Rendered at 06:44:53 GMT+0000 (Coordinated Universal Time) with Cloudflare Workers.
ModernTimes 1 days ago [-]
None of this would work if Google Adsense didn't allow scam ads on their system. But they do, millions every day (I deal with this every day on my websites, Google don't care).
Cloudflare is no better, maybe worse. They forward your complaint & PI on to the offending site's registered owner and to whichever (gray or black hat) host it's served from. In my experience, there is nothing you can do to convince Cloudflare to do anything other than be a middleman for the complaint, yet they offer a layer of protection for the nefarious activities.
Even when I've been able to track down hosts, registrars, etc for scraped duplicates of sites, and report to all and Google, Microsoft Safety Scanner, etc -- nobody acts (or certainly not in any reasonable enough time to be useful).
In one case the scammer was using our own logo served directly from a source we could replace with Cloudflare rewrites. So the hijacked logo became "THIS IS A SCAM SITE" while we replaced the one on production.
brian_cunnie 1 days ago [-]
> nobody acts
I act. I receive about 5 takedown notices every day--the curse of running an open source DNS service (nip.io/sslip.io).
I've received over 1,000 takedown requests, but none came from Cloudflare or Google. Most of them come from Netcraft, Phishlabs, and doppel.com.
rsync 1 days ago [-]
This is interesting… Could you elaborate?
Are you getting takedown requests from people who don’t understand how DNS works, or… are they actually suggesting that your particular DNS server filter particular results?
rawling 21 hours ago [-]
> We take abuse reports very seriously. To report a site, email the offending URL to abuse@nip.io. We respond to all abuse reports within 24 hours
They seem to invite it
arcfour 1 days ago [-]
> Cloudflare is no better, maybe worse. They forward your complaint & PI on to the offending site's registered owner and to whichever (gray or black hat) host it's served from.
This is literally false. They are one of the few hosts I have dealt with that actually does NOT do this. Their abuse reporting form even has check boxes that are optional to forward it to the underlying host and the owner. If you leave them unchecked they don't forward anything.
I don't know where you got your information from but it's quite literally the opposite of reality.
Now, whether or not they actually act on it depends on whether they are proxying the site or merely providing authoritative DNS. If they are just providing DNS they will continue to provide it and deny your report and I think that's stupid and frustrating. If they are proxying it they will put up a block page in front of it which is meh.
mitxela 1 days ago [-]
A large company's report system is designed to distract you from complaint paths that work and are expensive for the company to deal with (lawsuits) and make you complain to /dev/null instead.
bvcp 1 days ago [-]
i gave up reporting scams to meta and google, you get the distinct impression they are in on it when you get a response saying “we looked into it and it was fine”
toomuchtodo 1 days ago [-]
Report them to the FTC and your attorney general.
hoppyhoppy2 1 days ago [-]
Your state's attorney general's office, yes, definitely - many have a consumer protection division or whatever.
I'd have trouble believing that U.S. Attorney General Todd Blanche would care very much, but I guess it wouldn't hurt to try.
1 days ago [-]
150g2 19 hours ago [-]
[dead]
MisterMunchkin 21 hours ago [-]
Try and upvote your own YouTube video and they’ll be on you like a ton of bricks.
Upload a scam ad? No problemo.
LorenPechtel 5 hours ago [-]
The problem is they keep changing identity. From what they said Google is taking them down--it's just they keep coming back under new names. Killing a hydra is hard!
1 days ago [-]
hedora 1 days ago [-]
They should be held liable, in the same way as brick and mortar stores are liable if they sell you shoddy goods, and the manufacturer can’t be found after your house burns down or whatever.
albert_e 24 hours ago [-]
A total of 404 fake domains impersonating a single restaurant brand site!
The scale is mind-boggling. The number 404 is poetic. Any possible (mis) spelling of the brand will open the "intended" site - you will never see a 404 :D. Auto-correct on steroids indeed.
And I imagine this sort of thing must be happening across hundreds of markets not just US. And possibly not just food delivery but other types of ecommerce as well.
ryandrake 15 hours ago [-]
> Across two research passes, we identified 820 domains impersonating 35 restaurant brands. Of those, 808 use the .delivery top-level domain, and the rest use .com or .shop.
