Akamai’s Fraud and Abuse Report 2026 paints retail fraud as a franchise operation: infrastructure that can lose a domain and resume selling the same afternoon.
One scheme leaned on more than 1,200 look-alike .shop domains that all resolved to a single IP address, recycling HTML, JavaScript and payment designs built for card harvesting, so blocking one address only pushed buyers toward a twin on the same backend. A ticket scam mirrored that setup. Sites posing as official ticketing and hospitality portals for a major sporting event sent payment and personal information to one collection system, and a few checkouts sought passport or identity-document copies as a condition of getting into the venue. Each address was a separate doorway into the same operation, so any domain that survived left the pipeline running, and the harvested details fed card fraud, account takeover and identity abuse.
Bulk-registered names get parked for weeks or months so a domain can age into respectability first. Some serve different pages depending on the visitor: scanners get harmless filler, while the target sees the scam, chosen by browser and location.
Phishing also lands on hijacked sites, trading on trust their owners already earned. Prebuilt kits and rented payment plumbing explain why a replacement surfaces within hours of takedown, and one documented paid social ad routed consumers to a counterfeit app marketplace, where a malicious download grabbed sensitive data and abused device permissions. Recruitment scams pushed bogus job offers across four major social platforms and funneled applicants into forms built to collect their details.
Chasing domains one at a time is therefore losing work. Detection aimed at the payment backend, the shared infrastructure and the reused kit catches the operation instead.
