Key takeaway: Merchants and processors should treat a domain takedown as a temporary disruption, not a fix. Akamai found scammers reusing the same phishing kits, hosting, and payment infrastructure to relaunch lookalike sites within hours. Separately, Akamai found that account creation fraud and risky login traffic make up a meaningful share of pre-sale activity. These two findings come from different samples in the report, not one combined statistic.
Akamai’s 2026 Fraud and Abuse Report found a single retail phishing operation running more than 1,200 lookalike .shop domains. All of the domains shared one IP address. Help Net Security first reported these findings on October 30, 2026, citing Akamai’s research. Neither Help Net Security nor Akamai named a spokesperson for the report. Neither source has stated the report’s own release date either. The report also found that scammers relaunched replacement sites within hours of a takedown. Separately, Akamai linked 8.3% of 2025 account creation attempts across its network to suspected fraud.
Akamai traced the domain network to a scam that copied the HTML, JavaScript, and payment-page designs of real retail sites. The fake sites collected card numbers, expiration dates, and security codes. Akamai documented similar domain-spoofing patterns elsewhere. Scammers built lookalike ticketing and hospitality sites around a major sporting event. Some of those sites also asked shoppers for passport or ID details.
Scammers also promoted a counterfeit app marketplace through paid social ads. Operators registered many of the lookalike domains well in advance. They left the domains dormant for weeks or months to build a clean reputation before activating them. Some sites used cloaking: they showed harmless content to security scanners while showing the fraudulent offer to real visitors. The sites selected which version to show based on a visitor’s location and browser data.
Akamai also examined a separate, 30-day sample of login traffic from July and August 2026. In that sample, Akamai classified 26.6% of login attempts as high or critical risk. Account verification requests made up 40% of that risky traffic. Akamai said these requests can help attackers check whether an email address belongs to a real account. Attackers typically do this before attempting credential stuffing with previously breached logins. This login-risk figure comes from a different, smaller sample than the 1,200+ domain count and the 2025 account creation data. Readers should not combine these figures into a single statistic.
Akamai tied most of the account creation fraud it tracked to three patterns. Criminals claimed welcome bonuses, tested stolen card numbers, and hoarded limited-stock inventory for resale. These patterns suggest, in MFJ’s view, that account takeover prevention needs attention at sign-up as well as at sign-in.
Why it matters: These findings point to fraud infrastructure that merchants cannot simply outwait. A single takedown no longer removes an operation’s capacity. That speed puts a premium on continuous monitoring over one-time enforcement. The account creation fraud and login-risk figures come from different samples. Both suggest that processors and merchants are absorbing fraud risk earlier in the funnel. That risk now shows up at sign-up and sign-in, not only at checkout.
Sources: Help Net Security,and Akamai, Fraud and Abuse Report 2026