This crazy proliferation of top level domains has to be part of the problem. Every time a new one is conjured up, legitimate businesses and organizations need to scramble and buy them before a scammer inevitably snaps it up and starts scamming on it.
What are you suggesting browsers ought to do here? Sure ICANN is a very flawed solution and the gTLD cash grab has reached absurd levels but what are you expecting browser vendors to do? For example .net .de and .delivery are all equally legitimate TLDs according to both the central body and all the infrastructure providers.
voakbasda 13 hours ago [-]
Stop hiding URLs for one. I still can’t believe that is a thing.
ryandrake 13 hours ago [-]
E-mail anti-spam systems are able to crowdsource and otherwise build up reputation for domains. Surely "selecting the legit domain for Organization X" is within the realm of computability.
Of course, I'll admit there is a danger there of creating a two-tier domain system, where the "big guy$" get the green Checkmark of Legitimacy or whatever in browsers, and everyone else, including mypersonalwebsite.org gets the shaft. I don't have all the answers but surely we are capable of at least crowdsourcing a list of known scam sites and surfacing them at the browser level.
6510 13 hours ago [-]
It seems fun to load a local business directory into the browser.
If there is a banana.tw in your neigbourhood, loading banana.delivery could trigger a popup asking if you were looking for banana.tw
stablevoy 9 hours ago [-]
[flagged]
mrguyorama 1 days ago [-]
Google is the entire problem here. Pay them money and your literal scam site can sit above the real site in the search results.
Why are they allowed to direct you to literal scams? Why are they allowed to profit off of literal scams?
This affects the company I work for, who gets called every single day with customer complaints from people who clicked the scam link from a search ad when looking for our site.
Our site has existed for over a decade. There's no justifiable reason that a company who's brand is known by every single grocer or merchant to somehow show up under a literal fly by night scam company pretending to have the same name. It's unacceptable.
My sister got scammed by this exact mechanism just last week.
jonhohle 17 hours ago [-]
I often use google shopping when I’m looking at items in categories I’m not familiar with. About half the time there is a store charging significantly less than the others. I’ll open a new tab ask Google search AI if the site is legit, and 95% of the time the response is that it’s a well known scam site. So the anemic search AI knows it’s a scam, but google shopping has no problem sending people there (likely with an affiliate code).
augment_me 15 hours ago [-]
Sounds like you pay less for ads than someone else will. Attention is the currency in the world, pay more and your site will be on top, clearly there are customers that want your product.
ndriscoll 14 hours ago [-]
You shouldn't have to pay more than someone who is obviously committing fraud because people working at Google should be going to prison for deciding to partner with people who are obviously committing fraud.
augment_me 13 hours ago [-]
Yeah and housing should be affordable, and there should be no wars in the world, people should not be greedy, etc. Let's look at the facts and incentives in front of us now instead of fairytail "shoulds".
1) Google has more money than anyone who can file for litigation
2) You don't want your brand reputation damaged
So you can choose to either complain, spend a load of money in pointless juridical processes you will lose, or just pay up for the ads now, which will in the end pay for part of it at least since people are interested in the product.
So the fully rational choice right now you can do is: if brand damage costs > ad costs, buy ads. If not, then it's fine and let people get scammed because its out of your hands.
ndriscoll 13 hours ago [-]
You can of course do both: pay the protection racket money while also working to spread an understanding and build consensus/a demand for the government to crack down on major companies directly participating in fraud.
6510 13 hours ago [-]
you could but then you should call it protection money
Viliam1234 10 hours ago [-]
Recently I tried to download Blender, so I put "blender" in Google search... and the first link was some scam website pretending to be Blender, trying to make me install their malware.
Google doesn't even try anymore. The easier way to distribute malware to people is simply to pay Google to pretend that you are someone else.
(Similarly it's been months since I last saw a non-scam ad on YouTube. Sure, Elon Musk will send me tons of money made by AI brokers as soon as I give him my bank account. And the AI-generated video is great proof of how you can lose 50% body weight in 21 days just by sitting in a chair and nodding your head according to the special secret exercise routine.)
mitxela 1 days ago [-]
You work for a company? Why hasn't your company sued Google for creating this problem yet?
