How to check if an Australian website is legit
Paste the website or the link from the email or text. We'll show when the domain first appeared, which registered business is behind it, and whether it imitates a real organisation.
What the check shows
Enter any .com.au, .net.au, .org.au or .au address in the box. In seconds you see:
- Age: when the domain first appeared, from 12 years of public certificate records. Australian domain records don't show this.
- Owner: the business on the ABN register that matches the domain, with a link to ABN Lookup.
- Lookalikes: whether the name is one letter off, or a copy, of an established Australian website.
- Risk: an AI check of new domains (website, hosting and email setup), scored 0–100 with the reasons.
5 warning signs
- It's brand new: a site that claims to be an established company but first appeared weeks ago.
- The name is almost right: one letter added or missing, an extra word ("-group", "-portal", "-pay"), or .net.au instead of .com.au.
- No business behind it: no ABN on the site, or an ABN that belongs to a different business.
- It asks for money or logins too soon: a payment, bank details or password form on a site you've never used.
- The email doesn't match: invoices or messages from a domain that's different from the company's real website.
One sign on its own isn't proof of a scam; several together are a strong reason to stop and check.
Is a .com.au site always Australian?
To register a .com.au domain you need an Australian presence, usually an ABN or ACN. That makes a .com.au look trustworthy, and scammers know it: they register lookalike domains using real businesses' ABNs, or re-register expired domains.
So a .com.au tells you the domain was registered against an Australian business, not that the business behind the website is the one it claims to be. Check that the registered business matches the company you think you're dealing with.
How old is this website?
Australian domain lookups (WHOIS) don't show when a domain was registered, so most "domain age" tools can't answer this for .au. Our check uses the date the domain got its first website certificate, which shows it has existed since at least then.
A new domain isn't a scam by itself: businesses launch new sites every day. Be careful when a new domain also looks like a well-known name, asks for payment, or sends invoices.
Shops, invoices and links
- Online shop: prices far below everyone else, bank transfer only, no ABN or address, and a domain that's only weeks old.
- Invoice or new bank details: call the supplier on a number you already have, not one from the email, and compare the sender's domain letter by letter with past invoices.
- Link in a text or email: don't tap it. Type the company's address yourself, or paste the link into the check, which looks at the domain the link actually points to.
If something looks wrong
- Don't pay, log in or reply until you've confirmed through a channel you already trust.
- If you've already paid, call your bank or payment provider straight away.
- Report the website to Scamwatch, and cybercrime to ReportCyber. IDCARE gives free help on 1800 595 160 if your details were taken.