None of this would work if Google Adsense didn't allow scam ads on their system. But they do, millions every day (I deal with this every day on my websites, Google don't care).
Cloudflare is no better, maybe worse. They forward your complaint & PI on to the offending site's registered owner and to whichever (gray or black hat) host it's served from. In my experience, there is nothing you can do to convince Cloudflare to do anything other than be a middleman for the complaint, yet they offer a layer of protection for the nefarious activities.
Even when I've been able to track down hosts, registrars, etc for scraped duplicates of sites, and report to all and Google, Microsoft Safety Scanner, etc -- nobody acts (or certainly not in any reasonable enough time to be useful).
In one case the scammer was using our own logo served directly from a source we could replace with Cloudflare rewrites. So the hijacked logo became "THIS IS A SCAM SITE" while we replaced the one on production.
Are you getting takedown requests from people who don’t understand how DNS works, or… are they actually suggesting that your particular DNS server filter particular results?
> Cloudflare is no better, maybe worse. They forward your complaint & PI on to the offending site's registered owner and to whichever (gray or black hat) host it's served from.
This is literally false. They are one of the few hosts I have dealt with that actually does NOT do this. Their abuse reporting form even has check boxes that are optional to forward it to the underlying host and the owner. If you leave them unchecked they don't forward anything.
I don't know where you got your information from but it's quite literally the opposite of reality.
Now, whether or not they actually act on it depends on whether they are proxying the site or merely providing authoritative DNS. If they are just providing DNS they will continue to provide it and deny your report and I think that's stupid and frustrating. If they are proxying it they will put up a block page in front of it which is meh.
A large company's report system is designed to distract you from complaint paths that work and are expensive for the company to deal with (lawsuits) and make you complain to /dev/null instead.
i gave up reporting scams to meta and google, you get the distinct impression they are in on it when you get a response saying “we looked into it and it was fine”
The problem is they keep changing identity. From what they said Google is taking them down--it's just they keep coming back under new names. Killing a hydra is hard!
They should be held liable, in the same way as brick and mortar stores are liable if they sell you shoddy goods, and the manufacturer can’t be found after your house burns down or whatever.
A total of 404 fake domains impersonating a single restaurant brand site!
The scale is mind-boggling. The number 404 is poetic. Any possible (mis) spelling of the brand will open the "intended" site - you will never see a 404 :D. Auto-correct on steroids indeed.
And I imagine this sort of thing must be happening across hundreds of markets not just US. And possibly not just food delivery but other types of ecommerce as well.
> Across two research passes, we identified 820 domains impersonating 35 restaurant brands. Of those, 808 use the .delivery top-level domain, and the rest use .com or .shop.
This crazy proliferation of top level domains has to be part of the problem. Every time a new one is conjured up, legitimate businesses and organizations need to scramble and buy them before a scammer inevitably snaps it up and starts scamming on it.
What are you suggesting browsers ought to do here? Sure ICANN is a very flawed solution and the gTLD cash grab has reached absurd levels but what are you expecting browser vendors to do? For example .net .de and .delivery are all equally legitimate TLDs according to both the central body and all the infrastructure providers.
E-mail anti-spam systems are able to crowdsource and otherwise build up reputation for domains. Surely "selecting the legit domain for Organization X" is within the realm of computability.
Of course, I'll admit there is a danger there of creating a two-tier domain system, where the "big guy$" get the green Checkmark of Legitimacy or whatever in browsers, and everyone else, including mypersonalwebsite.org gets the shaft. I don't have all the answers but surely we are capable of at least crowdsourcing a list of known scam sites and surfacing them at the browser level.
Google is the entire problem here. Pay them money and your literal scam site can sit above the real site in the search results.
Why are they allowed to direct you to literal scams? Why are they allowed to profit off of literal scams?
This affects the company I work for, who gets called every single day with customer complaints from people who clicked the scam link from a search ad when looking for our site.
Our site has existed for over a decade. There's no justifiable reason that a company who's brand is known by every single grocer or merchant to somehow show up under a literal fly by night scam company pretending to have the same name. It's unacceptable.
My sister got scammed by this exact mechanism just last week.
I often use google shopping when I’m looking at items in categories I’m not familiar with. About half the time there is a store charging significantly less than the others. I’ll open a new tab ask Google search AI if the site is legit, and 95% of the time the response is that it’s a well known scam site. So the anemic search AI knows it’s a scam, but google shopping has no problem sending people there (likely with an affiliate code).
Sounds like you pay less for ads than someone else will. Attention is the currency in the world, pay more and your site will be on top, clearly there are customers that want your product.
You shouldn't have to pay more than someone who is obviously committing fraud because people working at Google should be going to prison for deciding to partner with people who are obviously committing fraud.
