damn it. Every now and then I daydream about a federated network of digital delivery infra to cut out these platform middlemen but abuse/moderation like this is still what makes the idea impossible to take off. That's what you (and the restaurant) get from the centralization.
None of this would work if Google Adsense didn't allow scam ads on their system. But they do, millions every day (I deal with this every day on my websites, Google don't care).
i gave up reporting scams to meta and google, you get the distinct impression they are in on it when you get a response saying “we looked into it and it was fine”
Cloudflare is no better, maybe worse. They forward your complaint & PI on to the offending site's registered owner and to whichever (gray or black hat) host it's served from. In my experience, there is nothing you can do to convince Cloudflare to do anything other than be a middleman for the complaint, yet they offer a layer of protection for the nefarious activities.
Even when I've been able to track down hosts, registrars, etc for scraped duplicates of sites, and report to all and Google, Microsoft Safety Scanner, etc -- nobody acts (or certainly not in any reasonable enough time to be useful).
In one case the scammer was using our own logo served directly from a source we could replace with Cloudflare rewrites. So the hijacked logo became "THIS IS A SCAM SITE" while we replaced the one on production.
Are you getting takedown requests from people who don’t understand how DNS works, or… are they actually suggesting that your particular DNS server filter particular results?
> Cloudflare is no better, maybe worse. They forward your complaint & PI on to the offending site's registered owner and to whichever (gray or black hat) host it's served from.
This is literally false. They are one of the few hosts I have dealt with that actually does NOT do this. Their abuse reporting form even has check boxes that are optional to forward it to the underlying host and the owner. If you leave them unchecked they don't forward anything.
I don't know where you got your information from but it's quite literally the opposite of reality.
Now, whether or not they actually act on it depends on whether they are proxying the site or merely providing authoritative DNS. If they are just providing DNS they will continue to provide it and deny your report and I think that's stupid and frustrating. If they are proxying it they will put up a block page in front of it which is meh.
A large company's report system is designed to distract you from complaint paths that work and are expensive for the company to deal with (lawsuits) and make you complain to /dev/null instead.
They should be held liable, in the same way as brick and mortar stores are liable if they sell you shoddy goods, and the manufacturer can’t be found after your house burns down or whatever.
Hmm, how do you even protect against this one? Rewriting the entire website makes the entire situation a bit more difficult, you can control about everything.
There are lots of restaurants (legitimate ones!) that use some payment processor on the backend whose name shows up in the transaction. So asking consumers to verify the payment info, when the payment info may not match the restaurant, is a losing battle.
This is because banks only show one line on the transaction history. Payment processors should have the ability to report more information about each transaction, and customers should have the ability to see it.
Here often with smaller restaurants the name can be nearly anything. Very often I end up scratching my head trying to figure out what did I buy. This is due to them having multiple companies and payments going through different one from the restaurant name. While being entirely legitimate. Sometimes it is something like smaller franchise chains.
This advice from the article to the affected retailers:
Brands and their ordering providers that watch for their site loading under someone else's domain, or for checkout sessions that never reach the real payment provider, are well placed to catch these sites early.
It can be detected if the IT folks look in the right places. I suppose a SCAM ALERT page could be presented to a reverse proxy when discovered.
I don't know the scale of cart-abandonment for a website like Jimmy John's, but it has got to be large enough that a few dozen more wouldn't be _too_ surprising.
In the old days, delivery was limited to pizza, and occasionally Chinese. You'd call the restaurant directly and place the order. The only possible way a scammer would get you is if you called the wrong number. That's why we had the Yellow Pages.
It seems from comments here that Google is a lot less reliable than the Yellow Pages were.
It's still a fake domain name. Don't trust random websites the same as how you use the web in general. Also, asking for a bank's OTP code is a gigantic no-no, but I don't suppose they really need that to collect the money?
I'm thinking more elaborate CSRF tokens that uses subresource integrity and everything else (cookies, headers, etc). As soon as there's a mismatch, collect details and report.
You make the penalty for being caught have teeth. A slap on the wrist (or nothing in this case) just encourages more abuse. Make a public showing that it wont be tolerated.
Something short of public execution, but decades in prison seems reasonable.
Google is the entire problem here. Pay them money and your literal scam site can sit above the real site in the search results.
Why are they allowed to direct you to literal scams? Why are they allowed to profit off of literal scams?
This affects the company I work for, who gets called every single day with customer complaints from people who clicked the scam link from a search ad when looking for our site.
