Key takeaway: Akamai found that scam operators can relaunch replacement storefronts within hours of a takedown. That means merchants whose brands scammers impersonate cannot rely on takedowns alone to stop a fake-storefront operation.
Akamai’s Fraud and Abuse Report 2026 describes a single retail impersonation scheme. It used more than 1,200 look-alike .shop domains sharing one IP address. Help Net Security reported on October 30, 2026 that replacement sites in this scheme appeared within hours of a takedown.
Akamai says operators register look-alike addresses in bulk and leave them inactive for weeks or months. Reused phishing kits and hosting then let replacement sites go live quickly after operators take one down.
The same report classified 26.6% of recorded login attempts as high or critical risk. The sample covered 30 days spanning July and August 2026. Account verification requests made up 40% of that high- or critical-risk login traffic. Akamai also linked 8.3% of account creation attempts in 2025 to suspected fraud.
Help Net Security also notes two other schemes covered in the report. One used a ticket scam that impersonated official ticketing and hospitality portals for a major sporting event. The other used a paid social media ad that led to a counterfeit app marketplace.
Why it matters: More than 1,200 domains on one IP address show the scale a single operation can reach. The speed of replacement also means a takedown removes just one site while the larger scheme survives. When scammers copy a merchant’s brand, the merchant can still face customer complaints and lost trust. That happens even though scammers never touch its own checkout.
Sources: Help Net Security