6 ms·

This is what happens when Google isn't sue-able by private entities. In Germany, lieferando (subsidiary of takeaway.com) registers domains in the form of resta

This is what happens when Google isn't sue-able by private entities. In Germany, lieferando (subsidiary of takeaway.com) registers domains in the form of restaurantname-city.de, points them to their lieferando cloudflare account, and claims ownership for the google business entry where they set the phone number to their own call center. Then they call the business owner and _force them_ to sign the contract with them, because effectively the owner knows they cannot be found anymore via google, and everyone that wants to order something will reach the call center hotline and leave a negative review after the hotline tells them wrong number, effectively destroying their business. And the people working for lieferando via Zeitarbeitsfirmen know this, and mention this in the call to pressure the restaurant owners to get their sales provision. Crimeflare before it got taken down had around 130k domains that were pointing to the lieferando website using this kind of scheme, I helped provide the dataset for a couple of local business owners that were extorted this way and refused to abide by that scheme. Guess what happened, nobody could be sued and the financial damages were too small to escalate it on the European court level. Sadly, class-action lawsuits don't work the same way as in the US, apparently. Effectively Google does not abide by the laws and gets away with it due to their financial structures of their holding companies. And they certainly know about this, they just don't give a single fvck.

chaosbolt 1y ago
Wow that scheme sounds exactly like mafia activities in the Sopranos or other movies.
mikae1 1y ago
Geez. Has there been any good write-ups about this in the German press?
- cookiengineer 1y ago
  At the time we didn't know how large the scheme is, because you only find out effectively about those domains if you let your own root/resolver running and listen for the A/AAAA entries coming from cloudflare. So the real number of those domains is likely to be much much larger if you would have the same dataset like crimeflare had. You can find articles about it with the keyword "Schattenwebsites lieferando" because that's what the press seems to have settled on. Different press teams counted different amount of websites because of that. Another team where I knew people from the CCC that helped them confirmed the 120k number though. Our final number in Q4 of 2021 was 130k domains that we found out about, and we were trying to contact a bunch of other business owners to be able to escalate the lawsuit onto the Landsgerichtsebene (so that it can go into the Bundesgerichtshofsebene afterwards, and then to the EU court). [1] https://www.stern.de/wirtschaft/lieferando-lockt-kundschaft-mit--schattenwebsites--von-restaurants-weg-30394366.html https://www.stern.de/wirtschaft/lieferando-lockt-kundschaft-... [2] https://notizlo.ch/wie-man-gegen-lieferando-domains-arbeitet/ https://notizlo.ch/wie-man-gegen-lieferando-domains-arbeitet... [3] https://t3n.de/news/lieferando-restaurants-schattenwebsites-1358508/ https://t3n.de/news/lieferando-restaurants-schattenwebsites-... [4] https://www.trendingtopics.eu/lieferando-provisionszahlungen-ueber-schattenwebseiten-von-restaurants/ https://www.trendingtopics.eu/lieferando-provisionszahlungen... [5] https://www.deutschlandfunknova.de/beitrag/schattenwebseiten-lieferando-erstellt-tausende-website-fuer-restaurants https://www.deutschlandfunknova.de/beitrag/schattenwebseiten...
  - stavros 1y ago
    You could perhaps parse the CT logs to see who registered certificates for such domains, no?
    - thyristan 1y ago
      CT logs usually don't identify the owner of a site in case of the usual domain validation (DV) certificates. Only OV or EV (organisation or extended validation) certificates provide some hint at the responsible party.
      - stavros 1y ago
        Yeah but you can visit the site and see if it's their usual landing page.
iakov 1y ago
That sounds absolutely insane. Doesn't Google have any way to dispute the business ownership? Can I take over any business on the maps by just registering a domain that contains the business name?
- mschuster91 1y ago
  > Can I take over any business on the maps by just registering a domain that contains the business name? yes, as long as the business doesn't have that already. And that's the point - many small restaurants, takeaways etc simply don't have a website because they think they don't need one, until they're fucked by Lieferando.
  - Tade0 1y ago
    I googled the name as I was unfamiliar with it, but immediately recognized the orange logo in search results. Their entire business model seems to be centered around extorting businesses. I stopped giving them money after they inaccurately posted that a certain restaurant delivers to my location and got a phonecall from the place that this was the case so I agreed to pay extra to fulfill the order anyway, because Lieferando certainly wouldn't take responsibility. Nowadays I use them only for discovery, but call the place directly or use the webpage if the business provides online ordering. It appears that their initial value proposition to businesses was substituting delivery services so that restaurants could scale that up without hiring more staff. Of course enshittification made that service worse than just walking/driving/taking public transport there.
  - Aerroon 1y ago
    But isn't that fraud? Lieferando is fraudulently pretending to be someone they aren't to profit from it.
    - mschuster91 1y ago
      They're following the usual VC pattern: it's more profitable to ask for forgiveness instead of approval. Plus, many restaurant owners are immigrants, and undocumented/underpaid labor is blooming as well. The last thing they want is to attract the eyes of the government.
triknomeister 1y ago
Why is google not sue-able?
- ale42 1y ago
  Here I'd rather ask, why Lieferando is not sue-able? What they did is not just unethical, it's plain illegal.
  - ahofmann 1y ago
    I do not use lieferando because of this, and I think what they're doing is highly immoral and wrong. But I don't see where this is plain illegal. Can you elaborate?
    - deno 1y ago