Our site has existed for over a decade. There's no justifiable reason that a company who's brand is known by every single grocer or merchant to somehow show up under a literal fly by night scam company pretending to have the same name. It's unacceptable.
My sister got scammed by this exact mechanism just last week.
I often use google shopping when I’m looking at items in categories I’m not familiar with. About half the time there is a store charging significantly less than the others. I’ll open a new tab ask Google search AI if the site is legit, and 95% of the time the response is that it’s a well known scam site. So the anemic search AI knows it’s a scam, but google shopping has no problem sending people there (likely with an affiliate code).
Sounds like you pay less for ads than someone else will. Attention is the currency in the world, pay more and your site will be on top, clearly there are customers that want your product.
OMG. The site had a popup banner to tell me that they don't have a cookie banner? What the actual f____?
Either:
- They actually decided to remove one of the most annoying things about the modern web... and replace it with something very similar to tell you that they removed it, or...
- They found some legal justification for getting me to accept their cookies for dismissing the "no cookie banner banner"
Either choice makes me think less of them.
[edit: added extra newlines so bullets showed up correctly]
Probably because they were fielding complaints from their readers.
I took down a fully static public web page that had basically no traffic and no cookies. It literally just said that a domain that I had was not associated with a popular brand name that was on a different TLD so don’t email me about it.
I got as many emails complaining there was no cookie banner as I had previously gotten about the brand. There is some brand of privacy crank out there that likes to harass people about those banners (and similar gdpr regs).
You don't understand. Creating as much friction as possible and hiding the actual content is web design best practice.
If you just show the actual content in a readable format that uses the screenspace people will get scared and think of your site as unprofessional. People are so used to these popups, modals and annoyances that interrupt, take away screen space from and cover the content that they expect them.
I only clicked on the link after reading your comment. Yep, what that website is doing is obnoxious. A little less obnoxious than a cookie banner, but more obnoxious than not having any banner or modal.
If you think that’s bad, turn on the successor to x-do-not-stab. Many sites now show three popups: “we noticed the signal”, “optionally enter email to submit request”, “you clicked OK”, when zero popups would do.
Looks like a marketing bit to me ("look how we care about your privacy!"). I vaguely appreciate the sentiment but they've done that in a very annoying way.
Couldn't the original website owner just look at the logs and see where most of the requests are coming from? And also the referrers would be a dead giveaway, right? That's assuming someone is looking at the `access.log` file occasionally.
Blocking IP ranges and user agents has nothing to do with "AI". It's a bad practice by lazy sysadmins who'd rather discriminate users than fix their infra. Writing this from a non-profit ISP (fdn.fr) whose IP range is blocked by Google and Reddit and noone still knows why or how to unblock it [0].
Residential proxies on the other hand i don't think have any legitime usecase. I would support people working around Youtube to export interesting videos to Bittorrent. But what's happening is malicious actors going around rate limiting to run bad-behaving scrapers on smaller sites. That, and much worse is the residential proxy economy.
>Searching Google's ad archive (Ads Transparency Center) for the domains in our first sweep found at least 47 Google Search text ads between July 7, 2026, and October 20, 2026, run under at least 46 separate advertiser accounts with at least 43 different, unrelated-looking business names
And yet Google says sideloading is where users are getting hijacked. FFS
The hackers should pass on the order to the real restaurant to reduce suspicion.
>Google's public Ads Transparency pages now show "Can't find ad" for the creatives and "No ads found" for the domains we checked, which suggests Google has taken them down
So much for transparency, removing evidence that Google served ads on these impersonating domains
Despite mountains of text on this page, none of it explains how exactly this "reverse proxy" of the restaurant's site actually works?
Is it just some JS on bad.com shuttling assets from the real site and displaying them on the fake one? Shouldn't the right CORS headers from the real site prevent this?
Is it a real browser running on a server somewhere visiting the real site, and then rendering that output on a <canvas> on the fake site to avoid the browser's built in protections against this kind of thing? And throwing up their own credit card entry form when the time is right?
Maybe the answer's in there somewhere. Too much Claudish to parse through.
The evil site is acting as a reverse HTTP proxy: When you do a `GET evilsite/foo`, to compose its response the server first does a `GET targetsite/foo`, mutates the response however it likes, and passes it along to you.
So you don't need to worry about CORS from the perspective of the web app, nor need a real browser, because the victim is only ever interacting with the evilsite endpoints.
Certainly there are ways the target site could try to thwart this (i.e. detect unusual request patterns from wherever the proxy server is fetching from; client-side JS to detect the site being hosted on a foreign domain; etc). But at that point it's an arms race.