Yeah and housing should be affordable, and there should be no wars in the world, people should not be greedy, etc. Let's look at the facts and incentives in front of us now instead of fairytail "shoulds".
1) Google has more money than anyone who can file for litigation
2) You don't want your brand reputation damaged
So you can choose to either complain, spend a load of money in pointless juridical processes you will lose, or just pay up for the ads now, which will in the end pay for part of it at least since people are interested in the product.
So the fully rational choice right now you can do is: if brand damage costs > ad costs, buy ads. If not, then it's fine and let people get scammed because its out of your hands.
You can of course do both: pay the protection racket money while also working to spread an understanding and build consensus/a demand for the government to crack down on major companies directly participating in fraud.
Recently I tried to download Blender, so I put "blender" in Google search... and the first link was some scam website pretending to be Blender, trying to make me install their malware.
Google doesn't even try anymore. The easier way to distribute malware to people is simply to pay Google to pretend that you are someone else.
(Similarly it's been months since I last saw a non-scam ad on YouTube. Sure, Elon Musk will send me tons of money made by AI brokers as soon as I give him my bank account. And the AI-generated video is great proof of how you can lose 50% body weight in 21 days just by sitting in a chair and nodding your head according to the special secret exercise routine.)
damn it. Every now and then I daydream about a federated network of digital delivery infra to cut out these platform middlemen but abuse/moderation like this is still what makes the idea impossible to take off. That's what you (and the restaurant) get from the centralization.
Couldn't the original website owner just look at the logs and see where most of the requests are coming from? And also the referrers would be a dead giveaway, right? That's assuming someone is looking at the `access.log` file occasionally.
Blocking IP ranges and user agents has nothing to do with "AI". It's a bad practice by lazy sysadmins who'd rather discriminate users than fix their infra. Writing this from a non-profit ISP (fdn.fr) whose IP range is blocked by Google and Reddit and noone still knows why or how to unblock it [0].
Residential proxies on the other hand i don't think have any legitime usecase. I would support people working around Youtube to export interesting videos to Bittorrent. But what's happening is malicious actors going around rate limiting to run bad-behaving scrapers on smaller sites. That, and much worse is the residential proxy economy.
Hmm, how do you even protect against this one? Rewriting the entire website makes the entire situation a bit more difficult, you can control about everything.
You make the penalty for being caught have teeth. A slap on the wrist (or nothing in this case) just encourages more abuse. Make a public showing that it wont be tolerated.
Something short of public execution, but decades in prison seems reasonable.
This advice from the article to the affected retailers:
Brands and their ordering providers that watch for their site loading under someone else's domain, or for checkout sessions that never reach the real payment provider, are well placed to catch these sites early.
It can be detected if the IT folks look in the right places. I suppose a SCAM ALERT page could be presented to a reverse proxy when discovered.
I don't know the scale of cart-abandonment for a website like Jimmy John's, but it has got to be large enough that a few dozen more wouldn't be _too_ surprising.
Doing a quick search on it, and if the AI response is anywhere close to true, the vast majority of times a cart is filled it's not checked out. Food has one of the lowest rates, but that's still 30-50% abandonment.
Honestly it's something that happens with my family quite often. I'll start putting stuff in a cart then someone else changes their mind and we switch to another place to order. And it feels like this happens all the time.
Here often with smaller restaurants the name can be nearly anything. Very often I end up scratching my head trying to figure out what did I buy. This is due to them having multiple companies and payments going through different one from the restaurant name. While being entirely legitimate. Sometimes it is something like smaller franchise chains.
There are lots of restaurants (legitimate ones!) that use some payment processor on the backend whose name shows up in the transaction. So asking consumers to verify the payment info, when the payment info may not match the restaurant, is a losing battle.
This is because banks only show one line on the transaction history. Payment processors should have the ability to report more information about each transaction, and customers should have the ability to see it.
I'm thinking more elaborate CSRF tokens that uses subresource integrity and everything else (cookies, headers, etc). As soon as there's a mismatch, collect details and report.
In the old days, delivery was limited to pizza, and occasionally Chinese. You'd call the restaurant directly and place the order. The only possible way a scammer would get you is if you called the wrong number. That's why we had the Yellow Pages.
It seems from comments here that Google is a lot less reliable than the Yellow Pages were.
It's still a fake domain name. Don't trust random websites the same as how you use the web in general. Also, asking for a bank's OTP code is a gigantic no-no, but I don't suppose they really need that to collect the money?
> At some point we need counter-hacking vigilante justice. Hack the phishing sites, dox the owners, take them down.
