Restaurant Delivery Payment-Skimming Campaign

Posted by fiej 6 hours ago

Counter95Comment41OpenOriginal

Comments

Comment by ModernTimes 5 hours ago

None of this would work if Google Adsense didn't allow scam ads on their system. But they do, millions every day (I deal with this every day on my websites, Google don't care).

https://en.wikipedia.org/wiki/Racketeer_Influenced_and_Corru...

Comment by bnmathm 2 hours ago

Cloudflare is no better, maybe worse. They forward your complaint & PI on to the offending site's registered owner and to whichever (gray or black hat) host it's served from. In my experience, there is nothing you can do to convince Cloudflare to do anything other than be a middleman for the complaint, yet they offer a layer of protection for the nefarious activities.

Even when I've been able to track down hosts, registrars, etc for scraped duplicates of sites, and report to all and Google, Microsoft Safety Scanner, etc -- nobody acts (or certainly not in any reasonable enough time to be useful).

In one case the scammer was using our own logo served directly from a source we could replace with Cloudflare rewrites. So the hijacked logo became "THIS IS A SCAM SITE" while we replaced the one on production.

Comment by brian_cunnie 45 minutes ago

> nobody acts

I act. I receive about 5 takedown notices every day--the curse of running an open source DNS service (nip.io/sslip.io).

I've received over 1,000 takedown requests, but none came from Cloudflare or Google. Most of them come from Netcraft, Phishlabs, and doppel.com.

Comment by arcfour 11 minutes ago

> Cloudflare is no better, maybe worse. They forward your complaint & PI on to the offending site's registered owner and to whichever (gray or black hat) host it's served from.

This is literally false. They are one of the few hosts I have dealt with that actually does NOT do this. Their abuse reporting form even has check boxes that are optional to forward it to the underlying host and the owner. If you leave them unchecked they don't forward anything.

I don't know where you got your information from but it's quite literally the opposite of reality.

Now, whether or not they actually act on it depends on whether they are proxying the site or merely providing authoritative DNS. If they are just providing DNS they will continue to provide it and deny your report and I think that's stupid and frustrating. If they are proxying it they will put up a block page in front of it which is meh.

Comment by 5 hours ago

Comment by bvcp 4 hours ago

i gave up reporting scams to meta and google, you get the distinct impression they are in on it when you get a response saying “we looked into it and it was fine”

Comment by toomuchtodo 3 hours ago

Report them to the FTC and your attorney general.

Comment by 4 hours ago

Comment by mlmonkey 3 hours ago

Couldn't the original website owner just look at the logs and see where most of the requests are coming from? And also the referrers would be a dead giveaway, right? That's assuming someone is looking at the `access.log` file occasionally.

Comment by lokar 1 hour ago

They could use residential proxies

Comment by BatchJob 29 minutes ago

I have to say this is probably the anti-pattern of all anti-patterns that the web easily allows without much protection. Its a little surprising that it took this long. Probably vibe coding aided its creation.

Maybe its time to turn off the web. Its only going to get worse.

Comment by pixl97 5 hours ago

Hmm, how do you even protect against this one? Rewriting the entire website makes the entire situation a bit more difficult, you can control about everything.

Comment by ModernTimes 5 hours ago

You put the people (Google Adsense) showing the scam adverts in prison.

Comment by Crunchified 4 hours ago

This advice from the article to the affected retailers:

Brands and their ordering providers that watch for their site loading under someone else's domain, or for checkout sessions that never reach the real payment provider, are well placed to catch these sites early.

It can be detected if the IT folks look in the right places. I suppose a SCAM ALERT page could be presented to a reverse proxy when discovered.

Comment by StilesCrisis 4 hours ago

I don't see what you could do about "people browse the site but don't check out." I'm sure that is normal for any website regardless.

Comment by ano-ther 1 hour ago

In this case, wouldn’t you see a lot of abandoned carts coming from the reverse proxy sessions?

Comment by trollbridge 5 hours ago

Long-term, via credit card attestation to a trusted device (eg Apple Pay) where the consumer verifies the merchant name & addres they're paying.

Comment by Ekaros 4 hours ago

Here often with smaller restaurants the name can be nearly anything. Very often I end up scratching my head trying to figure out what did I buy. This is due to them having multiple companies and payments going through different one from the restaurant name. While being entirely legitimate. Sometimes it is something like smaller franchise chains.

Comment by warkdarrior 5 hours ago

There are lots of restaurants (legitimate ones!) that use some payment processor on the backend whose name shows up in the transaction. So asking consumers to verify the payment info, when the payment info may not match the restaurant, is a losing battle.

Comment by gwerbin 4 hours ago

This is because banks only show one line on the transaction history. Payment processors should have the ability to report more information about each transaction, and customers should have the ability to see it.

Comment by BeetleB 2 hours ago

Don't do delivery from 3rd party services...?

In the old days, delivery was limited to pizza, and occasionally Chinese. You'd call the restaurant directly and place the order. The only possible way a scammer would get you is if you called the wrong number. That's why we had the Yellow Pages.

It seems from comments here that Google is a lot less reliable than the Yellow Pages were.

Comment by DANmode 4 hours ago

Having the app installed already.

Excuse me while I go throw up, can’t believe I just recommended that.

Comment by mrguyorama 5 hours ago

Google is the entire problem here. Pay them money and your literal scam site can sit above the real site in the search results.

Why are they allowed to direct you to literal scams? Why are they allowed to profit off of literal scams?

This affects the company I work for, who gets called every single day with customer complaints from people who clicked the scam link from a search ad when looking for our site.

Our site has existed for over a decade. There's no justifiable reason that a company who's brand is known by every single grocer or merchant to somehow show up under a literal fly by night scam company pretending to have the same name. It's unacceptable.