This is very useful information. I operate an AI-governed digital nation, and this type of proxying would be devastating to our users. Due to the scale of the attacks, DNS and even the IP address system itself also may not be fully reliable. We already saw some DNS servers serve the wrong IP address, though SSL certificates help in this respect.
What could we possibly do to limit the damage from this? Malicious Chrome extensions can also rewrite entire web pages, so if bad actors purchase or infiltrate legitimate extensions, they can also put users at risk.
We are considering continuing work on our own browser, since we could ship certificates to use client-side, but it's a recursive problem since our users would have to get the first trusted version before they could trust updates to it. If they have trouble reaching our site in the first place, through poisoned Google search results, poisoned DNS, and poisoned IP routing, then it is difficult to do this.
AI comes up with the laws, and acts as a judiciary etc, plus builds the services etc. You can read one of our laws[1], this was written by ChatGPT and ratified by Claude. Our ChatGPT account was closed in early September, erasing our country's history, we've been trying for the past two months to reopen it. Since we're a sovereign nation we are under an enormous amount of attack all the time. We recently lost our server and are temporarily on a free host.
Save that page (with curl or wget), you should get this sha256:
BFE524880867A84C9A438A057734B58954B860843BDB5B15C9E4ED70C534126D (updated after I removed a script injection attack).
though if you're reading this comment through a proxied Hacker News clone, someone might rewrite that hash to their version of what they want our law to say.
the list also told me a lot of people search for and order sendwiches
i wonder if the malicious sites will need an adpative tranform of reverse-proxied content so that the real content fetched from real site is updated to insert these "correct" spellings so that the customer dont find it ... suspicious?
all i have to say is Jimmy Johns is a really bad tasting version of Subway. I know other people feel the same way. Jersey Mike's is actually pretty good too.
I have to say this is probably the anti-pattern of all anti-patterns that the web easily allows without much protection. Its a little surprising that it took this long. Probably vibe coding aided its creation.
Maybe its time to turn off the web. Its only going to get worse.
It also doesn’t help that nearly everything is now outsourced to SaaS that use ridiculously generic or often sketchy sounding domain names for secure transactions. When the government sends you to id.me, or a doctors office sends you to phreesia.com (huh?), or a business sends you to something like securepayments.com, insurance companies through fiserv.com, restaurants through all kinds of shady sounding domains.
We’ve been trained to ignore the domain name and accept putting sensitive content into random third party providers. How does a scam site look any different?
Yes. This is wire fraud. It is absolutely illegal. Even if they weren’t impersonating a business, charging someone for services or goods with no intent to provide them would still be fraud.
A total of 404 fake domains impersonating a single restaurant brand site!
The scale is mind-boggling. The number 404 is poetic. Any possible (mis) spelling of the brand will open the "intended" site - you will never see a 404 :D. Auto-correct on steroids indeed.
And I imagine this sort of thing must be happening across hundreds of markets not just US. And possibly not just food delivery but other types of ecommerce as well.
Seen all the attacks and what AI allows for bad guys, I'm beginning to think that running my own DNS and null routing hundreds of thousands of domains (including variations of domains I use regularly, for which I automatically generated hundred of thousands of alternate names: to fight phishing) ain't enough.
I also block every single domain whose name contains non-ASCII character (no Unicode domain names for me / no punnycode: just get lost).
So maybe, maybe, maybe that after all I'll be moving to whitelisting domains. I know some do it and I know it's hard to do right. But some do just that.
It may be time for companies to give the list of all the domains we need to whitelist for their site to function.
Better yet: it may be time for companies to use as few domains as possible.
I don't care about your ads partners. I don't care about your surveillance (pardon, telemetry) partners.
It's too early to tell but a mindset shift may be coming.
_def | 19 hours ago
ModernTimes | 19 hours ago
https://en.wikipedia.org/wiki/Racketeer_Influenced_and_Corru...
bvcp | 18 hours ago
toomuchtodo | 17 hours ago
hoppyhoppy2 | 12 hours ago
I'd have trouble believing that U.S. Attorney General Todd Blanche would care very much, but I guess it wouldn't hurt to try.
bnmathm | 17 hours ago
Even when I've been able to track down hosts, registrars, etc for scraped duplicates of sites, and report to all and Google, Microsoft Safety Scanner, etc -- nobody acts (or certainly not in any reasonable enough time to be useful).
In one case the scammer was using our own logo served directly from a source we could replace with Cloudflare rewrites. So the hijacked logo became "THIS IS A SCAM SITE" while we replaced the one on production.
brian_cunnie | 14 hours ago
I act. I receive about 5 takedown notices every day--the curse of running an open source DNS service (nip.io/sslip.io).