      Isn’t this business model (as described above) literally the definition of racketeering? I guess there might not be an equivalent in Germany.
    - albumen 1y ago
      "And the people working for lieferando via Zeitarbeitsfirmen know this, and mention this in the call to pressure the restaurant owners to get their sales provision." Extortion.
    - Koffiepoeder 1y ago
      It may constitute an infringement on common law trademark rules [0], but not sure what the German legislation around that is. [0]: https://en.wikipedia.org/wiki/Unregistered_trademark https://en.wikipedia.org/wiki/Unregistered_trademark
    - harvey9 1y ago
      lieferando has an identical logo to just-eat.co.uk . I already don't use the UK one: i often get their drivers coming to my house with other people's food so I don't trust them to get the basics of delivery right (they should capture the GPS where the successful handover takes place and learn from that for future orders).
chatmasta 1y ago
This was a well-published tactic on BlackHatWorld about 15 years ago. I love that VC companies have finally capitalized on it…
- TeMPOraL 1y ago
  VC knew this for just as long. Similar ideas brewed in the business model of TripAdvisor, and eventually crystalized in the form of GrubHub and Uber Eats. I remember a growing amount of articles and on-line discussions about restaurants being extorted this way; then the pandemic came and removed the need for extortion by making delivery necessary for restaurants' survival. It's probably why the whole thing isn't talked about anymore these days.
RataNova 1y ago
Terrifying how easy it is to weaponize Google's ecosystem against small businesses like that
- throwaway2037 1y ago
  Wasn't this Yelp's business strategy for a while? I'm unsure if that finally changed.
  - genewitch 1y ago
    Yelp was pay to have bad reviews removed, even if the reviews were possibly put there by yelp to facilitate extortion.
afarah1 1y ago
This seems about not being able to sue the company doing extortion (in your words), not Google...
- cookiengineer 1y ago
  It would not be extortion if Google would verify their data sources and would have a working process to claim ownership of legal entities.
hyperman1 1y ago
Isn't trademark law designed to stop this?
- briandear 1y ago
  Assuming you have registered the trademark. Most small businesses don’t think to do this.
  - microtonal 1y ago
    IANAL and this probably differs a lot per country. But typically you do not need to register a trademark, you only lose it if you do not actively defend it. So a small business could still sue Lieferando when they take your name. However, I think most small companies with thin margins would find the idea too daunting.
    - thyristan 1y ago
      For the usual case of "Ristorante Napoli #239878", "Bangkok Asia Imbiss #9999" and "Taverna Rhodos #4711" you cannot register a trademark because those names are usually not unique and often reference generic place names or stuff like that.
ale42 1y ago
Related, today on HN: https://news.ycombinator.com/item?id=44095250 https://news.ycombinator.com/item?id=44095250
GuB-42 1y ago
What laws Google (and Cloudflare) does not abide with? It seems like Lieferando is the problem here. How comes that company is still in business? It seems like obvious identity theft to me, if anything Google is only guilty of trusting Lieferando too much.
- thyristan 1y ago
  Various rights to correct misinformation and misdirection exist that Google blatantly ignores. Google aides and abides identity theft, deception and fraud this way, also profiting from it. As soon as Google knows about a crime being committed and about information they spread being wrong or even fraudulent, they do have a duty to immediately take it down, otherwise they are an accomplice. As soon as a certain site like lieferando and cloudflare is known to provide mostly fraudulent information, Google also has the duty to implement more thorough checks for information from those parties and even stop trusting them.
- tobr 1y ago
  There was a good comment on HN the other week about identity theft: > There's no such thing as identity theft, it's all bank fraud or in this case student aid fraud. "Identity theft" is a term coined by banks to try to make it sound like random people should have to deal with the fallout of the banks' bad identity verification practices. https://news.ycombinator.com/item?id=43923179 https://news.ycombinator.com/item?id=43923179 In this case, the ”identity theft” happens because Google trusts someone they shouldn’t. If they didn’t, the scam wouldn’t be possible. Yes, the scammer is the problem, but Google are providing them the opportunity, and leave it to each victim to deal with the situation.
  - ghusto 1y ago
    Came here to say this, thank you. "Beware of scammers!!!111!". No, _you_ beware of scammers, that's what I pay you for.
deleted 1y ago
[deleted]
lolinder 1y ago
Why are you framing this as being primarily about Google being un-sueable? There's clearly a problem with Google being difficult to work with to re-claim ownership of a business profile (no customer support, as always) and Google obviously has deep pockets that would be tempting to get access to, but isn't Lieferando the one engaged in the extortionate business practices? Under US law I can see a few different things that would make the Lieferando behavior you describe illegal, whereas all Google is doing is being the unwitting vector for their illegal activity. It's always more difficult to pin fault for a crime on unwitting enablers even when their negligence arguably rises to the level of a crime. The big question here is why businesses haven't successfully fought back against the ones doing the actual crime?
ensignavenger 1y ago
I'm not familair with German laws, but are you saying that there is some law that prevents individuals from sueing Google and liederando? That seems insane, in the US, you could absolutely sue both of these businesses.
tomhow 1y ago
> they just don't give a single fvck Can we not do this on HN? We're not prudish about words like that, so if you're going to use the word, please just use it correctly. We do have a guideline that asks not to fulminate, so please observe that, along with all the guidelines. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html