_def 1 days ago [-]
damn it. Every now and then I daydream about a federated network of digital delivery infra to cut out these platform middlemen but abuse/moderation like this is still what makes the idea impossible to take off. That's what you (and the restaurant) get from the centralization.
mlmonkey 1 days ago [-]
Couldn't the original website owner just look at the logs and see where most of the requests are coming from? And also the referrers would be a dead giveaway, right? That's assuming someone is looking at the `access.log` file occasionally.
lokar 1 days ago [-]
They could use residential proxies
hedora 1 days ago [-]
And residential proxies are becoming increasingly legitimate because of over-zealous AI blocks.
selfhoster1312 24 hours ago [-]
Blocking IP ranges and user agents has nothing to do with "AI". It's a bad practice by lazy sysadmins who'd rather discriminate users than fix their infra. Writing this from a non-profit ISP (fdn.fr) whose IP range is blocked by Google and Reddit and noone still knows why or how to unblock it [0].
Residential proxies on the other hand i don't think have any legitime usecase. I would support people working around Youtube to export interesting videos to Bittorrent. But what's happening is malicious actors going around rate limiting to run bad-behaving scrapers on smaller sites. That, and much worse is the residential proxy economy.
Hmm, how do you even protect against this one? Rewriting the entire website makes the entire situation a bit more difficult, you can control about everything.
ModernTimes 1 days ago [-]
You put the people (Google Adsense) showing the scam adverts in prison.
dismalpedigree 18 hours ago [-]
You make the penalty for being caught have teeth. A slap on the wrist (or nothing in this case) just encourages more abuse. Make a public showing that it wont be tolerated.
Something short of public execution, but decades in prison seems reasonable.
LorenPechtel 5 hours ago [-]
They're probably not in the US.
Crunchified 1 days ago [-]
This advice from the article to the affected retailers:
Brands and their ordering providers that watch for their site loading under someone else's domain, or for checkout sessions that never reach the real payment provider, are well placed to catch these sites early.
It can be detected if the IT folks look in the right places. I suppose a SCAM ALERT page could be presented to a reverse proxy when discovered.
StilesCrisis 1 days ago [-]
I don't see what you could do about "people browse the site but don't check out." I'm sure that is normal for any website regardless.
ano-ther 1 days ago [-]
In this case, wouldn’t you see a lot of abandoned carts coming from the reverse proxy sessions?
StilesCrisis 1 days ago [-]
I don't know the scale of cart-abandonment for a website like Jimmy John's, but it has got to be large enough that a few dozen more wouldn't be _too_ surprising.
chezzwizz 14 hours ago [-]
> it has got to be large enough that a few dozen more wouldn't be _too_ surprising.
Shouldn't it be though? What is the precedent here? Isn't anyone concerned about the slow boiling frog any more?
pixl97 14 hours ago [-]
Doing a quick search on it, and if the AI response is anywhere close to true, the vast majority of times a cart is filled it's not checked out. Food has one of the lowest rates, but that's still 30-50% abandonment.
Honestly it's something that happens with my family quite often. I'll start putting stuff in a cart then someone else changes their mind and we switch to another place to order. And it feels like this happens all the time.
trollbridge 1 days ago [-]
Long-term, via credit card attestation to a trusted device (eg Apple Pay) where the consumer verifies the merchant name & addres they're paying.
Ekaros 1 days ago [-]
Here often with smaller restaurants the name can be nearly anything. Very often I end up scratching my head trying to figure out what did I buy. This is due to them having multiple companies and payments going through different one from the restaurant name. While being entirely legitimate. Sometimes it is something like smaller franchise chains.
warkdarrior 1 days ago [-]
There are lots of restaurants (legitimate ones!) that use some payment processor on the backend whose name shows up in the transaction. So asking consumers to verify the payment info, when the payment info may not match the restaurant, is a losing battle.
gwerbin 1 days ago [-]
This is because banks only show one line on the transaction history. Payment processors should have the ability to report more information about each transaction, and customers should have the ability to see it.
tosti 1 days ago [-]
I'm thinking more elaborate CSRF tokens that uses subresource integrity and everything else (cookies, headers, etc). As soon as there's a mismatch, collect details and report.