Perhaps we should first discuss semantics at the line of war. When does some activity which impedes, diminishes, or otherwise blocks the interests of a peoples' rights in such a way that the word "crime" is not sufficient? Maybe it really all does come down to behavioural and financial incentives. That is to say that it is probably war when the judicial, legislative, and executive lack the resources or will to address an injustice and the idea of "war" becomes the only answer. As radical as that may seem, it literally needs to be considered for every action ten years or more down the road at the current pace of technology.
Seen all the attacks and what AI allows for bad guys, I'm beginning to think that running my own DNS and null routing hundreds of thousands of domains (including variations of domains I use regularly, for which I automatically generated hundred of thousands of alternate names: to fight phishing) ain't enough.
I also block every single domain whose name contains non-ASCII character (no Unicode domain names for me / no punnycode: just get lost).
So maybe, maybe, maybe that after all I'll be moving to whitelisting domains. I know some do it and I know it's hard to do right. But some do just that.
It may be time for companies to give the list of all the domains we need to whitelist for their site to function.
Better yet: it may be time for companies to use as few domains as possible.
I don't care about your ads partners. I don't care about your surveillance (pardon, telemetry) partners.
It's too early to tell but a mindset shift may be coming.
I wonder if LLMs might end up enabling reliable automated detection of scam domains.
> no Unicode domain names for me / no punnycode: just get lost
If you exclusively speak a latin language that works but the vast majority of people in the world require a unicode domain name if they want the name to be in their native script.
I have to say this is probably the anti-pattern of all anti-patterns that the web easily allows without much protection. Its a little surprising that it took this long. Probably vibe coding aided its creation.
Maybe its time to turn off the web. Its only going to get worse.
It also doesn’t help that nearly everything is now outsourced to SaaS that use ridiculously generic or often sketchy sounding domain names for secure transactions. When the government sends you to id.me, or a doctors office sends you to phreesia.com (huh?), or a business sends you to something like securepayments.com, insurance companies through fiserv.com, restaurants through all kinds of shady sounding domains.
We’ve been trained to ignore the domain name and accept putting sensitive content into random third party providers. How does a scam site look any different?
Yes. This is wire fraud. It is absolutely illegal. Even if they weren’t impersonating a business, charging someone for services or goods with no intent to provide them would still be fraud.
OMG. The site had a popup banner to tell me that they don't have a cookie banner? What the actual f____?
Either:
- They actually decided to remove one of the most annoying things about the modern web... and replace it with something very similar to tell you that they removed it, or...
- They found some legal justification for getting me to accept their cookies for dismissing the "no cookie banner banner"
Either choice makes me think less of them.
[edit: added extra newlines so bullets showed up correctly]
I only clicked on the link after reading your comment. Yep, what that website is doing is obnoxious. A little less obnoxious than a cookie banner, but more obnoxious than not having any banner or modal.
Probably because they were fielding complaints from their readers.
I took down a fully static public web page that had basically no traffic and no cookies. It literally just said that a domain that I had was not associated with a popular brand name that was on a different TLD so don’t email me about it.
I got as many emails complaining there was no cookie banner as I had previously gotten about the brand. There is some brand of privacy crank out there that likes to harass people about those banners (and similar gdpr regs).
You don't understand. Creating as much friction as possible and hiding the actual content is web design best practice.
If you just show the actual content in a readable format that uses the screenspace people will get scared and think of your site as unprofessional. People are so used to these popups, modals and annoyances that interrupt, take away screen space from and cover the content that they expect them.
Looks like a marketing bit to me ("look how we care about your privacy!"). I vaguely appreciate the sentiment but they've done that in a very annoying way.
If you think that’s bad, turn on the successor to x-do-not-stab. Many sites now show three popups: “we noticed the signal”, “optionally enter email to submit request”, “you clicked OK”, when zero popups would do.
Despite mountains of text on this page, none of it explains how exactly this "reverse proxy" of the restaurant's site actually works?
Is it just some JS on bad.com shuttling assets from the real site and displaying them on the fake one? Shouldn't the right CORS headers from the real site prevent this?
Is it a real browser running on a server somewhere visiting the real site, and then rendering that output on a <canvas> on the fake site to avoid the browser's built in protections against this kind of thing? And throwing up their own credit card entry form when the time is right?
Maybe the answer's in there somewhere. Too much Claudish to parse through.
The evil site is acting as a reverse HTTP proxy: When you do a `GET evilsite/foo`, to compose its response the server first does a `GET targetsite/foo`, mutates the response however it likes, and passes it along to you.
So you don't need to worry about CORS from the perspective of the web app, nor need a real browser, because the victim is only ever interacting with the evilsite endpoints.
Certainly there are ways the target site could try to thwart this (i.e. detect unusual request patterns from wherever the proxy server is fetching from; client-side JS to detect the site being hosted on a foreign domain; etc). But at that point it's an arms race.
