Hacker News
points by albert_e 1 day ago | 0 comments
A total of 404 fake domains impersonating a single restaurant brand site!

The scale is mind-boggling. The number 404 is poetic. Any possible (mis) spelling of the brand will open the "intended" site - you will never see a 404 :D. Auto-correct on steroids indeed.

And I imagine this sort of thing must be happening across hundreds of markets not just US. And possibly not just food delivery but other types of ecommerce as well.

[–] ryandrake 17 hours ago
> Across two research passes, we identified 820 domains impersonating 35 restaurant brands. Of those, 808 use the .delivery top-level domain, and the rest use .com or .shop.

This crazy proliferation of top level domains has to be part of the problem. Every time a new one is conjured up, legitimate businesses and organizations need to scramble and buy them before a scammer inevitably snaps it up and starts scamming on it.

Also, the fact that web browsers are insanely trying to downplay and hide web site domain names and paths is also not helping. https://totallylegitjerseymikes.delivery/ should NOT get the same visual treatment as https://www.jerseymikes.com/

[–] fc417fc802 16 hours ago
> https://totallylegitjerseymikes.delivery/ should NOT get the same visual treatment as https://www.jerseymikes.com/

What are you suggesting browsers ought to do here? Sure ICANN is a very flawed solution and the gTLD cash grab has reached absurd levels but what are you expecting browser vendors to do? For example .net .de and .delivery are all equally legitimate TLDs according to both the central body and all the infrastructure providers.

[–] voakbasda 15 hours ago
Stop hiding URLs for one. I still can’t believe that is a thing.
[–] ryandrake 15 hours ago
E-mail anti-spam systems are able to crowdsource and otherwise build up reputation for domains. Surely "selecting the legit domain for Organization X" is within the realm of computability.

Of course, I'll admit there is a danger there of creating a two-tier domain system, where the "big guy$" get the green Checkmark of Legitimacy or whatever in browsers, and everyone else, including mypersonalwebsite.org gets the shaft. I don't have all the answers but surely we are capable of at least crowdsourcing a list of known scam sites and surfacing them at the browser level.

[–] 6510 15 hours ago
It seems fun to load a local business directory into the browser.

If there is a banana.tw in your neigbourhood, loading banana.delivery could trigger a popup asking if you were looking for banana.tw