BeetleB 1 days ago [-]
Don't do delivery from 3rd party services...?
In the old days, delivery was limited to pizza, and occasionally Chinese. You'd call the restaurant directly and place the order. The only possible way a scammer would get you is if you called the wrong number. That's why we had the Yellow Pages.
It seems from comments here that Google is a lot less reliable than the Yellow Pages were.
Excuse me while I go throw up, can’t believe I just recommended that.
foxglacier 1 days ago [-]
It's still a fake domain name. Don't trust random websites the same as how you use the web in general. Also, asking for a bank's OTP code is a gigantic no-no, but I don't suppose they really need that to collect the money?
TacticalCoder 15 hours ago [-]
Seen all the attacks and what AI allows for bad guys, I'm beginning to think that running my own DNS and null routing hundreds of thousands of domains (including variations of domains I use regularly, for which I automatically generated hundred of thousands of alternate names: to fight phishing) ain't enough.
I also block every single domain whose name contains non-ASCII character (no Unicode domain names for me / no punnycode: just get lost).
So maybe, maybe, maybe that after all I'll be moving to whitelisting domains. I know some do it and I know it's hard to do right. But some do just that.
It may be time for companies to give the list of all the domains we need to whitelist for their site to function.
Better yet: it may be time for companies to use as few domains as possible.
I don't care about your ads partners. I don't care about your surveillance (pardon, telemetry) partners.
It's too early to tell but a mindset shift may be coming.
fc417fc802 14 hours ago [-]
I wonder if LLMs might end up enabling reliable automated detection of scam domains.
> no Unicode domain names for me / no punnycode: just get lost
If you exclusively speak a latin language that works but the vast majority of people in the world require a unicode domain name if they want the name to be in their native script.
joezydeco 15 hours ago [-]
My Jimmy Johns app has had problems with Apple Pay all week. I wonder if it's related.
bigfloppa 18 hours ago [-]
At which point does cybercriminality become cyberwar?
14 hours ago [-]
znnajdla 15 hours ago [-]
At some point we need counter-hacking vigilante justice. Hack the phishing sites, dox the owners, take them down.
chezzwizz 14 hours ago [-]
> At some point we need counter-hacking vigilante justice. Hack the phishing sites, dox the owners, take them down.
Perhaps we should first discuss semantics at the line of war. When does some activity which impedes, diminishes, or otherwise blocks the interests of a peoples' rights in such a way that the word "crime" is not sufficient? Maybe it really all does come down to behavioural and financial incentives. That is to say that it is probably war when the judicial, legislative, and executive lack the resources or will to address an injustice and the idea of "war" becomes the only answer. As radical as that may seem, it literally needs to be considered for every action ten years or more down the road at the current pace of technology.
BatchJob 1 days ago [-]
I have to say this is probably the anti-pattern of all anti-patterns that the web easily allows without much protection. Its a little surprising that it took this long. Probably vibe coding aided its creation.
Maybe its time to turn off the web. Its only going to get worse.
zaik 1 days ago [-]
For starter's you could turn off the ads only.
augment_me 15 hours ago [-]
Just use AdBlock and this is not an issue
jonhohle 17 hours ago [-]
It also doesn’t help that nearly everything is now outsourced to SaaS that use ridiculously generic or often sketchy sounding domain names for secure transactions. When the government sends you to id.me, or a doctors office sends you to phreesia.com (huh?), or a business sends you to something like securepayments.com, insurance companies through fiserv.com, restaurants through all kinds of shady sounding domains.
We’ve been trained to ignore the domain name and accept putting sensitive content into random third party providers. How does a scam site look any different?
cowlevel 1 days ago [-]
Is this even illegal if the amount you get charged is the amount it says you'll get charged?
gruez 19 hours ago [-]
Is it legal for waiters to surreptitiously record your card number while processing payment? Because that's what basically it is
grumple 18 hours ago [-]
Yes. This is wire fraud. It is absolutely illegal. Even if they weren’t impersonating a business, charging someone for services or goods with no intent to provide them would still be fraud.
emacdona 1 days ago [-]
OMG. The site had a popup banner to tell me that they don't have a cookie banner? What the actual f____?