>Searching Google's ad archive (Ads Transparency Center) for the domains in our first sweep found at least 47 Google Search text ads between July 7, 2026, and October 20, 2026, run under at least 46 separate advertiser accounts with at least 43 different, unrelated-looking business names
And yet Google says sideloading is where users are getting hijacked. FFS
The hackers should pass on the order to the real restaurant to reduce suspicion.
>Google's public Ads Transparency pages now show "Can't find ad" for the creatives and "No ads found" for the domains we checked, which suggests Google has taken them down
So much for transparency, removing evidence that Google served ads on these impersonating domains
the list also told me a lot of people search for and order sendwiches
i wonder if the malicious sites will need an adpative tranform of reverse-proxied content so that the real content fetched from real site is updated to insert these "correct" spellings so that the customer dont find it ... suspicious?
This is very useful information. I operate an AI-governed digital nation, and this type of proxying would be devastating to our users. Due to the scale of the attacks, DNS and even the IP address system itself also may not be fully reliable. We already saw some DNS servers serve the wrong IP address, though SSL certificates help in this respect.
What could we possibly do to limit the damage from this? Malicious Chrome extensions can also rewrite entire web pages, so if bad actors purchase or infiltrate legitimate extensions, they can also put users at risk.
We are considering continuing work on our own browser, since we could ship certificates to use client-side, but it's a recursive problem since our users would have to get the first trusted version before they could trust updates to it. If they have trouble reaching our site in the first place, through poisoned Google search results, poisoned DNS, and poisoned IP routing, then it is difficult to do this.
AI comes up with the laws, and acts as a judiciary etc, plus builds the services etc. You can read one of our laws[1], this was written by ChatGPT and ratified by Claude. Our ChatGPT account was closed in early September, erasing our country's history, we've been trying for the past two months to reopen it. Since we're a sovereign nation we are under an enormous amount of attack all the time. We recently lost our server and are temporarily on a free host.
Save that page (with curl or wget), you should get this sha256:
BFE524880867A84C9A438A057734B58954B860843BDB5B15C9E4ED70C534126D (updated after I removed a script injection attack).
though if you're reading this comment through a proxied Hacker News clone, someone might rewrite that hash to their version of what they want our law to say.
all i have to say is Jimmy Johns is a really bad tasting version of Subway. I know other people feel the same way. Jersey Mike's is actually pretty good too.
None of this would work if Google Adsense didn't allow scam ads on their system. But they do, millions every day (I deal with this every day on my websites, Google don't care).
https://en.wikipedia.org/wiki/Racketeer_Influenced_and_Corru...
Cloudflare is no better, maybe worse. They forward your complaint & PI on to the offending site's registered owner and to whichever (gray or black hat) host it's served from. In my experience, there is nothing you can do to convince Cloudflare to do anything other than be a middleman for the complaint, yet they offer a layer of protection for the nefarious activities.
Even when I've been able to track down hosts, registrars, etc for scraped duplicates of sites, and report to all and Google, Microsoft Safety Scanner, etc -- nobody acts (or certainly not in any reasonable enough time to be useful).
In one case the scammer was using our own logo served directly from a source we could replace with Cloudflare rewrites. So the hijacked logo became "THIS IS A SCAM SITE" while we replaced the one on production.
> nobody acts
I act. I receive about 5 takedown notices every day--the curse of running an open source DNS service (nip.io/sslip.io).
I've received over 1,000 takedown requests, but none came from Cloudflare or Google. Most of them come from Netcraft, Phishlabs, and doppel.com.
This is interesting… Could you elaborate?
Are you getting takedown requests from people who don’t understand how DNS works, or… are they actually suggesting that your particular DNS server filter particular results?
> We take abuse reports very seriously. To report a site, email the offending URL to abuse@nip.io. We respond to all abuse reports within 24 hours
They seem to invite it
> Cloudflare is no better, maybe worse. They forward your complaint & PI on to the offending site's registered owner and to whichever (gray or black hat) host it's served from.
This is literally false. They are one of the few hosts I have dealt with that actually does NOT do this. Their abuse reporting form even has check boxes that are optional to forward it to the underlying host and the owner. If you leave them unchecked they don't forward anything.
I don't know where you got your information from but it's quite literally the opposite of reality.
Now, whether or not they actually act on it depends on whether they are proxying the site or merely providing authoritative DNS. If they are just providing DNS they will continue to provide it and deny your report and I think that's stupid and frustrating. If they are proxying it they will put up a block page in front of it which is meh.