I've received over 1,000 takedown requests, but none came from Cloudflare or Google. Most of them come from Netcraft, Phishlabs, and doppel.com.
rsync | 11 hours ago
Are you getting takedown requests from people who don’t understand how DNS works, or… are they actually suggesting that your particular DNS server filter particular results?
rawling | 6 hours ago
They seem to invite it
arcfour | 14 hours ago
This is literally false. They are one of the few hosts I have dealt with that actually does NOT do this. Their abuse reporting form even has check boxes that are optional to forward it to the underlying host and the owner. If you leave them unchecked they don't forward anything.
I don't know where you got your information from but it's quite literally the opposite of reality.
Now, whether or not they actually act on it depends on whether they are proxying the site or merely providing authoritative DNS. If they are just providing DNS they will continue to provide it and deny your report and I think that's stupid and frustrating. If they are proxying it they will put up a block page in front of it which is meh.
mitxela | 12 hours ago
hedora | 11 hours ago
MisterMunchkin | 5 hours ago
Upload a scam ad? No problemo.
pixl97 | 19 hours ago
trollbridge | 19 hours ago
warkdarrior | 19 hours ago
gwerbin | 18 hours ago
Ekaros | 18 hours ago
ModernTimes | 19 hours ago
Crunchified | 19 hours ago
Brands and their ordering providers that watch for their site loading under someone else's domain, or for checkout sessions that never reach the real payment provider, are well placed to catch these sites early.
It can be detected if the IT folks look in the right places. I suppose a SCAM ALERT page could be presented to a reverse proxy when discovered.
StilesCrisis | 18 hours ago
ano-ther | 15 hours ago
StilesCrisis | 13 hours ago
DANmode | 18 hours ago
Excuse me while I go throw up, can’t believe I just recommended that.
BeetleB | 16 hours ago
In the old days, delivery was limited to pizza, and occasionally Chinese. You'd call the restaurant directly and place the order. The only possible way a scammer would get you is if you called the wrong number. That's why we had the Yellow Pages.
It seems from comments here that Google is a lot less reliable than the Yellow Pages were.
mayneack | 14 hours ago
foxglacier | 12 hours ago
tosti | 9 hours ago
dismalpedigree | 3 hours ago
0x4e | 19 hours ago
StilesCrisis | 18 hours ago
yh11 | 19 hours ago
mrguyorama | 19 hours ago
Why are they allowed to direct you to literal scams? Why are they allowed to profit off of literal scams?
This affects the company I work for, who gets called every single day with customer complaints from people who clicked the scam link from a search ad when looking for our site.
Our site has existed for over a decade. There's no justifiable reason that a company who's brand is known by every single grocer or merchant to somehow show up under a literal fly by night scam company pretending to have the same name. It's unacceptable.
My sister got scammed by this exact mechanism just last week.
mitxela | 12 hours ago
jonhohle | 2 hours ago
augment_me | 28 minutes ago
emacdona | 18 hours ago
Either:
- They actually decided to remove one of the most annoying things about the modern web... and replace it with something very similar to tell you that they removed it, or...
- They found some legal justification for getting me to accept their cookies for dismissing the "no cookie banner banner"
Either choice makes me think less of them.
[edit: added extra newlines so bullets showed up correctly]
handoflixue | 18 hours ago
Then it links to a page which is even more explicit about how little they collect: https://www.infohawk.com/cookies
emacdona | 15 hours ago
My point is: they did all the necessary work required (no third party tracking cookies) to NOT HAVE TO show a banner...
... and then they chose to show a banner.
kasey_junk | 3 hours ago
I took down a fully static public web page that had basically no traffic and no cookies. It literally just said that a domain that I had was not associated with a popular brand name that was on a different TLD so don’t email me about it.
I got as many emails complaining there was no cookie banner as I had previously gotten about the brand. There is some brand of privacy crank out there that likes to harass people about those banners (and similar gdpr regs).
basilikum | 3 hours ago
If you just show the actual content in a readable format that uses the screenspace people will get scared and think of your site as unprofessional. People are so used to these popups, modals and annoyances that interrupt, take away screen space from and cover the content that they expect them.
emacdona | 2 hours ago
Laughter is the best medicine.
rationalist | 17 hours ago
hedora | 11 hours ago
williamdclt | 2 hours ago
mlmonkey | 17 hours ago
lokar | 15 hours ago
hedora | 11 hours ago
selfhoster1312 | 9 hours ago
Residential proxies on the other hand i don't think have any legitime usecase. I would support people working around Youtube to export interesting videos to Bittorrent. But what's happening is malicious actors going around rate limiting to run bad-behaving scrapers on smaller sites. That, and much worse is the residential proxy economy.
