Akamai says fraudsters rebuild fake shops within hours of takedowns

Akamai published its State of the Internet report AI-Driven Digital Deception: The Fraud and Abuse Report 2026 on Oct. 29, 2026. The report said fraudsters rebuild fake shopping sites within hours after takedowns.

The report found that scam detections passed phishing detections in Q1 2026. This was the first time. Scam detections roughly doubled from ~3.2 million to ~6.4 million. The typical phishing attack lasted 48 days in Q4 2025 and 22 days in Q2 2026, a drop of more than 50%.

According to Akamai’s report, one retail scam ran more than 1,200 look-alike.shop domains on a single shared IP address. The sites reused HTML, JavaScript and payment-page designs built to capture security codes, expiry dates and card numbers.

Akamai’s report described a ticket scam that used sites posing as official event portals. The sites also mimicked hospitality pages for a major sporting event. The ticket sites routed payment details and personal data to a shared collection system. Some checkout processes asked for passport or identity-document details.

They claimed ticket delivery or event access required the information.

The report said criminals used many domains as entrances to one operation. If a block or removal took one domain offline, another could still send data to the shared collection system. Stolen information can result in identity abuse, account takeover and payment fraud.

Akamai said criminals reuse phishing kits, hosting and payment systems. Replacement sites appear within hours after a website goes down. Operators register look-alike domains in groups. They keep them inactive for weeks or months.

This lets the domain build a clean reputation before the scam starts.

The report noted that fraud sites show different content to visitors. They give harmless material to security scanners. Victims see fraudulent offers based on location and browser details. Attackers put phishing pages on compromised websites.

They do this to abuse the good reputation of a known address.

Phishing cases targeted high technology brands in 41.6% of instances. Financial services accounted for 18.9% and commerce for 8.4%. Most malicious domains targeted enterprise networks during the reporting period. They impersonated commerce, financial services and high technology brands.

Akamai said 26.6% of recorded sign-in attempts were high or critical risk in a 30-day sample covering July and August 2026. Account verification requests made up 40% of the login traffic that examiners rated high or critical risk. Attackers check whether an e-mail address belongs to an account using verification requests. This happens before credential stuffing begins, an attack that tries stolen login details on many accounts.

Victims may learn about the theft from a purchase notification or missing points. They might also discover it when a password stops working. Businesses handle disputed transactions and refund requests. They also work to restore account access.

Criminals open accounts to collect welcome bonuses and abuse promotions. They also test stolen cards and hold products for resale. In 2025, account creation attempts showed a suspected fraud link of 8.3%. Criminals use small purchases through fake accounts to verify stolen cards work before larger purchases.

Fake accounts reduce product availability for shoppers. They also supply resellers.

According to the report, fake hiring content showed up on four major social platforms. It sent people toward phishing forms that collect sensitive information. A paid social media ad sent consumers to a counterfeit app marketplace. Visitors downloaded an app that gathered sensitive information and misused device permissions.

According to Akamai, criminals run SMS pumping schemes using automated requests. These requests send sign-up or password reset texts. The texts go to premium rate international phone numbers. This creates costs for the business sending them.

Some SMS pumping schemes use rogue telecom carriers. Those carriers split revenue with fraudsters.

Intent-based behavioral checks can stop slow credential stuffing and credit card testing. Akamai also recommends microsegmentation. Microsegmentation is part of a broader ransomware strategy. The State of the Internet reports are in their 12th year.

They draw on attacks viewed across Akamai’s cybersecurity infrastructure. That infrastructure handles much global web traffic.