A large company's report system is designed to distract you from complaint paths that work and are expensive for the company to deal with (lawsuits) and make you complain to /dev/null instead.
i gave up reporting scams to meta and google, you get the distinct impression they are in on it when you get a response saying “we looked into it and it was fine”
Report them to the FTC and your attorney general.
Your state's attorney general's office, yes, definitely - many have a consumer protection division or whatever.
I'd have trouble believing that U.S. Attorney General Todd Blanche would care very much, but I guess it wouldn't hurt to try.
Try and upvote your own YouTube video and they’ll be on you like a ton of bricks.
Upload a scam ad? No problemo.
The problem is they keep changing identity. From what they said Google is taking them down--it's just they keep coming back under new names. Killing a hydra is hard!
They should be held liable, in the same way as brick and mortar stores are liable if they sell you shoddy goods, and the manufacturer can’t be found after your house burns down or whatever.
A total of 404 fake domains impersonating a single restaurant brand site!
The scale is mind-boggling. The number 404 is poetic. Any possible (mis) spelling of the brand will open the "intended" site - you will never see a 404 :D. Auto-correct on steroids indeed.
And I imagine this sort of thing must be happening across hundreds of markets not just US. And possibly not just food delivery but other types of ecommerce as well.
> Across two research passes, we identified 820 domains impersonating 35 restaurant brands. Of those, 808 use the .delivery top-level domain, and the rest use .com or .shop.
This crazy proliferation of top level domains has to be part of the problem. Every time a new one is conjured up, legitimate businesses and organizations need to scramble and buy them before a scammer inevitably snaps it up and starts scamming on it.
Also, the fact that web browsers are insanely trying to downplay and hide web site domain names and paths is also not helping. https://totallylegitjerseymikes.delivery/ should NOT get the same visual treatment as https://www.jerseymikes.com/
> https://totallylegitjerseymikes.delivery/ should NOT get the same visual treatment as https://www.jerseymikes.com/
What are you suggesting browsers ought to do here? Sure ICANN is a very flawed solution and the gTLD cash grab has reached absurd levels but what are you expecting browser vendors to do? For example .net .de and .delivery are all equally legitimate TLDs according to both the central body and all the infrastructure providers.
Stop hiding URLs for one. I still can’t believe that is a thing.
E-mail anti-spam systems are able to crowdsource and otherwise build up reputation for domains. Surely "selecting the legit domain for Organization X" is within the realm of computability.
Of course, I'll admit there is a danger there of creating a two-tier domain system, where the "big guy$" get the green Checkmark of Legitimacy or whatever in browsers, and everyone else, including mypersonalwebsite.org gets the shaft. I don't have all the answers but surely we are capable of at least crowdsourcing a list of known scam sites and surfacing them at the browser level.
It seems fun to load a local business directory into the browser.
If there is a banana.tw in your neigbourhood, loading banana.delivery could trigger a popup asking if you were looking for banana.tw
Well that's what search was supposed to be, until it wasn't.
Google is the entire problem here. Pay them money and your literal scam site can sit above the real site in the search results.
Why are they allowed to direct you to literal scams? Why are they allowed to profit off of literal scams?
This affects the company I work for, who gets called every single day with customer complaints from people who clicked the scam link from a search ad when looking for our site.
Our site has existed for over a decade. There's no justifiable reason that a company who's brand is known by every single grocer or merchant to somehow show up under a literal fly by night scam company pretending to have the same name. It's unacceptable.
My sister got scammed by this exact mechanism just last week.
I often use google shopping when I’m looking at items in categories I’m not familiar with. About half the time there is a store charging significantly less than the others. I’ll open a new tab ask Google search AI if the site is legit, and 95% of the time the response is that it’s a well known scam site. So the anemic search AI knows it’s a scam, but google shopping has no problem sending people there (likely with an affiliate code).
Sounds like you pay less for ads than someone else will. Attention is the currency in the world, pay more and your site will be on top, clearly there are customers that want your product.
You shouldn't have to pay more than someone who is obviously committing fraud because people working at Google should be going to prison for deciding to partner with people who are obviously committing fraud.
Yeah and housing should be affordable, and there should be no wars in the world, people should not be greedy, etc. Let's look at the facts and incentives in front of us now instead of fairytail "shoulds".
1) Google has more money than anyone who can file for litigation
2) You don't want your brand reputation damaged
So you can choose to either complain, spend a load of money in pointless juridical processes you will lose, or just pay up for the ads now, which will in the end pay for part of it at least since people are interested in the product.
So the fully rational choice right now you can do is: if brand damage costs > ad costs, buy ads. If not, then it's fine and let people get scammed because its out of your hands.
