When was this .au domain born, and who is it pretending to be?
spotafraud.ai checks Australian (.au) domains for signs they were set up for fraud: lookalikes of real organisations, fake invoices, phishing and fake stores. It starts from something ordinary checks can't see for .au: when a domain first appeared.
The .au blind spot
Most scam and email-security checks ask one question first: how old is this domain? For .com that comes from WHOIS. For .au it doesn't: auDA's WHOIS policy says creation dates are not disclosed, there is no public zone file, and bulk lookups are not allowed.
So the usual "newly registered domain" warning quietly fails for Australian domains, and fraudsters use that. A typical pattern: a company launches an app on a new domain, and weeks later a copy one letter shorter appears and starts sending invoices. Nothing in WHOIS says one is years old and the other is weeks old.
How it works
Certificate history
Every HTTPS certificate is recorded in public Certificate Transparency logs. We keep that history back to 2013 for 4.7M .au domains, so each has a first-seen date. Updated hourly.
Registered business
Established domains are matched by name to organisations on the ABN register, linked to ABN Lookup. A name match is a lead, not proof.
Lookalike detection
New domains are compared with 2.3M established .au names: typos, look-alike characters (0 for o), other namespaces, and a real name plus a word.
AI triage
Within about an hour, every new .au domain's DNS, hosting, email setup and homepage are checked, and an AI model scores it 0–100.
Agent investigation
Suspicious domains go to an AI agent that finds the real organisation's official domain and compares the two, which also clears genuine new launches.
Watchlist
Fraud domains often sit idle for weeks. Suspicious ones are re-checked when they change: mail switched on, a login form, a new redirect.
How to read a result
Before you pay an invoice with new bank details, call the supplier on a number you already have, not one from the email.
Who it's for
Anyone checking a website
Paste a .au domain or link before you buy, log in or reply.
Finance and accounts payable
Confirmation of Payee checks the account name. We check the sender: is the domain on that invoice days old, and one letter off your supplier's?
Fraud and security teams
The same check over an API, plus a feed of new .au domains as they appear.
Brand owners
See .au lookalikes of your organisation as soon as they go live.
Questions
When was this .com.au domain registered?
.au registries don't publish creation dates. The date of a domain's first HTTPS certificate is the next best thing: it shows the domain has been in use since at least then. Check any .au domain on the home page to see it.
Why does WHOIS show no creation date for .au domains?
auDA's WHOIS policy withholds creation, renewal and expiry dates from public lookups. Generic "domain age" tools then show nothing, or a last-changed date that looks like an age but isn't.
Does "low risk" mean a site is safe?
No. It means we found no warning signs in the domain's history, setup and content. A well-run scam can look ordinary, so verify payments and requests through a channel you already trust.
I think a site is a scam. Where do I report it?
Report it to Scamwatch and, for cybercrime, to ReportCyber. If you've already paid, call your bank straight away.
Think we have your domain wrong? Email support@spotafraud.ai and we will review it.
Limits and data
What we can't see
- Only domains that get an HTTPS certificate appear in our history. A domain used only for email, with no certificate, is invisible until it gets one.
- We cover .au domains only.
- Business matches come from public ABN register names, not from the domain registry.
- AI checks can be wrong in both directions. Every result lists its evidence so you can judge it.
Data sources
- Public Certificate Transparency logs (RFC 6962 and static-ct logs), read directly and from public archives.
- ABN Bulk Extract, Australian Business Register, data.gov.au, licensed under CC BY 3.0 AU.
- DNS, and the public homepage of each domain we check, fetched read-only.