InfoHawk finds 820 fake restaurant domains skimming card payments
The gist
Security firm InfoHawk found 820 domains impersonating 35 restaurant brands to skim card payments.
The clones copy real ordering sites, so any online food shopper could be targeted.
How it unfolded
- Mar 3, 2026 to Oct 21, 2026Registration or scan dates for Jimmy John's look-alike domains, the earliest range seen among the impersonated brands.
- Nov 3, 2026A server at 196.251.107.226 (AS214351, FEMO IT Solutions, GB; block named "internet-security," listed in the Seychelles) running a live card panel at /payment/socket.io was active, hosting 46 Dave's Hot Chicken clones, all six Chipotle clones, all four Red Lobster clones and a BJ's Restaurants clone.
- Nov 5, 2026InfoHawk published research on 820 domains impersonating 35 restaurant brands, 808 of them on the .delivery top-level domain and the rest on .com or .shop; the investigation began with mlckessejersstey[.]delivery, a Jersey Mike's look-alike.
Key terms
- domains
- A string of characters that identifies a realm of administrative control on the Internet, used to name websites and services.
- reverse-proxy
- A proxy server that appears to clients as an ordinary web server but forwards their requests to backend servers.
Source: Wikipedia