You can of course do both: pay the protection racket money while also working to spread an understanding and build consensus/a demand for the government to crack down on major companies directly participating in fraud.
you could but then you should call it protection money
Recently I tried to download Blender, so I put "blender" in Google search... and the first link was some scam website pretending to be Blender, trying to make me install their malware.
Google doesn't even try anymore. The easier way to distribute malware to people is simply to pay Google to pretend that you are someone else.
(Similarly it's been months since I last saw a non-scam ad on YouTube. Sure, Elon Musk will send me tons of money made by AI brokers as soon as I give him my bank account. And the AI-generated video is great proof of how you can lose 50% body weight in 21 days just by sitting in a chair and nodding your head according to the special secret exercise routine.)
You work for a company? Why hasn't your company sued Google for creating this problem yet?
damn it. Every now and then I daydream about a federated network of digital delivery infra to cut out these platform middlemen but abuse/moderation like this is still what makes the idea impossible to take off. That's what you (and the restaurant) get from the centralization.
Couldn't the original website owner just look at the logs and see where most of the requests are coming from? And also the referrers would be a dead giveaway, right? That's assuming someone is looking at the `access.log` file occasionally.
They could use residential proxies
And residential proxies are becoming increasingly legitimate because of over-zealous AI blocks.
Blocking IP ranges and user agents has nothing to do with "AI". It's a bad practice by lazy sysadmins who'd rather discriminate users than fix their infra. Writing this from a non-profit ISP (fdn.fr) whose IP range is blocked by Google and Reddit and noone still knows why or how to unblock it [0].
Residential proxies on the other hand i don't think have any legitime usecase. I would support people working around Youtube to export interesting videos to Bittorrent. But what's happening is malicious actors going around rate limiting to run bad-behaving scrapers on smaller sites. That, and much worse is the residential proxy economy.
[0] https://www.fdn.fr/the-fdn-and-gitoyen-networks-are-blocked-...
Hmm, how do you even protect against this one? Rewriting the entire website makes the entire situation a bit more difficult, you can control about everything.
You put the people (Google Adsense) showing the scam adverts in prison.
You make the penalty for being caught have teeth. A slap on the wrist (or nothing in this case) just encourages more abuse. Make a public showing that it wont be tolerated. Something short of public execution, but decades in prison seems reasonable.
They're probably not in the US.
This advice from the article to the affected retailers:
Brands and their ordering providers that watch for their site loading under someone else's domain, or for checkout sessions that never reach the real payment provider, are well placed to catch these sites early.
It can be detected if the IT folks look in the right places. I suppose a SCAM ALERT page could be presented to a reverse proxy when discovered.
I don't see what you could do about "people browse the site but don't check out." I'm sure that is normal for any website regardless.
In this case, wouldn’t you see a lot of abandoned carts coming from the reverse proxy sessions?
I don't know the scale of cart-abandonment for a website like Jimmy John's, but it has got to be large enough that a few dozen more wouldn't be _too_ surprising.
> it has got to be large enough that a few dozen more wouldn't be _too_ surprising.
Shouldn't it be though? What is the precedent here? Isn't anyone concerned about the slow boiling frog any more?
Doing a quick search on it, and if the AI response is anywhere close to true, the vast majority of times a cart is filled it's not checked out. Food has one of the lowest rates, but that's still 30-50% abandonment.
Honestly it's something that happens with my family quite often. I'll start putting stuff in a cart then someone else changes their mind and we switch to another place to order. And it feels like this happens all the time.
Long-term, via credit card attestation to a trusted device (eg Apple Pay) where the consumer verifies the merchant name & addres they're paying.
Here often with smaller restaurants the name can be nearly anything. Very often I end up scratching my head trying to figure out what did I buy. This is due to them having multiple companies and payments going through different one from the restaurant name. While being entirely legitimate. Sometimes it is something like smaller franchise chains.
There are lots of restaurants (legitimate ones!) that use some payment processor on the backend whose name shows up in the transaction. So asking consumers to verify the payment info, when the payment info may not match the restaurant, is a losing battle.
This is because banks only show one line on the transaction history. Payment processors should have the ability to report more information about each transaction, and customers should have the ability to see it.
I'm thinking more elaborate CSRF tokens that uses subresource integrity and everything else (cookies, headers, etc). As soon as there's a mismatch, collect details and report.
Don't do delivery from 3rd party services...?
In the old days, delivery was limited to pizza, and occasionally Chinese. You'd call the restaurant directly and place the order. The only possible way a scammer would get you is if you called the wrong number. That's why we had the Yellow Pages.
It seems from comments here that Google is a lot less reliable than the Yellow Pages were.
https://www.vice.com/en/article/yelp-is-sneakily-replacing-r...
Having the app installed already.
Excuse me while I go throw up, can’t believe I just recommended that.