Either:
- They actually decided to remove one of the most annoying things about the modern web... and replace it with something very similar to tell you that they removed it, or...
- They found some legal justification for getting me to accept their cookies for dismissing the "no cookie banner banner"
Either choice makes me think less of them.
[edit: added extra newlines so bullets showed up correctly]
rationalist 1 days ago [-]
I only clicked on the link after reading your comment. Yep, what that website is doing is obnoxious. A little less obnoxious than a cookie banner, but more obnoxious than not having any banner or modal.
handoflixue 1 days ago [-]
If you'd bothered to read the banner, it answers your question: "Zero cookies, zero trackers, zero pixels."
Oh, I had bothered to read the banner. And I clicked the link.
My point is: they did all the necessary work required (no third party tracking cookies) to NOT HAVE TO show a banner...
... and then they chose to show a banner.
kasey_junk 18 hours ago [-]
Probably because they were fielding complaints from their readers.
I took down a fully static public web page that had basically no traffic and no cookies. It literally just said that a domain that I had was not associated with a popular brand name that was on a different TLD so don’t email me about it.
I got as many emails complaining there was no cookie banner as I had previously gotten about the brand. There is some brand of privacy crank out there that likes to harass people about those banners (and similar gdpr regs).
basilikum 18 hours ago [-]
You don't understand. Creating as much friction as possible and hiding the actual content is web design best practice.
If you just show the actual content in a readable format that uses the screenspace people will get scared and think of your site as unprofessional. People are so used to these popups, modals and annoyances that interrupt, take away screen space from and cover the content that they expect them.
emacdona 17 hours ago [-]
Ugh. I hate the modern web. Thanks for making me chuckle :-)
Laughter is the best medicine.
williamdclt 17 hours ago [-]
Looks like a marketing bit to me ("look how we care about your privacy!"). I vaguely appreciate the sentiment but they've done that in a very annoying way.
hedora 1 days ago [-]
If you think that’s bad, turn on the successor to x-do-not-stab. Many sites now show three popups: “we noticed the signal”, “optionally enter email to submit request”, “you clicked OK”, when zero popups would do.
akersten 1 days ago [-]
Despite mountains of text on this page, none of it explains how exactly this "reverse proxy" of the restaurant's site actually works?
Is it just some JS on bad.com shuttling assets from the real site and displaying them on the fake one? Shouldn't the right CORS headers from the real site prevent this?
Is it a real browser running on a server somewhere visiting the real site, and then rendering that output on a <canvas> on the fake site to avoid the browser's built in protections against this kind of thing? And throwing up their own credit card entry form when the time is right?
Maybe the answer's in there somewhere. Too much Claudish to parse through.
mik3y 1 days ago [-]
The evil site is acting as a reverse HTTP proxy: When you do a `GET evilsite/foo`, to compose its response the server first does a `GET targetsite/foo`, mutates the response however it likes, and passes it along to you.
So you don't need to worry about CORS from the perspective of the web app, nor need a real browser, because the victim is only ever interacting with the evilsite endpoints.
Certainly there are ways the target site could try to thwart this (i.e. detect unusual request patterns from wherever the proxy server is fetching from; client-side JS to detect the site being hosted on a foreign domain; etc). But at that point it's an arms race.
hnburnsy 1 days ago [-]
>Searching Google's ad archive (Ads Transparency Center) for the domains in our first sweep found at least 47 Google Search text ads between July 7, 2026, and October 20, 2026, run under at least 46 separate advertiser accounts with at least 43 different, unrelated-looking business names
And yet Google says sideloading is where users are getting hijacked. FFS
The hackers should pass on the order to the real restaurant to reduce suspicion.
