Reverse-Proxy Payment Skimming: 820 Restaurant Clones Found

Researchers at InfoHawk uncovered a large-scale fraud campaign targeting restaurant customers through counterfeit ordering websites. The investigation identified 820 malicious domains impersonating 35 restaurant brands, with 808 using the .delivery top-level domain. The operation combines technical sophistication with social engineering: attackers deployed reverse proxies that fetch legitimate pages from real restaurant servers in real-time while silently injecting malicious payment forms. Visitors experience a seamless ordering flow with accurate menus, prices, and cart functions—until reaching payment, where the fake form harvests credit card numbers and SMS verification codes from banks.

The infrastructure reveals a coordinated operation with live human oversight. Attackers hide their servers behind Cloudflare for valid SSL certificates and distribute the scam through Google Search ads across at least 46 advertiser accounts. When a customer submits card details, an operator monitors the transaction in real-time, responding to bank challenges by either declining the card, requesting SMS codes, or approving charges through 3-D Secure verification. Once the operator captures the SMS code, the victim is redirected to a legitimate restaurant’s site—no order reaches the target restaurant, no food is delivered, and the stolen card details are charged for unauthorized purchases.

Distribution records show at least 47 Google Search ads ran between July and October 2026, with most campaigns lasting 1-4 days after domain registration. As of early November, 367 of the 820 domains remained operational, indicating ongoing activity beyond paid search or potential for renewed campaigns.