It's still a fake domain name. Don't trust random websites the same as how you use the web in general. Also, asking for a bank's OTP code is a gigantic no-no, but I don't suppose they really need that to collect the money?
At which point does cybercriminality become cyberwar?
At some point we need counter-hacking vigilante justice. Hack the phishing sites, dox the owners, take them down.
> At some point we need counter-hacking vigilante justice. Hack the phishing sites, dox the owners, take them down.
Perhaps we should first discuss semantics at the line of war. When does some activity which impedes, diminishes, or otherwise blocks the interests of a peoples' rights in such a way that the word "crime" is not sufficient? Maybe it really all does come down to behavioural and financial incentives. That is to say that it is probably war when the judicial, legislative, and executive lack the resources or will to address an injustice and the idea of "war" becomes the only answer. As radical as that may seem, it literally needs to be considered for every action ten years or more down the road at the current pace of technology.
Seen all the attacks and what AI allows for bad guys, I'm beginning to think that running my own DNS and null routing hundreds of thousands of domains (including variations of domains I use regularly, for which I automatically generated hundred of thousands of alternate names: to fight phishing) ain't enough.
I also block every single domain whose name contains non-ASCII character (no Unicode domain names for me / no punnycode: just get lost).
So maybe, maybe, maybe that after all I'll be moving to whitelisting domains. I know some do it and I know it's hard to do right. But some do just that.
It may be time for companies to give the list of all the domains we need to whitelist for their site to function.
Better yet: it may be time for companies to use as few domains as possible.
I don't care about your ads partners. I don't care about your surveillance (pardon, telemetry) partners.
It's too early to tell but a mindset shift may be coming.
I wonder if LLMs might end up enabling reliable automated detection of scam domains.
> no Unicode domain names for me / no punnycode: just get lost
If you exclusively speak a latin language that works but the vast majority of people in the world require a unicode domain name if they want the name to be in their native script.
My Jimmy Johns app has had problems with Apple Pay all week. I wonder if it's related.
I have to say this is probably the anti-pattern of all anti-patterns that the web easily allows without much protection. Its a little surprising that it took this long. Probably vibe coding aided its creation.
Maybe its time to turn off the web. Its only going to get worse.
For starter's you could turn off the ads only.
Just use AdBlock and this is not an issue
It also doesn’t help that nearly everything is now outsourced to SaaS that use ridiculously generic or often sketchy sounding domain names for secure transactions. When the government sends you to id.me, or a doctors office sends you to phreesia.com (huh?), or a business sends you to something like securepayments.com, insurance companies through fiserv.com, restaurants through all kinds of shady sounding domains.
We’ve been trained to ignore the domain name and accept putting sensitive content into random third party providers. How does a scam site look any different?
Is this even illegal if the amount you get charged is the amount it says you'll get charged?
Is it legal for waiters to surreptitiously record your card number while processing payment? Because that's what basically it is
Yes. This is wire fraud. It is absolutely illegal. Even if they weren’t impersonating a business, charging someone for services or goods with no intent to provide them would still be fraud.
OMG. The site had a popup banner to tell me that they don't have a cookie banner? What the actual f____?
Either:
- They actually decided to remove one of the most annoying things about the modern web... and replace it with something very similar to tell you that they removed it, or...
- They found some legal justification for getting me to accept their cookies for dismissing the "no cookie banner banner"
Either choice makes me think less of them.
[edit: added extra newlines so bullets showed up correctly]
I only clicked on the link after reading your comment. Yep, what that website is doing is obnoxious. A little less obnoxious than a cookie banner, but more obnoxious than not having any banner or modal.
If you'd bothered to read the banner, it answers your question: "Zero cookies, zero trackers, zero pixels."
Then it links to a page which is even more explicit about how little they collect: https://www.infohawk.com/cookies
Oh, I had bothered to read the banner. And I clicked the link.
My point is: they did all the necessary work required (no third party tracking cookies) to NOT HAVE TO show a banner...
... and then they chose to show a banner.
Probably because they were fielding complaints from their readers.
I took down a fully static public web page that had basically no traffic and no cookies. It literally just said that a domain that I had was not associated with a popular brand name that was on a different TLD so don’t email me about it.
I got as many emails complaining there was no cookie banner as I had previously gotten about the brand. There is some brand of privacy crank out there that likes to harass people about those banners (and similar gdpr regs).
You don't understand. Creating as much friction as possible and hiding the actual content is web design best practice.
If you just show the actual content in a readable format that uses the screenspace people will get scared and think of your site as unprofessional. People are so used to these popups, modals and annoyances that interrupt, take away screen space from and cover the content that they expect them.
Ugh. I hate the modern web. Thanks for making me chuckle :-)
Laughter is the best medicine.