chaosbolt 1y ago

Wow that scheme sounds exactly like mafia activities in the Sopranos or other movies.

mikae1 1y ago

Geez. Has there been any good write-ups about this in the German press?

cookiengineer 1y ago
At the time we didn't know how large the scheme is, because you only find out effectively about those domains if you let your own root/resolver running and listen for the A/AAAA entries coming from cloudflare. So the real number of those domains is likely to be much much larger if you would have the same dataset like crimeflare had. You can find articles about it with the keyword "Schattenwebsites lieferando" because that's what the press seems to have settled on. Different press teams counted different amount of websites because of that. Another team where I knew people from the CCC that helped them confirmed the 120k number though. Our final number in Q4 of 2021 was 130k domains that we found out about, and we were trying to contact a bunch of other business owners to be able to escalate the lawsuit onto the Landsgerichtsebene (so that it can go into the Bundesgerichtshofsebene afterwards, and then to the EU court). [1] https://www.stern.de/wirtschaft/lieferando-lockt-kundschaft-mit--schattenwebsites--von-restaurants-weg-30394366.html https://www.stern.de/wirtschaft/lieferando-lockt-kundschaft-... [2] https://notizlo.ch/wie-man-gegen-lieferando-domains-arbeitet/ https://notizlo.ch/wie-man-gegen-lieferando-domains-arbeitet... [3] https://t3n.de/news/lieferando-restaurants-schattenwebsites-1358508/ https://t3n.de/news/lieferando-restaurants-schattenwebsites-... [4] https://www.trendingtopics.eu/lieferando-provisionszahlungen-ueber-schattenwebseiten-von-restaurants/ https://www.trendingtopics.eu/lieferando-provisionszahlungen... [5] https://www.deutschlandfunknova.de/beitrag/schattenwebseiten-lieferando-erstellt-tausende-website-fuer-restaurants https://www.deutschlandfunknova.de/beitrag/schattenwebseiten...
- stavros 1y ago
  You could perhaps parse the CT logs to see who registered certificates for such domains, no?
  - thyristan 1y ago
    CT logs usually don't identify the owner of a site in case of the usual domain validation (DV) certificates. Only OV or EV (organisation or extended validation) certificates provide some hint at the responsible party.
    - stavros 1y ago
      Yeah but you can visit the site and see if it's their usual landing page.

