餐厅外卖支付欺诈活动内幕

← All news

November 5, 2026

Scamwich: Inside a Restaurant Delivery Payment-Skimming Campaign

InfoHawk research has uncovered a network of 820 suspicious restaurant domains impersonating major US chains, including Jersey Mike's, Jimmy John's, Firehouse Subs, Chipotle, and Dave's Hot Chicken. Some are running sophisticated payment-skimming attacks that capture credit card information and ask customers for their bank's SMS verification codes.

When customers order food online, they expect a familiar experience: find their restaurant, choose their meal, and pay. Increasingly, criminals are exploiting that familiarity by creating convincing clones of restaurant ordering websites, right down to the original site's underlying code.

In early November 2026, InfoHawk researchers investigated a collection of suspicious websites that appear to be part of one or more coordinated restaurant impersonation and payment-skimming operations.

Across two research passes, we identified 820 domains impersonating 35 restaurant brands. Of those, 808 use the .delivery top-level domain, and the rest use .com or .shop.

The scale is concerning, but what makes these sites particularly dangerous is how convincing they can be.

These aren't ordinary fake websites

The investigation began with a suspicious domain: mlckessejersstey[.]delivery.

The site impersonated Jersey Mike's, the popular sandwich chain, and reproduced its online ordering experience.

Rather than simply displaying a crude imitation of the restaurant's website, the attackers used a more sophisticated approach: reverse-proxying the legitimate site while replacing the checkout payment form with a malicious one.

A reverse proxy can retrieve content from a legitimate website and present it to visitors under a different domain. This allows an attacker-controlled site to display genuine pages and assets while selectively modifying the parts of the experience that matter to the attacker.

In this case, the malicious checkout requested credit card information and also asked customers for the SMS verification code sent by their bank.

This is a particularly dangerous combination. Capturing a credit card number is valuable to criminals; obtaining a one-time verification code could also help them authorize fraudulent transactions, depending on how the victim's bank uses that code.

For consumers, the experience can appear nearly indistinguishable from ordering directly from the restaurant. The site looks familiar, the menu and ordering flow can behave normally, and the fraudulent payment form appears at the moment a customer expects to pay.

Importantly, this does not require the legitimate restaurant's website to have been hacked. The attackers can operate on infrastructure they control while using the authentic restaurant website as the source of the content they display.

Impersonated brands

Mostly .delivery typosquats, plus a few look-alike .com and .shop names, found across two research passes. "Seen" is the range of registration or scan dates we have for a brand's domains, all in 2026. Open a brand to see its domains.