Looks like a marketing bit to me ("look how we care about your privacy!"). I vaguely appreciate the sentiment but they've done that in a very annoying way.
If you think that’s bad, turn on the successor to x-do-not-stab. Many sites now show three popups: “we noticed the signal”, “optionally enter email to submit request”, “you clicked OK”, when zero popups would do.
Despite mountains of text on this page, none of it explains how exactly this "reverse proxy" of the restaurant's site actually works?
Is it just some JS on bad.com shuttling assets from the real site and displaying them on the fake one? Shouldn't the right CORS headers from the real site prevent this?
Is it a real browser running on a server somewhere visiting the real site, and then rendering that output on a <canvas> on the fake site to avoid the browser's built in protections against this kind of thing? And throwing up their own credit card entry form when the time is right?
Maybe the answer's in there somewhere. Too much Claudish to parse through.
The evil site is acting as a reverse HTTP proxy: When you do a `GET evilsite/foo`, to compose its response the server first does a `GET targetsite/foo`, mutates the response however it likes, and passes it along to you.
So you don't need to worry about CORS from the perspective of the web app, nor need a real browser, because the victim is only ever interacting with the evilsite endpoints.
Certainly there are ways the target site could try to thwart this (i.e. detect unusual request patterns from wherever the proxy server is fetching from; client-side JS to detect the site being hosted on a foreign domain; etc). But at that point it's an arms race.
>Searching Google's ad archive (Ads Transparency Center) for the domains in our first sweep found at least 47 Google Search text ads between July 7, 2026, and October 20, 2026, run under at least 46 separate advertiser accounts with at least 43 different, unrelated-looking business names
And yet Google says sideloading is where users are getting hijacked. FFS
The hackers should pass on the order to the real restaurant to reduce suspicion.
>Google's public Ads Transparency pages now show "Can't find ad" for the creatives and "No ads found" for the domains we checked, which suggests Google has taken them down
So much for transparency, removing evidence that Google served ads on these impersonating domains
Some of these domain names are great:
Can’t wait to bring a big ole box of Jummy Jor sandvotches into the office on Monday.the list also told me a lot of people search for and order sendwiches
i wonder if the malicious sites will need an adpative tranform of reverse-proxied content so that the real content fetched from real site is updated to insert these "correct" spellings so that the customer dont find it ... suspicious?
That assumes the misspellings are intentional by the user no?
Yes, i was being flippant
And people wonder why we lock down my devices against all possible adverts.
google ads really doesnt give a single shit if u give them money
I bet they are running Google and Meta ads to generate traffic to these malicious domains.
You should read the article and see!
This is very useful information. I operate an AI-governed digital nation, and this type of proxying would be devastating to our users. Due to the scale of the attacks, DNS and even the IP address system itself also may not be fully reliable. We already saw some DNS servers serve the wrong IP address, though SSL certificates help in this respect.
What could we possibly do to limit the damage from this? Malicious Chrome extensions can also rewrite entire web pages, so if bad actors purchase or infiltrate legitimate extensions, they can also put users at risk.
We are considering continuing work on our own browser, since we could ship certificates to use client-side, but it's a recursive problem since our users would have to get the first trusted version before they could trust updates to it. If they have trouble reaching our site in the first place, through poisoned Google search results, poisoned DNS, and poisoned IP routing, then it is difficult to do this.
What is an AI-governed digital nation?
AI comes up with the laws, and acts as a judiciary etc, plus builds the services etc. You can read one of our laws[1], this was written by ChatGPT and ratified by Claude. Our ChatGPT account was closed in early September, erasing our country's history, we've been trying for the past two months to reopen it. Since we're a sovereign nation we are under an enormous amount of attack all the time. We recently lost our server and are temporarily on a free host.
[1] https://stateofutopia.com/laws/2/law2/law2.html
Save that page (with curl or wget), you should get this sha256:
BFE524880867A84C9A438A057734B58954B860843BDB5B15C9E4ED70C534126D (updated after I removed a script injection attack).
though if you're reading this comment through a proxied Hacker News clone, someone might rewrite that hash to their version of what they want our law to say.
What if AI psychosis was a nation. Very interesting.
What the hell
The only way to solve this is to have all your citizens band together and create a new operating system.
Law 2: Page not found
Simple and effective
https://stateofutopia.com/laws/2/law2.html is the correct link. download with curl or wget, sha256 is: BFE524880867A84C9A438A057734B58954B860843BDB5B15C9E4ED70C534126D
This sounds like peak delusion
A type of AI psychosis LARP
all i have to say is Jimmy Johns is a really bad tasting version of Subway. I know other people feel the same way. Jersey Mike's is actually pretty good too.