# InfoHawk finds 820 suspicious domains impersonating restaurant brands

_Published Friday, November 6, 2026 at 4:08 PM EST · Security · Latest · Tier 2 — Notable_

![Scamwich: Inside a Restaurant Delivery Payment-Skimming Campaign — InfoHawk News — Primary](https://www.infohawk.com/_app/immutable/assets/2026-11-05-scamwich-restaurant-skimming.CsokS_Fm.png)

InfoHawk identified 820 suspicious domains impersonating 35 restaurant brands, with some capturing payment card details and asking customers for their bank's SMS verification codes. Its early-November investigation found that 808 of the domains used the .delivery suffix.

One site imitating Jersey Mike's retrieved genuine restaurant pages and presented them under an attacker-controlled domain while replacing the checkout payment form. This approach can reproduce a familiar ordering experience without compromising the restaurant's own website.

Obtaining a bank verification code alongside card details could help attackers authorize fraudulent transactions, depending on how the bank uses the code.

## Sources

- [infohawk.com](https://www.infohawk.com/news/2026-11-05-scamwich-restaurant-skimming)

---
Canonical: https://techandbusiness.org/newswire/a1trDhzpy7XhA461LoD8eX
Published: 2026-11-06T21:08:12.406Z
Story chronology: 2026-11-06T19:19:27.000Z
Retrieved: 2026-11-06T22:49:23.057Z
Publisher: Tech & Business (techandbusiness.org)