Akamai found replacement storefronts appearing hours after takedowns, rebuilt from reused kits and payment pages that harvest card details.