>Google's public Ads Transparency pages now show "Can't find ad" for the creatives and "No ads found" for the domains we checked, which suggests Google has taken them down
So much for transparency, removing evidence that Google served ads on these impersonating domains
jihadjihad 1 days ago [-]
Some of these domain names are great:
jummyjonhsanbich
jummyjorsandvotch
Can’t wait to bring a big ole box of Jummy Jor sandvotches into the office on Monday.
albert_e 24 hours ago [-]
the list also told me a lot of people search for and order sendwiches
i wonder if the malicious sites will need an adpative tranform of reverse-proxied content so that the real content fetched from real site is updated to insert these "correct" spellings so that the customer dont find it ... suspicious?
skinfaxi 20 hours ago [-]
That assumes the misspellings are intentional by the user no?
albert_e 19 hours ago [-]
Yes, i was being flippant
LightBug1 16 hours ago [-]
And people wonder why we lock down my devices against all possible adverts.
yh11 1 days ago [-]
google ads really doesnt give a single shit if u give them money
aniq_ui 1 days ago [-]
[flagged]
0x4e 1 days ago [-]
I bet they are running Google and Meta ads to generate traffic to these malicious domains.
StilesCrisis 1 days ago [-]
You should read the article and see!
logicallee 1 days ago [-]
This is very useful information. I operate an AI-governed digital nation, and this type of proxying would be devastating to our users. Due to the scale of the attacks, DNS and even the IP address system itself also may not be fully reliable. We already saw some DNS servers serve the wrong IP address, though SSL certificates help in this respect.
What could we possibly do to limit the damage from this? Malicious Chrome extensions can also rewrite entire web pages, so if bad actors purchase or infiltrate legitimate extensions, they can also put users at risk.
We are considering continuing work on our own browser, since we could ship certificates to use client-side, but it's a recursive problem since our users would have to get the first trusted version before they could trust updates to it. If they have trouble reaching our site in the first place, through poisoned Google search results, poisoned DNS, and poisoned IP routing, then it is difficult to do this.
IncreasePosts 1 days ago [-]
What is an AI-governed digital nation?
logicallee 1 days ago [-]
AI comes up with the laws, and acts as a judiciary etc, plus builds the services etc. You can read one of our laws[1], this was written by ChatGPT and ratified by Claude. Our ChatGPT account was closed in early September, erasing our country's history, we've been trying for the past two months to reopen it. Since we're a sovereign nation we are under an enormous amount of attack all the time. We recently lost our server and are temporarily on a free host.
Save that page (with curl or wget), you should get this sha256:
BFE524880867A84C9A438A057734B58954B860843BDB5B15C9E4ED70C534126D (updated after I removed a script injection attack).
though if you're reading this comment through a proxied Hacker News clone, someone might rewrite that hash to their version of what they want our law to say.
protocolture 1 days ago [-]
What if AI psychosis was a nation. Very interesting.
human_eyes 1 days ago [-]
What the hell
JSR_FDED 1 days ago [-]
The only way to solve this is to have all your citizens band together and create a new operating system.
all i have to say is Jimmy Johns is a really bad tasting version of Subway. I know other people feel the same way. Jersey Mike's is actually pretty good too.
https://en.wikipedia.org/wiki/Racketeer_Influenced_and_Corru...
Even when I've been able to track down hosts, registrars, etc for scraped duplicates of sites, and report to all and Google, Microsoft Safety Scanner, etc -- nobody acts (or certainly not in any reasonable enough time to be useful).
In one case the scammer was using our own logo served directly from a source we could replace with Cloudflare rewrites. So the hijacked logo became "THIS IS A SCAM SITE" while we replaced the one on production.
I act. I receive about 5 takedown notices every day--the curse of running an open source DNS service (nip.io/sslip.io).
I've received over 1,000 takedown requests, but none came from Cloudflare or Google. Most of them come from Netcraft, Phishlabs, and doppel.com.
Are you getting takedown requests from people who don’t understand how DNS works, or… are they actually suggesting that your particular DNS server filter particular results?
They seem to invite it
This is literally false. They are one of the few hosts I have dealt with that actually does NOT do this. Their abuse reporting form even has check boxes that are optional to forward it to the underlying host and the owner. If you leave them unchecked they don't forward anything.
I don't know where you got your information from but it's quite literally the opposite of reality.
Now, whether or not they actually act on it depends on whether they are proxying the site or merely providing authoritative DNS. If they are just providing DNS they will continue to provide it and deny your report and I think that's stupid and frustrating. If they are proxying it they will put up a block page in front of it which is meh.
I'd have trouble believing that U.S. Attorney General Todd Blanche would care very much, but I guess it wouldn't hurt to try.
Upload a scam ad? No problemo.