[0] https://www.fdn.fr/the-fdn-and-gitoyen-networks-are-blocked-...
hnburnsy | 17 hours ago
And yet Google says sideloading is where users are getting hijacked. FFS
The hackers should pass on the order to the real restaurant to reduce suspicion.
>Google's public Ads Transparency pages now show "Can't find ad" for the creatives and "No ads found" for the domains we checked, which suggests Google has taken them down
So much for transparency, removing evidence that Google served ads on these impersonating domains
akersten | 16 hours ago
Is it just some JS on bad.com shuttling assets from the real site and displaying them on the fake one? Shouldn't the right CORS headers from the real site prevent this?
Is it a real browser running on a server somewhere visiting the real site, and then rendering that output on a <canvas> on the fake site to avoid the browser's built in protections against this kind of thing? And throwing up their own credit card entry form when the time is right?
Maybe the answer's in there somewhere. Too much Claudish to parse through.
mik3y | 16 hours ago
So you don't need to worry about CORS from the perspective of the web app, nor need a real browser, because the victim is only ever interacting with the evilsite endpoints.
Certainly there are ways the target site could try to thwart this (i.e. detect unusual request patterns from wherever the proxy server is fetching from; client-side JS to detect the site being hosted on a foreign domain; etc). But at that point it's an arms race.
logicallee | 16 hours ago
What could we possibly do to limit the damage from this? Malicious Chrome extensions can also rewrite entire web pages, so if bad actors purchase or infiltrate legitimate extensions, they can also put users at risk.
We are considering continuing work on our own browser, since we could ship certificates to use client-side, but it's a recursive problem since our users would have to get the first trusted version before they could trust updates to it. If they have trouble reaching our site in the first place, through poisoned Google search results, poisoned DNS, and poisoned IP routing, then it is difficult to do this.
IncreasePosts | 16 hours ago
logicallee | 16 hours ago
[1] https://stateofutopia.com/laws/2/law2/law2.html
Save that page (with curl or wget), you should get this sha256:
BFE524880867A84C9A438A057734B58954B860843BDB5B15C9E4ED70C534126D (updated after I removed a script injection attack).
though if you're reading this comment through a proxied Hacker News clone, someone might rewrite that hash to their version of what they want our law to say.
NamlchakKhandro | 15 hours ago
human_eyes | 14 hours ago
JSR_FDED | 14 hours ago
protocolture | 13 hours ago
executive | 13 hours ago
Simple and effective
logicallee | 13 hours ago
mitxela | 12 hours ago
jihadjihad | 15 hours ago
albert_e | 9 hours ago
i wonder if the malicious sites will need an adpative tranform of reverse-proxied content so that the real content fetched from real site is updated to insert these "correct" spellings so that the customer dont find it ... suspicious?
skinfaxi | 5 hours ago
albert_e | 4 hours ago
jijji | 14 hours ago
BatchJob | 14 hours ago
Maybe its time to turn off the web. Its only going to get worse.
zaik | 12 hours ago
jonhohle | 2 hours ago
We’ve been trained to ignore the domain name and accept putting sensitive content into random third party providers. How does a scam site look any different?
augment_me | 30 minutes ago
cowlevel | 10 hours ago
gruez | 4 hours ago
grumple | 3 hours ago
albert_e | 9 hours ago
The scale is mind-boggling. The number 404 is poetic. Any possible (mis) spelling of the brand will open the "intended" site - you will never see a 404 :D. Auto-correct on steroids indeed.
And I imagine this sort of thing must be happening across hundreds of markets not just US. And possibly not just food delivery but other types of ecommerce as well.
bigfloppa | 2 hours ago
znnajdla | 33 minutes ago
LightBug1 | an hour ago
TacticalCoder | 46 minutes ago
I also block every single domain whose name contains non-ASCII character (no Unicode domain names for me / no punnycode: just get lost).
So maybe, maybe, maybe that after all I'll be moving to whitelisting domains. I know some do it and I know it's hard to do right. But some do just that.
It may be time for companies to give the list of all the domains we need to whitelist for their site to function.
Better yet: it may be time for companies to use as few domains as possible.
I don't care about your ads partners. I don't care about your surveillance (pardon, telemetry) partners.
It's too early to tell but a mindset shift may be coming.