops copy the real brands’ product photos and product descriptions verbatim. So of course the photos do not look off. They came from the original. Only the price is slashed and pasted on top.

INFERRED The padlock icon is no basis for judgment either. The padlock in the address bar is not a stamp saying “this site is trustworthy.” It only means “nobody alongside can peek at what passes between me and this site.” It is the same as how a sturdy padlock on a locker is no proof that the locker is mine. A lock protects the box; it does not tell you who owns the box.

FACT Circumstantial evidence that these are stamped out from a mold was also reported. 96% of the confirmed shops are said to be built from the same skeleton file, and the servers they connect to cluster into 27 groups. It amounts to pressing the frame in one place and setting it down in hallway after hallway. This, too, appears only in the report.

FACT The bait is the size of the discount. They were reported to make it look like as much as 65% off. That means something priced at 100,000 won appears as 35,000 won. When it is this cheap, you have not caught a good opportunity — you are more likely standing in front of bait.

The scale, in numbers

Let’s look at the numbers first. Please read the third column (where the number came from) along with them. Confirmed figures and report-only figures are mixed together here.

Number What Source
119,012 Count of fake shop addresses linked into one network nebty’s own database (confirmed)
44,783 Number of brands whose names were stolen nebty’s own database (confirmed)
2.72% Share of all .shop sites this cluster accounts for nebty report (confirmed)
65% Discount depth used to draw people in BleepingComputer (report only)

The data collection date is 2026-09-05.

119,000 is a hard number to grasp. Shutting down 100 of them a day would take more than three years. And new addresses keep opening during that time. Which is why the approach of memorizing “this address is a scam” one at a time and avoiding them does not hold up from the start. It is not that one fake locker was placed in the hallway — new ones are placed every morning.

FACT The brand count of 44,000 has to be read alongside it. Checking one brand a day would take more than 120 years to get through the list. There is one conclusion to draw from this. The fact that a brand name I know is attached to a site is no evidence whatsoever that the site is real. If anything, the better known the brand, the likelier it is to be on the impersonation list. For the record, the brands on this list are not the perpetrators — they are the ones whose names were taken.

FACT Close to 3 out of every 100 addresses ending in .shop belong to this cluster. The part tacked onto the very end of an address — things like .com or .co.kr — is called the top-level domain, and here most of them use .shop.

INFERRED That does not mean “.shop equals scam.” More than 97% of .shop sites are perfectly fine. But if the end of an address differs from what you usually see, that is reason enough to stop instead of clicking through and take one more look.

FACT A previously known cluster of similar fake shops was said to be on the order of 75,000 sites. The report’s account is that this one is the largest yet disclosed.

So, what to do now

There are two things to do. Neither is hard.

One. Right before you type a card number, look at the address bar.

Match the address of the page you are looking at directly against the brand’s official site address. Do not just skim it with your eyes — open the official site separately and put them side by side. And here is the key part: do not type a card number on a page you landed on by tapping an ad link. If you find something you want, close that link, search the brand name yourself or open the official app you normally use, and buy it there. It is exactly as much work as checking the number plate before putting your things in a locker.

Two. If you already typed it, contact your card issuer today.

Freeze the card you used and request a reissue. Then go through your recent transactions. This is not something you do after confirming the item never arrived — you do it the moment you realize you typed it in. There is nothing to be embarrassed about, either. The photos, the descriptions, and the phone number on that page were all lifted from the real thing.

What We Don’t Know

This blog does not write unconfirmed things as if they were confirmed. Here is what we still do not know about this case.

  • We do not know how many people in Korea were hit. Neither the domestic scale of harm nor the domestic entry paths appear in this investigation.
  • We do not know who runs it. What country the group is in has not been established either. That is why this post attaches no nationality and no organization name.
  • We do not know the actual number of victims. 119,000 is a count of sites, not a count of victims. These are completely different values.
  • We do not know how the intercepted one-time bank confirmation codes are actually used. The report offers no explanation. We cannot state definitively that they are used immediately to authorize payments.
  • We do not know the main route by which people reach these sites. Whether ads, search, or social media — there is no settled explanation.
  • The exact publication date of the investigation report is not stated. The reference date for the figures in this post is 2026-09-05, the data collection date.

On top of that, the real-time transmission of checkout page input and the figure that “105,000 are still live” are absent from the primary material and appear only in the BleepingComputer report. This post does not use the latter at all, and states that the former is a report where it is used.

Sources

Primary sources first.

This post is built from someone else’s reporting, not our own observations. That is why there is no attack timeline, MITRE, or IOC block — we do not manufacture material we do not have. The figures give priority to the primary investigation material (as of 2026-09-05), and content that appears only in the report without being in the primary material is marked in the body with “was reported.” The brand count differs between the primary database’s 44,783 and the report’s 44,182; the database appears to be continuously updated, so we used the primary figure. The nationality and affiliation of the attackers and the domestic scale of harm are unconfirmed, so they are not written in this post. We do not include commands, addresses, or procedures that could be replicated. Published 2026-09-10.