Security · High impactFan score 6 · Tier D63 comments in the community
Restaurant Delivery Payment-Skimming Campaign
Hacker News: Front Page ·
The Brief
- Attackers ran a payment-skimming campaign using lookalike sites that reverse-proxied a restaurant delivery site.
- Commenters citing the report say 404 fake domains impersonated a single restaurant brand's site.
- The report found at least 47 Google Search text ads for the domains, run under at least 46 advertiser accounts.
Why it matters
Lookalike domains and paid search ads can send customers to fake checkout pages, so developers should expect brand impersonation and check their own logs and domain coverage.
Who’s affected
- Customers ordering from the impersonated restaurant delivery brand
- Site owners whose brands could be impersonated by lookalike domains
- #payment-skimming
- #phishing
- #food-delivery
- #google-ads
- #typosquatting
- #web-security
What developers are saying
Based on 63 comments · Mostly critical
Commenters largely blame Google for allowing scam ads to run in search results and see the campaign as a symptom of platform centralization. Some doubt that the scheme is clearly illegal and question how the reverse-proxy technique works. Several note that cloned sites and lookalike domains are hard to defend against.
- Google allows scam ads40%
- Centralization enables platform abuse20%
- Hard to defend against clones20%
- Scale of lookalike domains15%
In favour
Concerns
- − Google's ad policies let scam ads run in search results
- − Cloned sites and reverse proxies are hard to detect or block
- − Centralized platforms make abuse like this harder to stop
“Google is the entire problem here. Pay them money and your literal scam site can sit above the real site in the search results.”
“None of this would work if Google Adsense didn't allow scam ads on their system.”
“That's what you (and the restaurant) get from the centralization.”
Timeline
Earliest Google Search text ad for the scam domains in the report's sweep
Latest Google Search text ad for the scam domains in the report's sweep
Hacker News: Front Page
Restaurant Delivery Payment-Skimming Campaign
Hacker News
128 points · 63 comments