https://en.wikipedia.org/wiki/Racketeer_Influenced_and_Corru...

The scale is mind-boggling. The number 404 is poetic. Any possible (mis) spelling of the brand will open the "intended" site - you will never see a 404 :D. Auto-correct on steroids indeed.

And I imagine this sort of thing must be happening across hundreds of markets not just US. And possibly not just food delivery but other types of ecommerce as well.

Why are they allowed to direct you to literal scams? Why are they allowed to profit off of literal scams?

This affects the company I work for, who gets called every single day with customer complaints from people who clicked the scam link from a search ad when looking for our site.

Our site has existed for over a decade. There's no justifiable reason that a company who's brand is known by every single grocer or merchant to somehow show up under a literal fly by night scam company pretending to have the same name. It's unacceptable.

My sister got scammed by this exact mechanism just last week.

I also block every single domain whose name contains non-ASCII character (no Unicode domain names for me / no punnycode: just get lost).

So maybe, maybe, maybe that after all I'll be moving to whitelisting domains. I know some do it and I know it's hard to do right. But some do just that.

It may be time for companies to give the list of all the domains we need to whitelist for their site to function.

Better yet: it may be time for companies to use as few domains as possible.

I don't care about your ads partners. I don't care about your surveillance (pardon, telemetry) partners.

It's too early to tell but a mindset shift may be coming.

Maybe its time to turn off the web. Its only going to get worse.

Either:

- They actually decided to remove one of the most annoying things about the modern web... and replace it with something very similar to tell you that they removed it, or...

- They found some legal justification for getting me to accept their cookies for dismissing the "no cookie banner banner"

Either choice makes me think less of them.

[edit: added extra newlines so bullets showed up correctly]

Is it just some JS on bad.com shuttling assets from the real site and displaying them on the fake one? Shouldn't the right CORS headers from the real site prevent this?

Is it a real browser running on a server somewhere visiting the real site, and then rendering that output on a <canvas> on the fake site to avoid the browser's built in protections against this kind of thing? And throwing up their own credit card entry form when the time is right?

Maybe the answer's in there somewhere. Too much Claudish to parse through.

And yet Google says sideloading is where users are getting hijacked. FFS

The hackers should pass on the order to the real restaurant to reduce suspicion.

>Google's public Ads Transparency pages now show "Can't find ad" for the creatives and "No ads found" for the domains we checked, which suggests Google has taken them down

So much for transparency, removing evidence that Google served ads on these impersonating domains

  jummyjonhsanbich
  jummyjorsandvotch

What could we possibly do to limit the damage from this? Malicious Chrome extensions can also rewrite entire web pages, so if bad actors purchase or infiltrate legitimate extensions, they can also put users at risk.

We are considering continuing work on our own browser, since we could ship certificates to use client-side, but it's a recursive problem since our users would have to get the first trusted version before they could trust updates to it. If they have trouble reaching our site in the first place, through poisoned Google search results, poisoned DNS, and poisoned IP routing, then it is difficult to do this.