The scale is mind-boggling. The number 404 is poetic. Any possible (mis) spelling of the brand will open the "intended" site - you will never see a 404 :D. Auto-correct on steroids indeed.
And I imagine this sort of thing must be happening across hundreds of markets not just US. And possibly not just food delivery but other types of ecommerce as well.
This crazy proliferation of top level domains has to be part of the problem. Every time a new one is conjured up, legitimate businesses and organizations need to scramble and buy them before a scammer inevitably snaps it up and starts scamming on it.
Also, the fact that web browsers are insanely trying to downplay and hide web site domain names and paths is also not helping. https://totallylegitjerseymikes.delivery/ should NOT get the same visual treatment as https://www.jerseymikes.com/
What are you suggesting browsers ought to do here? Sure ICANN is a very flawed solution and the gTLD cash grab has reached absurd levels but what are you expecting browser vendors to do? For example .net .de and .delivery are all equally legitimate TLDs according to both the central body and all the infrastructure providers.
Of course, I'll admit there is a danger there of creating a two-tier domain system, where the "big guy$" get the green Checkmark of Legitimacy or whatever in browsers, and everyone else, including mypersonalwebsite.org gets the shaft. I don't have all the answers but surely we are capable of at least crowdsourcing a list of known scam sites and surfacing them at the browser level.
If there is a banana.tw in your neigbourhood, loading banana.delivery could trigger a popup asking if you were looking for banana.tw
Why are they allowed to direct you to literal scams? Why are they allowed to profit off of literal scams?
This affects the company I work for, who gets called every single day with customer complaints from people who clicked the scam link from a search ad when looking for our site.
Our site has existed for over a decade. There's no justifiable reason that a company who's brand is known by every single grocer or merchant to somehow show up under a literal fly by night scam company pretending to have the same name. It's unacceptable.
My sister got scammed by this exact mechanism just last week.
1) Google has more money than anyone who can file for litigation
2) You don't want your brand reputation damaged
So you can choose to either complain, spend a load of money in pointless juridical processes you will lose, or just pay up for the ads now, which will in the end pay for part of it at least since people are interested in the product.
So the fully rational choice right now you can do is: if brand damage costs > ad costs, buy ads. If not, then it's fine and let people get scammed because its out of your hands.
Google doesn't even try anymore. The easier way to distribute malware to people is simply to pay Google to pretend that you are someone else.
(Similarly it's been months since I last saw a non-scam ad on YouTube. Sure, Elon Musk will send me tons of money made by AI brokers as soon as I give him my bank account. And the AI-generated video is great proof of how you can lose 50% body weight in 21 days just by sitting in a chair and nodding your head according to the special secret exercise routine.)
Residential proxies on the other hand i don't think have any legitime usecase. I would support people working around Youtube to export interesting videos to Bittorrent. But what's happening is malicious actors going around rate limiting to run bad-behaving scrapers on smaller sites. That, and much worse is the residential proxy economy.
[0] https://www.fdn.fr/the-fdn-and-gitoyen-networks-are-blocked-...
Brands and their ordering providers that watch for their site loading under someone else's domain, or for checkout sessions that never reach the real payment provider, are well placed to catch these sites early.
It can be detected if the IT folks look in the right places. I suppose a SCAM ALERT page could be presented to a reverse proxy when discovered.
Shouldn't it be though? What is the precedent here? Isn't anyone concerned about the slow boiling frog any more?
Honestly it's something that happens with my family quite often. I'll start putting stuff in a cart then someone else changes their mind and we switch to another place to order. And it feels like this happens all the time.
In the old days, delivery was limited to pizza, and occasionally Chinese. You'd call the restaurant directly and place the order. The only possible way a scammer would get you is if you called the wrong number. That's why we had the Yellow Pages.
It seems from comments here that Google is a lot less reliable than the Yellow Pages were.
Excuse me while I go throw up, can’t believe I just recommended that.
I also block every single domain whose name contains non-ASCII character (no Unicode domain names for me / no punnycode: just get lost).
So maybe, maybe, maybe that after all I'll be moving to whitelisting domains. I know some do it and I know it's hard to do right. But some do just that.
It may be time for companies to give the list of all the domains we need to whitelist for their site to function.
