None of this would work if Google Adsense didn't allow scam ads on their system. But they do, millions every day (I deal with this every day on my websites, Google don't care).
i gave up reporting scams to meta and google, you get the distinct impression they are in on it when you get a response saying “we looked into it and it was fine”
Couldn't the original website owner just look at the logs and see where most of the requests are coming from? And also the referrers would be a dead giveaway, right? That's assuming someone is looking at the `access.log` file occasionally.
Hmm, how do you even protect against this one? Rewriting the entire website makes the entire situation a bit more difficult, you can control about everything.
This advice from the article to the affected retailers:
Brands and their ordering providers that watch for their site loading under someone else's domain, or for checkout sessions that never reach the real payment provider, are well placed to catch these sites early.
It can be detected if the IT folks look in the right places. I suppose a SCAM ALERT page could be presented to a reverse proxy when discovered.
Here often with smaller restaurants the name can be nearly anything. Very often I end up scratching my head trying to figure out what did I buy. This is due to them having multiple companies and payments going through different one from the restaurant name. While being entirely legitimate. Sometimes it is something like smaller franchise chains.
There are lots of restaurants (legitimate ones!) that use some payment processor on the backend whose name shows up in the transaction. So asking consumers to verify the payment info, when the payment info may not match the restaurant, is a losing battle.
This is because banks only show one line on the transaction history. Payment processors should have the ability to report more information about each transaction, and customers should have the ability to see it.
damn it. Every now and then I daydream about a federated network of digital delivery infra to cut out these platform middlemen but abuse/moderation like this is still what makes the idea impossible to take off. That's what you (and the restaurant) get from the centralization.
Google is the entire problem here. Pay them money and your literal scam site can sit above the real site in the search results.
Why are they allowed to direct you to literal scams? Why are they allowed to profit off of literal scams?
This affects the company I work for, who gets called every single day with customer complaints from people who clicked the scam link from a search ad when looking for our site.
Our site has existed for over a decade. There's no justifiable reason that a company who's brand is known by every single grocer or merchant to somehow show up under a literal fly by night scam company pretending to have the same name. It's unacceptable.
My sister got scammed by this exact mechanism just last week.
OMG. The site had a popup banner to tell me that they don't have a cookie banner? What the actual f____?
Either:
- They actually decided to remove one of the most annoying things about the modern web... and replace it with something very similar to tell you that they removed it, or...
- They found some legal justification for getting me to accept their cookies for dismissing the "no cookie banner banner"
Either choice makes me think less of them.
[edit: added extra newlines so bullets showed up correctly]
I only clicked on the link after reading your comment. Yep, what that website is doing is obnoxious. A little less obnoxious than a cookie banner, but more obnoxious than not having any banner or modal.
>Searching Google's ad archive (Ads Transparency Center) for the domains in our first sweep found at least 47 Google Search text ads between July 7, 2026, and October 20, 2026, run under at least 46 separate advertiser accounts with at least 43 different, unrelated-looking business names
And yet Google says sideloading is where users are getting hijacked. FFS
The hackers should pass on the order to the real restaurant to reduce suspicion.
>Google's public Ads Transparency pages now show "Can't find ad" for the creatives and "No ads found" for the domains we checked, which suggests Google has taken them down
So much for transparency, removing evidence that Google served ads on these impersonating domains
https://en.wikipedia.org/wiki/Racketeer_Influenced_and_Corru...
Brands and their ordering providers that watch for their site loading under someone else's domain, or for checkout sessions that never reach the real payment provider, are well placed to catch these sites early.
It can be detected if the IT folks look in the right places. I suppose a SCAM ALERT page could be presented to a reverse proxy when discovered.
Excuse me while I go throw up, can’t believe I just recommended that.
Why are they allowed to direct you to literal scams? Why are they allowed to profit off of literal scams?
This affects the company I work for, who gets called every single day with customer complaints from people who clicked the scam link from a search ad when looking for our site.
Our site has existed for over a decade. There's no justifiable reason that a company who's brand is known by every single grocer or merchant to somehow show up under a literal fly by night scam company pretending to have the same name. It's unacceptable.
My sister got scammed by this exact mechanism just last week.
Either:
- They actually decided to remove one of the most annoying things about the modern web... and replace it with something very similar to tell you that they removed it, or...
- They found some legal justification for getting me to accept their cookies for dismissing the "no cookie banner banner"
Either choice makes me think less of them.
[edit: added extra newlines so bullets showed up correctly]
Then it links to a page which is even more explicit about how little they collect: https://www.infohawk.com/cookies
And yet Google says sideloading is where users are getting hijacked. FFS
The hackers should pass on the order to the real restaurant to reduce suspicion.
>Google's public Ads Transparency pages now show "Can't find ad" for the creatives and "No ads found" for the domains we checked, which suggests Google has taken them down
So much for transparency, removing evidence that Google served ads on these impersonating domains