iakov 1y ago

That sounds absolutely insane. Doesn't Google have any way to dispute the business ownership? Can I take over any business on the maps by just registering a domain that contains the business name?

mschuster91 1y ago
> Can I take over any business on the maps by just registering a domain that contains the business name? yes, as long as the business doesn't have that already. And that's the point - many small restaurants, takeaways etc simply don't have a website because they think they don't need one, until they're fucked by Lieferando.
- Tade0 1y ago
  I googled the name as I was unfamiliar with it, but immediately recognized the orange logo in search results. Their entire business model seems to be centered around extorting businesses. I stopped giving them money after they inaccurately posted that a certain restaurant delivers to my location and got a phonecall from the place that this was the case so I agreed to pay extra to fulfill the order anyway, because Lieferando certainly wouldn't take responsibility. Nowadays I use them only for discovery, but call the place directly or use the webpage if the business provides online ordering. It appears that their initial value proposition to businesses was substituting delivery services so that restaurants could scale that up without hiring more staff. Of course enshittification made that service worse than just walking/driving/taking public transport there.
- Aerroon 1y ago
  But isn't that fraud? Lieferando is fraudulently pretending to be someone they aren't to profit from it.
  - mschuster91 1y ago
    They're following the usual VC pattern: it's more profitable to ask for forgiveness instead of approval. Plus, many restaurant owners are immigrants, and undocumented/underpaid labor is blooming as well. The last thing they want is to attract the eyes of the government.

triknomeister 1y ago

Why is google not sue-able?

ale42 1y ago
Here I'd rather ask, why Lieferando is not sue-able? What they did is not just unethical, it's plain illegal.
- ahofmann 1y ago
  I do not use lieferando because of this, and I think what they're doing is highly immoral and wrong. But I don't see where this is plain illegal. Can you elaborate?
  - deno 1y ago
    Isn’t this business model (as described above) literally the definition of racketeering? I guess there might not be an equivalent in Germany.
  - albumen 1y ago
    "And the people working for lieferando via Zeitarbeitsfirmen know this, and mention this in the call to pressure the restaurant owners to get their sales provision." Extortion.
  - Koffiepoeder 1y ago
    It may constitute an infringement on common law trademark rules [0], but not sure what the German legislation around that is. [0]: https://en.wikipedia.org/wiki/Unregistered_trademark https://en.wikipedia.org/wiki/Unregistered_trademark
  - harvey9 1y ago
    lieferando has an identical logo to just-eat.co.uk . I already don't use the UK one: i often get their drivers coming to my house with other people's food so I don't trust them to get the basics of delivery right (they should capture the GPS where the successful handover takes place and learn from that for future orders).

chatmasta 1y ago

This was a well-published tactic on BlackHatWorld about 15 years ago. I love that VC companies have finally capitalized on it…

TeMPOraL 1y ago
VC knew this for just as long. Similar ideas brewed in the business model of TripAdvisor, and eventually crystalized in the form of GrubHub and Uber Eats. I remember a growing amount of articles and on-line discussions about restaurants being extorted this way; then the pandemic came and removed the need for extortion by making delivery necessary for restaurants' survival. It's probably why the whole thing isn't talked about anymore these days.

