Investigation generated June 16, 2026. The campaign impersonated Dr Pepper and Cirkul through fake Shopify stores. Cirkul is not owned by KDP. All statuses are as of the investigation date.
The store presented 20+ Dr Pepper SKUs, scraped official product photography, deceptive markdown pricing, and an active Shopify Payments checkout. It was registered May 31, 2026 through Spaceship[.]net and hosted on Shopify infrastructure.
Confirmed active stores shared a registrar and Shopify hosting. Fifteen domains remained Certificate Transparency evidence only. The Cirkul cluster was unconfirmed and parked as leads for the next investigation cycle.
The report observed separate accounts across active sibling stores and characterized the setup as limiting account-level enforcement blast radius. No separate evidence tier or confidence was assigned to this finding.
Correlation rests only on shared registrar, shared Shopify hosting IP, burst registration timing, and an identical naming pattern. The report names no actor, group, or country.
Observed across confirmed sibling stores as of June 16, 2026. The report assigns no separate tier or confidence to this finding.
These are investigation and response recommendations, not completed actions or guaranteed outcomes.
In 30 minutes, review the evidence, trace 20 domains into one campaign, and see how Outtake coordinates action across the providers it depends on.
