Possible DoppelCart fake-shop cluster - high volume .shop TLD domain resolution

Arnold Chan@slaz

•updated Sep 10, 2026•0•0•0

This rule detects high-volume DNS resolution of domains ending in the .shop TLD from internal hosts, which may indicate interaction with a cluster of infrastructure used by the DoppelCart fake-shop campaign.