RataNova 1y ago

Terrifying how easy it is to weaponize Google's ecosystem against small businesses like that

throwaway2037 1y ago
Wasn't this Yelp's business strategy for a while? I'm unsure if that finally changed.
- genewitch 1y ago
  Yelp was pay to have bad reviews removed, even if the reviews were possibly put there by yelp to facilitate extortion.

afarah1 1y ago

This seems about not being able to sue the company doing extortion (in your words), not Google...

cookiengineer 1y ago
It would not be extortion if Google would verify their data sources and would have a working process to claim ownership of legal entities.

hyperman1 1y ago

Isn't trademark law designed to stop this?

briandear 1y ago
Assuming you have registered the trademark. Most small businesses don’t think to do this.
- microtonal 1y ago
  IANAL and this probably differs a lot per country. But typically you do not need to register a trademark, you only lose it if you do not actively defend it. So a small business could still sue Lieferando when they take your name. However, I think most small companies with thin margins would find the idea too daunting.
  - thyristan 1y ago
    For the usual case of "Ristorante Napoli #239878", "Bangkok Asia Imbiss #9999" and "Taverna Rhodos #4711" you cannot register a trademark because those names are usually not unique and often reference generic place names or stuff like that.

ale42 1y ago

Related, today on HN: https://news.ycombinator.com/item?id=44095250 https://news.ycombinator.com/item?id=44095250

GuB-42 1y ago

What laws Google (and Cloudflare) does not abide with? It seems like Lieferando is the problem here. How comes that company is still in business? It seems like obvious identity theft to me, if anything Google is only guilty of trusting Lieferando too much.

thyristan 1y ago
Various rights to correct misinformation and misdirection exist that Google blatantly ignores. Google aides and abides identity theft, deception and fraud this way, also profiting from it. As soon as Google knows about a crime being committed and about information they spread being wrong or even fraudulent, they do have a duty to immediately take it down, otherwise they are an accomplice. As soon as a certain site like lieferando and cloudflare is known to provide mostly fraudulent information, Google also has the duty to implement more thorough checks for information from those parties and even stop trusting them.
tobr 1y ago
There was a good comment on HN the other week about identity theft: > There's no such thing as identity theft, it's all bank fraud or in this case student aid fraud. "Identity theft" is a term coined by banks to try to make it sound like random people should have to deal with the fallout of the banks' bad identity verification practices. https://news.ycombinator.com/item?id=43923179 https://news.ycombinator.com/item?id=43923179 In this case, the ”identity theft” happens because Google trusts someone they shouldn’t. If they didn’t, the scam wouldn’t be possible. Yes, the scammer is the problem, but Google are providing them the opportunity, and leave it to each victim to deal with the situation.
- ghusto 1y ago
  Came here to say this, thank you. "Beware of scammers!!!111!". No, _you_ beware of scammers, that's what I pay you for.

deleted 1y ago

[deleted]

lolinder 1y ago

Why are you framing this as being primarily about Google being un-sueable? There's clearly a problem with Google being difficult to work with to re-claim ownership of a business profile (no customer support, as always) and Google obviously has deep pockets that would be tempting to get access to, but isn't Lieferando the one engaged in the extortionate business practices? Under US law I can see a few different things that would make the Lieferando behavior you describe illegal, whereas all Google is doing is being the unwitting vector for their illegal activity. It's always more difficult to pin fault for a crime on unwitting enablers even when their negligence arguably rises to the level of a crime. The big question here is why businesses haven't successfully fought back against the ones doing the actual crime?

ensignavenger 1y ago

I'm not familair with German laws, but are you saying that there is some law that prevents individuals from sueing Google and liederando? That seems insane, in the US, you could absolutely sue both of these businesses.

tomhow 1y ago

> they just don't give a single fvck Can we not do this on HN? We're not prudish about words like that, so if you're going to use the word, please just use it correctly. We do have a guideline that asks not to fulminate, so please observe that, along with all the guidelines. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html