01What you can report
Report a website that tries to trick people. The form asks which kind of problem it is:
- Phishing or a fake login — a copy of a real site that asks for a password, a code or card details;
- a scam shop — it took payment and nothing arrived, or it sells fake goods;
- fake tech support — pop-ups or phone numbers claiming your device is infected;
- malware or a forced download;
- pretending to be a brand or a person — using someone else’s name, logo or identity;
- an investment or crypto scam — promised returns, fake trading or giveaways;
- something else that is deceptive or harmful.
A report is not the place for a complaint about a genuine business — slow delivery, poor service or a refund dispute. Write a review instead, or contact the business. For content you own that a site copies, or a trademark question, contact us.
You can add what happened, the site it pretends to be, and up to five screenshots, emails or receipts (PNG, JPG or PDF, 10 MB each). Don’t include card numbers or passwords.
02How we check reports
There is one case per website: reports about the same site are added together. When a case opens, and again with every new report, we run automatic checks: how old the domain is, whether it looks like a well-known brand or the site it pretends to be, what safety services and DNS blocklists say about it, whether it is on a phishing list, and a look at the live page in an isolated browser (its title, and whether it asks for passwords or card details).
Reports don’t all count the same:
- a report from a trusted reporter — someone with at least three reports we confirmed, and three in four of their decided reports confirmed — counts in full;
- a report from a signed-in account counts a little over half;
- an anonymous report, sent after a bot check, counts less again.
Several reports from the same person, the same network or the same browser extension within 24 hours count once.
A case with strong warning signs goes to a CubDomain reviewer, usually within a few hours. The reviewer can confirm it as a scam, decide it isn’t one, or wait for more information. Reports alone never make us call a site a scam: that takes a reviewer’s decision, or the site being on an outside phishing list.
03What we show publicly, and for how long
A report is never published, and neither is who sent it. What we show — in the “Community reports” box on the site’s CubDomain report and in the CubDomain browser extension — is the number of reports and their categories, in one of three states:
- Under review (“Reported by users”)
- When the reports add up to at least two full reports and the site also shows a warning sign — it is under 30 days old, it looks like another site, or a safety service flags it. We say clearly that it isn’t a confirmed finding.
- Confirmed scam
- When a CubDomain reviewer has confirmed it, or when it is on an outside phishing list (we say which).
- Resolved
- When a reviewer found no scam in a case that had been shown publicly.
One report about a site with no warning signs is kept under watch and nothing is shown.
An unconfirmed case with no new report for 90 days stops showing. A confirmed scam shows until the domain changes owner (its registration date changes) or the site has been offline for 30 days. “Resolved” shows for 90 days after the decision.
04When we confirm a scam
CubDomain users see a red warning, and the report’s Community box says “Confirmed scam”. We also report the site to Google Safe Browsing, to PhishTank and the Anti-Phishing Working Group, and to the abuse contacts of the domain’s registrar and its hosting provider. What we send them is the domain, what kind of scam it is, the date we confirmed it, how many people reported it and the facts we checked — never who reported it or what they wrote.
If you left your email address, we tell you the outcome either way.
05Site owners’ right to respond
The verified owner of a domain (someone who has proved they own it) is emailed when reports about it are shown publicly or go to review. They can see a summary — how many reports, in which categories, and when — and respond from their account with an explanation and supporting documents, and choose to show a short public reply on the report.
A reviewer reads the response with the reports, usually within 2 working days. While it is being reviewed, the “under review” notice stays on: clearing it is always a reviewer’s decision, never automatic. If the site is genuine we mark the case resolved; if problems continue it stays open, and new reports reopen a closed case. The owner is emailed at each step.
Owners never see reporters’ names, email addresses or what they wrote.
06Fair use, false reports and bans
- You can send up to 5 reports a day, and up to 20 can come from one network in a day.
- You can’t report a domain you have claimed. Owners respond to reports instead.
- Report honestly: you confirm this each time. False or malicious reports are removed, lower the reporter’s standing, and can lead to their account being banned.
- Contacting, pressuring or threatening someone you believe reported your site breaks our terms.
07Your privacy
We never share a reporter’s identity with the site owner, the abuse desks we report to, or the public.
For each report we keep:
- what you sent: the category, the site it pretends to be, what happened, and your files;
- your email address, if you gave one (or your account’s, if you were signed in), to tell you the outcome;
- your account, if you were signed in, to weigh your reports by your record;
- a scrambled code (a keyed hash) of your network and, for the browser extension, of its random install ID — so that several reports from one place count once. We don’t store your IP address, and we delete these codes after 30 days.
Only CubDomain’s reviewers can see reports and their files. Files are kept in private storage (Cloudflare R2), never published. Anonymous reports pass Cloudflare’s Turnstile bot check. We keep reports and their files for [as long as the case is open and 24 months after the decision], then delete them. Our Privacy Policy explains your rights, including asking for a copy of your data or for it to be deleted.
08Contact us
Questions about a report, a decision or this policy:
- Email: [email protected]
- Contact page: cubdomain.com/contact
- Post: CubDomain, 88 Tram Road, Doncaster VIC 3108, Australia
- CubDomain is run by Parneet Singh Batra, ABN 53 661 545 083
If you lost money or shared a password, call your bank first. In Australia, also report to Scamwatch and ReportCyber.