Restaurant Delivery Payment-Skimming Campaign

None of this would work if Google Adsense didn't allow scam ads on their system. But they do, millions every day (I deal with this every day on my websites, Google don't care).

https://en.wikipedia.org/wiki/Racketeer_Influenced_and_Corru...

A total of 404 fake domains impersonating a single restaurant brand site!

The scale is mind-boggling. The number 404 is poetic. Any possible (mis) spelling of the brand will open the "intended" site - you will never see a 404 :D. Auto-correct on steroids indeed.

And I imagine this sort of thing must be happening across hundreds of markets not just US. And possibly not just food delivery but other types of ecommerce as well.

Seen all the attacks and what AI allows for bad guys, I'm beginning to think that running my own DNS and null routing hundreds of thousands of domains (including variations of domains I use regularly, for which I automatically generated hundred of thousands of alternate names: to fight phishing) ain't enough.

I also block every single domain whose name contains non-ASCII character (no Unicode domain names for me / no punnycode: just get lost).

So maybe, maybe, maybe that after all I'll be moving to whitelisting domains. I know some do it and I know it's hard to do right. But some do just that.

It may be time for companies to give the list of all the domains we need to whitelist for their site to function.

Better yet: it may be time for companies to use as few domains as possible.

I don't care about your ads partners. I don't care about your surveillance (pardon, telemetry) partners.

It's too early to tell but a mindset shift may be coming.

Google is the entire problem here. Pay them money and your literal scam site can sit above the real site in the search results.

Why are they allowed to direct you to literal scams? Why are they allowed to profit off of literal scams?

This affects the company I work for, who gets called every single day with customer complaints from people who clicked the scam link from a search ad when looking for our site.

Our site has existed for over a decade. There's no justifiable reason that a company who's brand is known by every single grocer or merchant to somehow show up under a literal fly by night scam company pretending to have the same name. It's unacceptable.

My sister got scammed by this exact mechanism just last week.

At which point does cybercriminality become cyberwar?

Couldn't the original website owner just look at the logs and see where most of the requests are coming from? And also the referrers would be a dead giveaway, right? That's assuming someone is looking at the `access.log` file occasionally.

damn it. Every now and then I daydream about a federated network of digital delivery infra to cut out these platform middlemen but abuse/moderation like this is still what makes the idea impossible to take off. That's what you (and the restaurant) get from the centralization.

Hmm, how do you even protect against this one? Rewriting the entire website makes the entire situation a bit more difficult, you can control about everything.

I have to say this is probably the anti-pattern of all anti-patterns that the web easily allows without much protection. Its a little surprising that it took this long. Probably vibe coding aided its creation.

Maybe its time to turn off the web. Its only going to get worse.

Is this even illegal if the amount you get charged is the amount it says you'll get charged?

OMG. The site had a popup banner to tell me that they don't have a cookie banner? What the actual f____?

Either:

- They actually decided to remove one of the most annoying things about the modern web... and replace it with something very similar to tell you that they removed it, or...

- They found some legal justification for getting me to accept their cookies for dismissing the "no cookie banner banner"

Either choice makes me think less of them.

[edit: added extra newlines so bullets showed up correctly]

Despite mountains of text on this page, none of it explains how exactly this "reverse proxy" of the restaurant's site actually works?

Is it just some JS on bad.com shuttling assets from the real site and displaying them on the fake one? Shouldn't the right CORS headers from the real site prevent this?

Is it a real browser running on a server somewhere visiting the real site, and then rendering that output on a <canvas> on the fake site to avoid the browser's built in protections against this kind of thing? And throwing up their own credit card entry form when the time is right?

Maybe the answer's in there somewhere. Too much Claudish to parse through.

Some of these domain names are great:

  jummyjonhsanbich
  jummyjorsandvotch

And people wonder why we lock down my devices against all possible adverts.

>Searching Google's ad archive (Ads Transparency Center) for the domains in our first sweep found at least 47 Google Search text ads between July 7, 2026, and October 20, 2026, run under at least 46 separate advertiser accounts with at least 43 different, unrelated-looking business names

And yet Google says sideloading is where users are getting hijacked. FFS

The hackers should pass on the order to the real restaurant to reduce suspicion.

>Google's public Ads Transparency pages now show "Can't find ad" for the creatives and "No ads found" for the domains we checked, which suggests Google has taken them down

So much for transparency, removing evidence that Google served ads on these impersonating domains

I bet they are running Google and Meta ads to generate traffic to these malicious domains.

google ads really doesnt give a single shit if u give them money

[flagged]

This is very useful information. I operate an AI-governed digital nation, and this type of proxying would be devastating to our users. Due to the scale of the attacks, DNS and even the IP address system itself also may not be fully reliable. We already saw some DNS servers serve the wrong IP address, though SSL certificates help in this respect.

What could we possibly do to limit the damage from this? Malicious Chrome extensions can also rewrite entire web pages, so if bad actors purchase or infiltrate legitimate extensions, they can also put users at risk.

We are considering continuing work on our own browser, since we could ship certificates to use client-side, but it's a recursive problem since our users would have to get the first trusted version before they could trust updates to it. If they have trouble reaching our site in the first place, through poisoned Google search results, poisoned DNS, and poisoned IP routing, then it is difficult to do this.

all i have to say is Jimmy Johns is a really bad tasting version of Subway. I know other people feel the same way. Jersey Mike's is actually pretty good too.