Incident · high
Restaurant delivery payment-skimming campaign
Tier D · Background noise – Good to know
Who’s exposed: Customers of one restaurant delivery brand, via lookalike domains
Tier D because: Does not hit tech teams
Reach
Attack
Damage
Fix
Exploited in the wild · Secrets exposed
The Brief
- Attackers ran a payment-skimming campaign using lookalike sites that reverse-proxied a restaurant delivery site.
- Commenters citing the report say 404 fake domains impersonated a single restaurant brand's site.
- The report found at least 47 Google Search text ads for the domains, run under at least 46 advertiser accounts.
Why it matters
Lookalike domains and paid search ads can send customers to fake checkout pages, so developers should expect brand impersonation and check their own logs and domain coverage.
The checklist behind the tier
Checklist · 2 of 10 yes
| No | Hits tech teams | Restaurant delivery payment skimming hits consumer ordering and non-tech restaurants, not developer-run systems. |
| No | Core infrastructure | Targets restaurant delivery payment flows, not software nearly every engineering team runs. |
| No | Popular tool | No widely used framework, tool, platform, OS or package is named as the affected product. |
| Yes | Exploited in the wild | Hacker News front page title: "Restaurant Delivery Payment-Skimming Campaign" reports an active campaign. |
| No | Public exploit | No source mentions published exploit code or proof-of-concept; only a title is given. |
| No | Remote, no login | Hacker News title gives no details on the attack vector or authentication requirements. |
| No | Full takeover | Hacker News title does not report code execution, admin rights or account takeover. |
| Yes | Secrets exposed | Hacker News title: payment-skimming campaign, which implies stolen customer payment card data. |
| No | Supply chain | Hacker News title describes a restaurant payment-skimming campaign; no compromised package, update or build pipeline is mentioned. |
| No | No fix yet | A skimming campaign is a breach, not a software vulnerability, so no patch question applies. |
Timeline
Earliest Google Search text ad for the scam domains in the report's sweep
Latest Google Search text ad for the scam domains in the report's sweep
Hacker News: Front Page
Restaurant Delivery Payment-Skimming Campaign
Hacker News
128 points · 63 comments
Source
Restaurant Delivery Payment-Skimming Campaign ↗ Hacker News: Front Page · 20h ago
What developers are saying
Based on 63 comments · Mostly critical
Commenters largely blame Google for allowing scam ads to run in search results and see the campaign as a symptom of platform centralization. Some doubt that the scheme is clearly illegal and question how the reverse-proxy technique works. Several note that cloned sites and lookalike domains are hard to defend against.
- Google allows scam ads40%
- Centralization enables platform abuse20%
- Hard to defend against clones20%
- Scale of lookalike domains15%
In favour
Concerns
- − Google's ad policies let scam ads run in search results
- − Cloned sites and reverse proxies are hard to detect or block
- − Centralized platforms make abuse like this harder to stop
“Google is the entire problem here. Pay them money and your literal scam site can sit above the real site in the search results.”
“None of this would work if Google Adsense didn't allow scam ads on their system.”
“That's what you (and the restaurant) get from the centralization.”
First seen · 1 source · 63 comments · Full story page · How tiers are decided