In early November 2026, InfoHawk researchers uncovered a coordinated payment-skimming operation that impersonates restaurant ordering websites at industrial scale. Across two research passes, the team identified 820 domains mimicking 35 restaurant brands. Of those, 808 sit on the .delivery top-level domain, with the remainder on .com and .shop. The sheer volume — 404 domains targeting Jimmy John's alone — signals automated infrastructure, not a lone operator. The attack mechanism is more sophisticated than a typical phishing page. Rather than building crude visual imitations, the operators use reverse proxies to fetch and display the legitimate restaurant's actual website content in real time. The menu, images, and ordering flow are genuine. Only the checkout payment form is swapped for a malicious version controlled by the attackers. The result is an experience nearly indistinguishable from ordering directly from the restaurant. Critically, the malicious checkout collects not just credit card numbers but also the SMS one-time verification codes sent by the victim's bank. This two-factor capture is what elevates the scheme from passive card harvesting to potential real-time transaction authorization. A stolen card number has commodity value on dark markets; a stolen card number paired with a live OTP can authorize purchases immediately. The legitimate restaurants are not compromised. The attackers operate entirely on their own infrastructure, using the authentic site as a content source via the reverse proxy. This means traditional breach-disclosure frameworks don't apply — there is no breach at the restaurant. The victims are individual consumers who arrive at a typosquatted URL, often through search engine results, ads, or social engineering. The domain registration pattern reveals operational tempo. Jimmy John's domains span from March 3 to October 21, 2026 — a sustained campaign over seven months. The typosquat naming convention is methodical: character substitution (l for i, j for i), character insertion, and word-fragment shuffling, all designed to survive a quick glance at the URL bar. Many domains read as plausible misspellings a distracted customer might accept. The investigation names Jersey Mike's as the initial discovery vector, via the domain mlckessejersstey[.]delivery. But the 35-brand spread suggests the operators are brand-agnostic — they target any restaurant chain with high-volume online ordering. The .delivery TLD itself is a force multiplier: it looks legitimate for a food ordering site, lowering suspicion further. This campaign exploits a structural gap in the digital ordering ecosystem. Restaurants outsource trust to their web presence, consumers rely on visual familiarity as their authentication signal, and the .delivery TLD provides cover. No single entity — not the restaurant, not the payment processor, not the TLD registry — currently owns the full picture of the threat. Until that changes, the playbook scales trivially.