Brand clonedDomainsSeen

Jimmy John's404Mar 3 – Oct 21

· jijmmyjomsandwich[.]delivery

· jilmmyjjsendwich[.]delivery

· jilmmyjohsendwich[.]delivery

· jilmmyjomsendwich[.]delivery

· jimijunes[.]delivery

· jimjjonesand[.]delivery

· jimlyjoosandwich[.]delivery

· jimmijones[.]delivery

· jimmijons[.]delivery

· jimmjjohsendwic[.]delivery

· jimmjjohsendwich[.]delivery

· jimmjonnsandwichers[.]delivery

· jimmjonsandwichers[.]delivery

· jimmjonsandwiches[.]delivery

· jimmjosandwichers[.]delivery

· jimmjosandwiches[.]delivery

· jimmjosandwicthers[.]delivery

· jimmlysandwichdel[.]delivery

· jimmsandwichers[.]delivery

· jimmujohsandwisch[.]delivery

· jimmyjiosandwichs[.]delivery

· jimmyjjons[.]delivery

· jimmyjjosandwichs[.]delivery

· jimmyjjsandwichs[.]delivery

· jimmyjjsandwitch[.]delivery

· jimmyjohsandvich[.]delivery

· jimmyjohsandwich[.]delivery

· jimmyjonsendwich[.]delivery

· jimmyjosandwitch[.]delivery

· jimmyjosendwiches[.]delivery

· jimmysandwich[.]delivery

· jimmysandwichjj[.]delivery

· jimmysandwichjjo[.]delivery

· jimmysandwichjlon[.]delivery

· jimmysandwichjon[.]delivery

· jimmysandwitch[.]delivery

· jimmysendwichjon[.]delivery

· jimmywhojo[.]delivery

· jimyjjohsandwichs[.]delivery

· jimyjjomsandwichs[.]delivery

· jimyjjosandwiches[.]delivery

· jimyjjosandwicth[.]delivery

· jimyjjosendwiches[.]delivery

· jimyjjosendwicthes[.]delivery

· jimyjohsandwichs[.]delivery

· jjimmyssandwich[.]delivery

· jjlmmydelsendwich[.]delivery

· jjmjohnsandch[.]delivery

· jjmmjjohsendwich[.]delivery

· jjmmjonnsandwichas[.]delivery

· jjmmjonnsandwiches[.]delivery

· jjmmjonnsandwichs[.]delivery

· jjmmjonnsandwicths[.]delivery

· jjmmjonsandw[.]delivery

· jjmmjonsandwicheres[.]delivery

· jjmmjonsandwichers[.]delivery

· jjmmjonsandwiches[.]delivery

· jjmmjonsandwichs[.]delivery

· jjmmjonysandwicths[.]delivery

· jjmmjornsandwicths[.]delivery

· jjmmyjohdelandwach[.]delivery

· jjmmyjohdelinsandwah[.]delivery

· jjmmyjohdelirsandwch[.]delivery

· jjmmyjohdelirsandwech[.]delivery

· jjmmyjohdelirsendw[.]delivery

· jjmmyjohdelisandw[.]delivery

· jjmmyjohdelisandwach[.]delivery

· jjmmyjohdelisandwah[.]delivery

· jjmmyjohdelisandwe[.]delivery

· jjmmyjohdelisandwec[.]delivery

· jjmmyjohdelisandwech[.]delivery

· jjmmyjohdelisandweh[.]delivery

· jjmmyjohdelisendw[.]delivery

· jjmmyjohdelitsandwch[.]delivery

· jjmmyjohdelivsandw[.]delivery

· jjmmyjohdelivsandwach[.]delivery

· jjmmyjohdelivsandwanh[.]delivery

· jjmmyjohdelivsandwech[.]delivery

· jjmmyjohdelivsendw[.]delivery

· jjmmyjohdelivsendwich[.]delivery

· jjmmyjohdelivssandwech[.]delivery

· jjmmyjohdelivvsendw[.]delivery

· jjmmyjohdeliwsendw[.]delivery

· jjmmyjohdelyvsandw[.]delivery

· jjmmyjohedelivsandwch[.]delivery

· jjmmyjohnsanbwanh[.]delivery

· jjmmyjohnsandwanh[.]delivery

· jjmmyjohsand[.]delivery

· jjmmyjohsandwanh[.]delivery

· jjmmyjohsandwans[.]delivery

· jjmmyjohsandwens[.]delivery

· jjmmyjohsandwihes[.]delivery

· jjmmyjohsandwihs[.]delivery

· jjmmyjohsandwinds[.]delivery

· jjmmyjohsandwins[.]delivery

· jjmmyjohsandwit[.]delivery

· jjmmyjohsandwiths[.]delivery

· jjmmyjohsandwits[.]delivery

· jjmmyjohsandwons[.]delivery

· jjmmyjohsendvitches[.]delivery

· jjmmyjohsendvitchs[.]delivery

· jjmmyjohsendwech[.]delivery

· jjmmyjohsendwich[.]delivery

· jjmmyjohsendwihs[.]delivery

· jjmmyjohsendwins[.]delivery

· jjmmyjohsendwitchs[.]delivery

· jjmmyjohsendwiths[.]delivery

· jjmmyjomsandwich[.]delivery

· jjmmyjones[.]delivery

· jjmmyjonesanb[.]delivery

· jjmmyjonesanbwitch[.]delivery

· jjmmyjonesandwihes[.]delivery

· jjmmyjonesandwit[.]delivery

· jjmmyjonesandwitch[.]delivery

· jjmmyjonesdely[.]delivery

· jjmmyjonessndw[.]delivery

· jjmmyjonhes[.]delivery

· jjmmyjonhesanbwihes[.]delivery

· jjmmyjonhesandwihes[.]delivery

· jjmmyjonhessandw[.]delivery

· jjmmyjonhessanw[.]delivery

· jjmmyjonsanbwanh[.]delivery

· jjmmyjonsand[.]delivery

· jjmmyjonsandwinds[.]delivery

· jjmmyjonsandwirds[.]delivery

· jjmmyjonsandwlrds[.]delivery

· jjmmyjonsanw[.]delivery

· jjmmyjonsanwanh[.]delivery

· jjmmyjonsanwatnh[.]delivery

· jjmmyjoomsandwich[.]delivery

· jjmmyjoonsandwich[.]delivery

· jjmmyjorhsandwit[.]delivery

· jjmmyjosandchv[.]delivery

· jjmmyjosandchw[.]delivery

· jjmmyjosandwitch[.]delivery

· jjmmyjosendwich[.]delivery

· jjmmysanbwihes[.]delivery

· jjmmysandwichs[.]delivery

· jjmmyyjjons[.]delivery

· jjmmyyjjos[.]delivery

· jjmmyyjohsendwich[.]delivery

· jjohjimmsendwich[.]delivery

· jjohjimmsendwiches[.]delivery

· jjohjjmmysendwiches[.]delivery

· jjojlmmydelsendwicher[.]delivery

· jjummyjohsandwitch[.]delivery

· jjummyjosandwitch[.]delivery

· jjummyjosandwitchs[.]delivery

· jjymmjohsandwichs[.]delivery

· jlimmjoohsandwiches[.]delivery

· jlimmysaandwiches[.]delivery

· jlimysaandwiches[.]delivery

· jlmmjohsanbit[.]delivery

· jlmmjohsanbwes[