Better yet: it may be time for companies to use as few domains as possible.
I don't care about your ads partners. I don't care about your surveillance (pardon, telemetry) partners.
It's too early to tell but a mindset shift may be coming.
> no Unicode domain names for me / no punnycode: just get lost
If you exclusively speak a latin language that works but the vast majority of people in the world require a unicode domain name if they want the name to be in their native script.
Perhaps we should first discuss semantics at the line of war. When does some activity which impedes, diminishes, or otherwise blocks the interests of a peoples' rights in such a way that the word "crime" is not sufficient? Maybe it really all does come down to behavioural and financial incentives. That is to say that it is probably war when the judicial, legislative, and executive lack the resources or will to address an injustice and the idea of "war" becomes the only answer. As radical as that may seem, it literally needs to be considered for every action ten years or more down the road at the current pace of technology.
Maybe its time to turn off the web. Its only going to get worse.
We’ve been trained to ignore the domain name and accept putting sensitive content into random third party providers. How does a scam site look any different?
Either:
- They actually decided to remove one of the most annoying things about the modern web... and replace it with something very similar to tell you that they removed it, or...
- They found some legal justification for getting me to accept their cookies for dismissing the "no cookie banner banner"
Either choice makes me think less of them.
[edit: added extra newlines so bullets showed up correctly]
Then it links to a page which is even more explicit about how little they collect: https://www.infohawk.com/cookies
My point is: they did all the necessary work required (no third party tracking cookies) to NOT HAVE TO show a banner...
... and then they chose to show a banner.
I took down a fully static public web page that had basically no traffic and no cookies. It literally just said that a domain that I had was not associated with a popular brand name that was on a different TLD so don’t email me about it.
I got as many emails complaining there was no cookie banner as I had previously gotten about the brand. There is some brand of privacy crank out there that likes to harass people about those banners (and similar gdpr regs).
If you just show the actual content in a readable format that uses the screenspace people will get scared and think of your site as unprofessional. People are so used to these popups, modals and annoyances that interrupt, take away screen space from and cover the content that they expect them.
Laughter is the best medicine.
Is it just some JS on bad.com shuttling assets from the real site and displaying them on the fake one? Shouldn't the right CORS headers from the real site prevent this?
Is it a real browser running on a server somewhere visiting the real site, and then rendering that output on a <canvas> on the fake site to avoid the browser's built in protections against this kind of thing? And throwing up their own credit card entry form when the time is right?
Maybe the answer's in there somewhere. Too much Claudish to parse through.
So you don't need to worry about CORS from the perspective of the web app, nor need a real browser, because the victim is only ever interacting with the evilsite endpoints.
Certainly there are ways the target site could try to thwart this (i.e. detect unusual request patterns from wherever the proxy server is fetching from; client-side JS to detect the site being hosted on a foreign domain; etc). But at that point it's an arms race.
And yet Google says sideloading is where users are getting hijacked. FFS
The hackers should pass on the order to the real restaurant to reduce suspicion.
>Google's public Ads Transparency pages now show "Can't find ad" for the creatives and "No ads found" for the domains we checked, which suggests Google has taken them down
So much for transparency, removing evidence that Google served ads on these impersonating domains
i wonder if the malicious sites will need an adpative tranform of reverse-proxied content so that the real content fetched from real site is updated to insert these "correct" spellings so that the customer dont find it ... suspicious?
What could we possibly do to limit the damage from this? Malicious Chrome extensions can also rewrite entire web pages, so if bad actors purchase or infiltrate legitimate extensions, they can also put users at risk.
We are considering continuing work on our own browser, since we could ship certificates to use client-side, but it's a recursive problem since our users would have to get the first trusted version before they could trust updates to it. If they have trouble reaching our site in the first place, through poisoned Google search results, poisoned DNS, and poisoned IP routing, then it is difficult to do this.
[1] https://stateofutopia.com/laws/2/law2/law2.html
Save that page (with curl or wget), you should get this sha256:
BFE524880867A84C9A438A057734B58954B860843BDB5B15C9E4ED70C534126D (updated after I removed a script injection attack).
though if you're reading this comment through a proxied Hacker News clone, someone might rewrite that hash to their version of what they want our law to say.
Simple and effective