TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
InfoHawk reported on Nov. 5, 2026, that researchers identified 820 domains impersonating 35 restaurant brands across two research passes. One investigated site copied Jersey Mike’s ordering flow and replaced checkout with a form seeking card details and a bank SMS verification code; the report does not establish how many customers were affected.
Researchers at InfoHawk reported finding 820 websites impersonating 35 restaurant brands in two research passes, including a fake Jersey Mike’s ordering site whose checkout sought customers’ card details and bank SMS verification codes. The findings point to a campaign that could put payment information at risk, although the report does not say how many people visited the sites or lost money.
InfoHawk’s investigation began with a suspicious domain that reproduced Jersey Mike’s online ordering experience. According to the report, the site used a reverse proxy to display content from the legitimate restaurant website while changing the checkout payment form. A reverse proxy can present content fetched from another site under a different domain, allowing the operator to make a fake site look familiar without changing the restaurant’s own website.
The replacement form requested credit card information and a bank-sent SMS verification code. InfoHawk said a code could help criminals authorize fraudulent transactions depending on how a victim’s bank uses it. The report describes the form’s design and potential risk; it does not confirm that any particular transaction was made or that a specific customer was defrauded.
Across the two research passes, InfoHawk counted 820 domains targeting 35 restaurant brands. Of those domains, 808 used the .delivery top-level domain; the remainder used .com or .shop. The report describes the names as mostly typosquats or look-alikes, but the supplied material does not identify confirmed losses, the campaign operators, or the number of sites still accessible.
How Fake Checkouts Put Orders at Risk
The reported method exploits the point in an online order when customers expect to enter payment details. A clone that reproduces a familiar menu and ordering flow may make it harder for a customer to notice that the address bar shows an unrelated domain. The additional request for an SMS code raises the stakes: if submitted, that code may be usable in some banking systems to approve a payment, as InfoHawk cautioned.
The scale reported by researchers matters because 820 domains across 35 brands suggests the activity was not limited to one isolated imitation. It does not, by itself, show how many domains were active simultaneously, how many customers encountered them, or whether all belonged to one operation. For restaurants and customers, the distinction is important: the reported approach can operate on attacker-controlled infrastructure and does not establish that a restaurant’s own site was breached.
Consumers who entered payment data on a suspicious page may need to contact their bank or card issuer promptly and review account activity. That is a precaution based on the information the reported forms sought, not evidence that every visitor’s account was compromised.
Products Worth Considering
Apple iPad 11-inch (A16 Chip, 128GB, Wi-Fi, Pink)
Jackery Explorer 300 Portable Power Station, 292Wh
Samsung Galaxy Tab A11+ 11-Inch Tablet, 6GB RAM, 128GB Storage, Expandable, Gray
As an affiliate, we earn on qualifying purchases.
From One Suspicious Site to 820 Domains
InfoHawk’s report, dated Nov. 5, 2026, says the research took place in early November and involved two passes over suspicious websites. Researchers first examined a domain impersonating Jersey Mike’s, then identified a wider set of domains targeting other restaurant names. The report lists registration or scan dates during 2026 for the brands it tracked.
The central technique described is reverse-proxy impersonation, rather than a simple static copy of a restaurant homepage. The attacker-controlled domain can fetch authentic pages and assets, then alter a selected component such as checkout. This can create a convincing customer experience while keeping the malicious payment form separate from the restaurant’s legitimate infrastructure.
InfoHawk’s material provides a count and examples, including the Jersey Mike’s case, but does not give a full accounting of each brand’s exposure in the supplied extract. The domain count should be read as the researchers’ finding from their scans, not as a count of confirmed victims or successful payments.
“The attackers used a more sophisticated approach: reverse-proxying the legitimate site while replacing the checkout payment form with a malicious one.”
— InfoHawk report
Victims and Site Status Remain Unknown
The supplied report does not state how many customers visited the domains, submitted payment information, or suffered financial loss. It also does not confirm whether any bank codes were used to authorize transactions. The number of domains found is not a measure of victim count or proven fraud.
It is also unclear whether the 820 domains were all active at the same time, how many remain online, or whether they were controlled by a single group. InfoHawk describes the sites as appearing to be part of one or more coordinated operations; that wording leaves the operators’ relationship unconfirmed. The report does not include responses from the restaurant brands, payment providers, or law enforcement.
Monitoring and Customer Precautions
InfoHawk’s report describes findings from two research passes but does not announce a follow-up date, takedown effort, or investigation by authorities. The immediate status of the listed domains is therefore not established by the source material. Further reporting would need to confirm which sites remain reachable and whether affected brands or service providers have taken action.
Customers concerned they entered card details or a verification code on a suspicious site can contact their card issuer or bank, watch for unfamiliar transactions, and follow the institution’s guidance. Before paying for an order, customers can check that the web address matches the restaurant’s official site or use its official app. These steps reduce exposure but do not establish whether a particular domain in the report is currently active.
Key Questions
What did InfoHawk researchers find?
InfoHawk reported 820 domains impersonating 35 restaurant brands across two research passes. Most used the .delivery domain ending.
What information did the fake Jersey Mike’s checkout request?
According to the report, the form requested credit card details and an SMS verification code sent by a customer’s bank.
Does the report say restaurant websites were hacked?
No. InfoHawk said the described method used attacker-controlled domains to display content from legitimate sites and replace checkout forms. The report does not establish a breach of the restaurants’ own websites.
Are customer losses confirmed?
The supplied report does not confirm a number of victims, successful fraudulent transactions, or financial losses. The domain count is a research finding, not a victim count.
What should someone do after entering payment information?
Contact the bank or card issuer promptly, check account activity, and follow its instructions. The report does not say that every visitor to a listed site had their information misused.
Source: infohawk.com
