This totally is on Google & Co for allowing those scam ads. They can filter those out. They are simply chosing not to.

Damn, that’s a high-quality variation of a man-in-the-middle attack, and going after the big name companies shows how confident they are they won’t get caught. Cloudflare and Google need to be doing more to prevent this.

tl;dr it’s a relatively sophisticated approach to make it look real. The fake site reverse proxies the real online ordering site so that it looks and behaves exactly like the real one, blocks some scripts like trackers or anything that’d redirect back to the real site, and swaps out the payment form for a fake one.

The payment details entered into the fake form go to a live operator that immediately tries to use the credit card elsewhere online. They get through 3-D Secure (where the bank requires verification of suspicious-looking online transactions) by asking the user to confirm the transaction, e.g. by providing an SMS confirmation code or confirming the transaction in their bank app.

If you didn’t see the incorrect domain name, I think this would be very hard to notice, since the site functions normally. Very different to a regular phishing page where the site looks out of place and is often full of broken links (since they don’t want you navigating away from the fake login page)

This was interesting. I’ve never considered that a scam site could proxy the real one.