My sister got scammed by this exact mechanism just last week.

Comment by _def 5 hours ago

damn it. Every now and then I daydream about a federated network of digital delivery infra to cut out these platform middlemen but abuse/moderation like this is still what makes the idea impossible to take off. That's what you (and the restaurant) get from the centralization.

Comment by logicallee 2 hours ago

This is very useful information. I operate an AI-governed digital nation, and this type of proxying would be devastating to our users. Due to the scale of the attacks, DNS and even the IP address system itself also may not be fully reliable. We already saw some DNS servers serve the wrong IP address, though SSL certificates help in this respect.

What could we possibly do to limit the damage from this? Malicious Chrome extensions can also rewrite entire web pages, so if bad actors purchase or infiltrate legitimate extensions, they can also put users at risk.

We are considering continuing work on our own browser, since we could ship certificates to use client-side, but it's a recursive problem since our users would have to get the first trusted version before they could trust updates to it. If they have trouble reaching our site in the first place, through poisoned Google search results, poisoned DNS, and poisoned IP routing, then it is difficult to do this.

Comment by IncreasePosts 2 hours ago

What is an AI-governed digital nation?

Comment by logicallee 2 hours ago

AI comes up with the laws, and acts as a judiciary etc, plus builds the services etc. You can read one of our laws[1], this was written by ChatGPT and ratified by Claude. Our ChatGPT account was closed in early September, erasing our country's history, we've been trying for the past two months to reopen it. Since we're a sovereign nation we are under an enormous amount of attack all the time. We recently lost our server and are temporarily on a free host.

[1] https://stateofutopia.com/laws/2/law2/law2.html

Save that page (with curl or wget), you should get this sha256:

BFE524880867A84C9A438A057734B58954B860843BDB5B15C9E4ED70C534126D (updated after I removed a script injection attack).

though if you're reading this comment through a proxied Hacker News clone, someone might rewrite that hash to their version of what they want our law to say.

Comment by human_eyes 17 minutes ago

What the hell

Comment by JSR_FDED 3 minutes ago

The only way to solve this is to have all your citizens band together and create a new operating system.

Comment by NamlchakKhandro 1 hour ago

This sounds like peak delusion

Comment by jijji 32 minutes ago

all i have to say is Jimmy Johns is a really bad tasting version of Subway. I know other people feel the same way. Jersey Mike's is actually pretty good too.

Comment by emacdona 4 hours ago

OMG. The site had a popup banner to tell me that they don't have a cookie banner? What the actual f____?

Either:

- They actually decided to remove one of the most annoying things about the modern web... and replace it with something very similar to tell you that they removed it, or...

- They found some legal justification for getting me to accept their cookies for dismissing the "no cookie banner banner"

Either choice makes me think less of them.

[edit: added extra newlines so bullets showed up correctly]

Comment by rationalist 3 hours ago

I only clicked on the link after reading your comment. Yep, what that website is doing is obnoxious. A little less obnoxious than a cookie banner, but more obnoxious than not having any banner or modal.

Comment by handoflixue 4 hours ago

If you'd bothered to read the banner, it answers your question: "Zero cookies, zero trackers, zero pixels."

Then it links to a page which is even more explicit about how little they collect: https://www.infohawk.com/cookies

Comment by emacdona 1 hour ago

Oh, I had bothered to read the banner. And I clicked the link.

My point is: they did all the necessary work required (no third party tracking cookies) to NOT HAVE TO show a banner...

... and then they chose to show a banner.

Comment by akersten 2 hours ago

Despite mountains of text on this page, none of it explains how exactly this "reverse proxy" of the restaurant's site actually works?

Is it just some JS on bad.com shuttling assets from the real site and displaying them on the fake one? Shouldn't the right CORS headers from the real site prevent this?

Is it a real browser running on a server somewhere visiting the real site, and then rendering that output on a <canvas> on the fake site to avoid the browser's built in protections against this kind of thing? And throwing up their own credit card entry form when the time is right?

Maybe the answer's in there somewhere. Too much Claudish to parse through.

Comment by mik3y 1 hour ago

The evil site is acting as a reverse HTTP proxy: When you do a `GET evilsite/foo`, to compose its response the server first does a `GET targetsite/foo`, mutates the response however it likes, and passes it along to you.

So you don't need to worry about CORS from the perspective of the web app, nor need a real browser, because the victim is only ever interacting with the evilsite endpoints.

Certainly there are ways the target site could try to thwart this (i.e. detect unusual request patterns from wherever the proxy server is fetching from; client-side JS to detect the site being hosted on a foreign domain; etc). But at that point it's an arms race.

Comment by jihadjihad 1 hour ago

Some of these domain names are great:

  jummyjonhsanbich
  jummyjorsandvotch
Can’t wait to bring a big ole box of Jummy Jor sandvotches into the office on Monday.

Comment by 0x4e 5 hours ago

I bet they are running Google and Meta ads to generate traffic to these malicious domains.

Comment by StilesCrisis 4 hours ago

You should read the article and see!

Comment by hnburnsy 3 hours ago

>Searching Google's ad archive (Ads Transparency Center) for the domains in our first sweep found at least 47 Google Search text ads between July 7, 2026, and October 20, 2026, run under at least 46 separate advertiser accounts with at least 43 different, unrelated-looking business names

And yet Google says sideloading is where users are getting hijacked. FFS

The hackers should pass on the order to the real restaurant to reduce suspicion.

>Google's public Ads Transparency pages now show "Can't find ad" for the creatives and "No ads found" for the domains we checked, which suggests Google has taken them down

So much for transparency, removing evidence that Google served ads on these impersonating domains

Comment by yh11 5 hours ago

google ads really doesnt give a single shit if u give them money

Comment by aniq_ui 4 hours ago

[flagged]