Scamwich: Inside a Restaurant Delivery Payment-Skimming Campaign

Impersonated brands

Mostly .delivery typosquats, plus a few look-alike .com and .shop names, found across two research passes. "Seen" is the range of registration or scan dates we have for a brand's domains, all in 2026. Open a brand to see its domains.

How the attack works

Each clone is a reverse proxy: a server that sits between the victim and the real restaurant site, fetches every page from the real site as it is requested, edits it on the way through, and passes it on. Menus, prices, store hours, and the cart are live and correct, because they come from the real site. Only the payment step is replaced. Described from mlckessejersstey[.]delivery (Jersey Mike's); we believe the clones of the other brands run the same kit.

1. The victim arrives from a search ad

   A Google Search ad imitates the restaurant's listing and shows a look-alike domain. The domain is behind Cloudflare, so its real server is hidden, and Cloudflare gives it a valid certificate automatically (Google Trust Services here), so the browser shows "Connection is secure".

2. Every page is fetched live from the real site

   The proxy forwards each request to the restaurant's own servers, adjusting the host name and cookies, and relays the answer. The real site's headers come through (on Jersey Mike's, x-powered-by: Nuxt and Amazon CloudFront headers), which is how we could tell which paths came from the real site and which from the scammer's server.

3. Addresses are rewritten to keep the victim on the fake domain

   The proxy replaces the brand's own host names in pages, scripts, and redirects with the fake domain, and maps each backend to a path on it, such as /__bapi__/ or /__payments__/. Store lookup, menus, login, and cart all work, because those calls go back through the proxy to the real APIs. Even the brand's own bot-detection script still runs, with its endpoints rewritten.

4. Three scripts are injected into every page

   A script blocker patches HTMLScriptElement.prototype.src so that listed scripts never load (on Jersey Mike's, the OneTrust cookie banner and Branch, which could send phone users to the app or the real domain). _jmu() finds the real checkout payment frame and points it at /js/index.html on the fake domain; a MutationObserver puts the fake one back whenever the page restores the real one. _chkT() reads the order total from the "Place order" button every half second and saves it, so the fake form shows the right amount.

5. The card form is the scammer's

   A few paths are answered by the scammer's server instead of the real site: /js/* (the card form and its scripts) and /payment/socket.io. The form looks like part of checkout. On submit it collects every field (card number, expiry, CVV, name, phone) and sends it, with the site name, to the operator over a live socket.io connection.

6. An operator gets past the bank's check live

   We believe a person watching a control panel uses the card elsewhere and, when the bank challenges that payment, tells the victim's page what to show next: "card declined, try another", a page asking for the SMS code (/js/confirmation/), an "approve in your bank app" page (/js/app/), or "invalid code, try again". We believe the code the victim types is what lets the operator's charge through 3-D Secure.

7. The victim is sent away

   When the operator marks it a success, the page sets a cookie valid=77777 lasting until 2038 and sends the victim to another chain's real site (href.li/?https://www.jimmyjohns.com/; href.li hides where they came from). No order reaches the restaurant: the real payment step never runs, so there is no confirmation email and no food. We believe the victim's card is then charged for whatever the operator bought.

Why this design. The clone never goes out of date, the victim builds a real order with a real total before anything looks wrong, and one kit works against any restaurant by changing the target site, the domain, and a few path rules. The scammer's server does very little work, which makes it cheap to move. Some variants skip the payment wording and only pin the frame's address, re-setting it every time the page changes it.

Distribution of the Delivery Scam

Searching Google's ad archive (Ads Transparency Center) for the domains in our first sweep found at least 47 Google Search text ads between July 7, 2026, and October 20, 2026, run under at least 46 separate advertiser accounts with at least 43 different, unrelated-looking business names (construction firms, a reptile rescue, a watch company). The ads below are a sub-sample: we searched only for the domains in our first sweep, so there are likely more. Each ad imitates a restaurant's search listing and shows a look-alike domain. Most ran for 1–4 days, usually starting days after the domain was registered.

Jimmy John's20Jul 7 – Sep 18

jjmmyjohsendwitchs[.]delivery

www.jjmmyjohsendwitchs[.]delivery/

Order Sandwiches for Pick Up

Order online for delivery, catering or stop by a location near you. Enjoy gourmet sandwiches and wraps from our menu.

Text from Google's ad preview (no image rendition)

jlmmyydelsendwlched[.]delivery

www.jlmmyydelsendwlched[.]delivery/

Order Sandwiches for Pick Up - Sandwich Shop

Order online for delivery, catering or stop by a location near you. Enjoy gourmet sandwiches and wraps from our menu.

Text from Google's ad preview (no image rendition)

jjymmjohsandwichs[.]delivery

www.jjymmjohsandwichs[.]delivery/

Order Sandwiches for Pick Up - Sandwich Shop

Order online for delivery, catering or stop by a location near you. Enjoy gourmet sandwiches and wraps from our menu.

Text from Google's ad preview (no image rendition)

jummyjohnsanbich[.]delivery

www.jummyjohnsanbich[.]delivery/

Order Sandwiches for Pick Up - Sandwich Shop

Order online for delivery, catering or stop by a location near you. Enjoy gourmet sandwiches and wraps from our menu.

Text from Google's ad preview (no image rendition)

Firehouse Subs12Jul 28 – Sep 30

Dave's Hot Chicken11Aug 18 – Oct 20

davehottchlcken[.]delivery

www.davehottchlcken[.]delivery/

Dave's Hot Chicken - Menu

Dave's Menu with the heat menu panel on the left. 7 levels of spice. Dave's Bites Fries.

Text from Google's ad preview (no image rendition)

dawershiortchlckan[.]delivery

www.dawershiortchlckan[.]delivery/

Dave's Menu - Menu

Street food sensation turned fast-casual hit, Dave's Hot Chicken. Dave's Bites Fries. White meat chicken tender bites served with a side of fries.

Text from Google's ad preview (no image rendition)

Jersey Mike's4Jul 21 – Jul 31

Hosting

Most of the clones sit behind Cloudflare (AS13335), which hides the real servers: 761 of the 820 domains use Cloudflare nameservers, 11 use other nameservers, and 48 have none. Another cluster of 68 domains is tied to an Amazon Web Services (AWS) server. Some of its sites are served straight from that server, in Frankfurt (3.79.192.101) through my-ndns.com nameservers, and its pages carry a different injected script (/static/<name>-fix.js). It uses the same cloning technique, but we found nothing that shows the same people run it, so these sites may come from more than one operator using the same kit.

In our first sweep of 255 domains, 251 were registered at Dynadot, spread across 111 Cloudflare nameserver pairs.

What this means for restaurant brands

These clones don't need to break into a restaurant's systems. They borrow the real site, page by page, and insert the attack only at the moment a customer pays. That makes them hard to spot from the outside, but it also means the brand's own servers see every page the clone serves. Brands and their ordering providers that watch for their site loading under someone else's domain, or for checkout sessions that never reach the real payment provider, are well placed to catch these sites early.