InfoHawk reports 820 domains impersonating US restaurant delivery sites
InfoHawk reports 820 domains impersonating US restaurant chains, some skimming cards and bank SMS codes; order only via official restaurant sites.
- Published
- Ecosystem
- Websites and CMS
- Exploitation
- Not confirmed, InfoHawk reports some domains run skimming checkouts but gives no victim count and there is no independent verification
What happened
InfoHawk reports that its researchers found a network of 820 suspicious domains impersonating 35 US restaurant brands. According to InfoHawk, some of these domains run payment-skimming checkouts that capture credit card details and ask customers for the SMS verification code sent by their bank (InfoHawk). The findings come from a single outlet, and no independent verification has been published. The source contains no comment from the impersonated brands.
InfoHawk says the brands include Jersey Mike’s, Jimmy John’s, Firehouse Subs, Chipotle and Dave’s Hot Chicken. According to InfoHawk, 808 of the 820 domains use the .delivery top-level domain, and the rest use .com or .shop. InfoHawk lists 404 domains impersonating Jimmy John’s, with registration or scan dates between March 3 and October 21, 2026 (InfoHawk).
InfoHawk says its investigation began in early November 2026 with the domain mlckessejersstey[.]delivery, which impersonated Jersey Mike’s. It also cites jarrysaymlckess[.]delivery and dawechlckhort[.]delivery as examples. For the Jersey Mike’s clone, InfoHawk reports that the site reverse-proxied the legitimate restaurant site and replaced the checkout payment form with a malicious one. That form requested card details and the bank SMS verification code (InfoHawk). The source does not say whether the other domains use the same technique.
InfoHawk states that this reverse-proxy approach does not require the legitimate restaurant’s website to have been hacked, because the attackers can run it on infrastructure they control (InfoHawk).
The following are not confirmed: the number of customers affected, the amount of fraud, who operates the domains, how many of the domains actually skim payments, and whether one group or several are behind them. InfoHawk itself says the sites may belong to “one or more” coordinated operations.
Am I affected?
- Customers: you may be exposed if you ordered from one of these restaurant brands through a look-alike domain, especially a .delivery address, and entered card details or a bank SMS code there. InfoHawk says the experience on such sites can appear nearly indistinguishable from ordering directly from the restaurant (InfoHawk).
- Restaurant brands and their web teams: InfoHawk says the reverse-proxy technique it described does not require the legitimate site to be hacked (InfoHawk). The domain list is in the InfoHawk article.
What to do now
- Before paying, confirm that the address bar shows the restaurant’s official domain. InfoHawk says the Jersey Mike’s clone it investigated reverse-proxied the real site, so a familiar-looking page on its own is not proof that a site is genuine.
- Do not enter a bank SMS verification code into a restaurant checkout form. InfoHawk notes that such a code could help authorize fraudulent transactions, depending on how your bank uses it.
- If you entered card details or a code on a suspicious domain, contact your bank or card issuer.
- If you run a restaurant brand’s web presence, review the InfoHawk domain list for names imitating your brand and report them through your usual domain abuse process.