Brand Impersonation Evidence: Grubhub

Lookalike domains are impersonating Grubhub

This is a public evidence page from Scam Detective’s published research. The real Grubhub operates at grubhub.com. The 3 domains below impersonate it — each with the corroborated evidence. Nothing here is a guess: every finding is backed by the independent sources listed further down the page.

Lookalike domains found

High

Overall risk level

Independent corroborating sources

October 17, 2026

Case verified

The evidence

Confirmed lookalike domains

High riskFake delivery-notification phishing domain

grubhub-track.net

Registration profileLookalike domains registered to mimic Grubhub's delivery-tracking links — rotated as they accumulate reports

First seenJuly 2026, in fake delivery-text waves documented in our Grubhub safety investigation

Evidence

Texts look like Grubhub delivery notifications (“Your driver is on the way! Track your order here: [link]”) but the link goes to a phishing page built to steal credentials or install malware.
Especially effective because recipients are expecting food deliveries and don't think to verify the link — the context does the convincing.
Real Grubhub delivery texts always link to grubhub.com — never to a random URL.

High riskFake delivery-notification phishing domain

grubhub-delivery.com

Registration profileSame lookalike rotation — interchangeable suffixed names for the same text wave

First seenJuly 2026, in the same fake delivery-text waves

Evidence

“Delivery” variant of the same lookalike pattern — the suffixed name reads as an official Grubhub service domain.
Same credential-harvesting payload behind the tracking link.

High riskFake delivery-notification phishing domain

grubhub-order-update.co

Registration profileSame lookalike rotation on an alternate TLD

First seenJuly 2026, in the same fake delivery-text waves

Evidence

“Order update” variant on an alternate TLD — same trick, different framing, aimed at the order-status anxiety window.
Any variation on the grubhub.com domain carrying a tracking link is a phishing page, not a Grubhub service.

Red flags in this impersonation

01Real Grubhub links use grubhub.com — a tracking link to any other domain is a scam.

02You're expecting a delivery — which is exactly why the fake text works; check the order in the app or at grubhub.com instead.

03Unsolicited texts with shortened or lookalike tracking links.

04Pages that ask you to log in again or “confirm” payment details.

05Type grubhub.com directly rather than clicking links from texts or emails.

Who corroborates this evidence

Scam Detective's published investigation

Our Grubhub safety investigation (published July 30, 2026) documented the fake delivery-text variant and the lookalike tracking domains it routes through.

Grubhub's own delivery-text footprint

Grubhub does send delivery texts — but they always link to grubhub.com, never to a random URL, which makes the sender-link mismatch a clean, checkable signal.

Pattern match to corroborated cases on this site

The same delivery-notification smishing playbook is corroborated in our USPS case, backed by USPS's own public warnings and FCC complaint data.

We found this without being asked

A brand impersonation audit does the same sweep for your company: every lookalike domain, typosquat, and copycat store impersonating your brand — each with evidence and a risk rating, plus a ready-to-send takedown-request template. Delivered instantly, $29 one-time, no subscription.

Audit my brand — $29

Get the free Grubhub impersonation evidence pack

Every confirmed lookalike domain, the red-flag pattern, and the independent corroboration from this page — compiled into one file and emailed to you, free. Useful for your security or legal team even if you never buy anything from us.

Ready now? The brand impersonation audit sweeps your own company for every lookalike domain, typosquat, and copycat store — with evidence, risk ratings, and a takedown-request template. $29 one-time, delivered instantly, no subscription.