How to Build a Personal Log of Suspicious Domains
A personal log of suspicious domains for future checks is a defensive record, not a collection of arguments or a licence to probe websites. Its value comes from preserving small details while memory is fresh: the exact web address, where it appeared, when it arrived and what action you took. Later, those details can reveal repeated campaigns, help you spot a familiar impersonation pattern and stop a suspicious message from reaching a bank account or family member.
Many encounters happen during ordinary Australian routines: checking a transfer while catching a train in Sydney, opening an event-ticket offer in Melbourne or scanning a QR code near a café in Brisbane. A genuine-looking message can still contain a mistyped address, an unfamiliar payment request or a link that leads somewhere unexpected. Recording the message before reacting creates a clean reference point without requiring technical expertise.
The log should stay factual. A strange domain is a signal, not proof that its owner is dishonest, and a familiar brand can be copied, compromised or mentioned by a legitimate news site. Note what you observed and separate that from any inference. This distinction prevents a weak clue from becoming an accusation and makes the record useful when you need to explain the risk to a bank, employer or household.
A practical system needs three parts: a protected place to store entries, a consistent set of fields and a short decision for what to do next. It should not contain passwords, one-time codes or unnecessary information about other people. Used this way, the log becomes a lightweight security habit rather than a digital archive of private data. It also lets you compare new activity with earlier warnings before clicking, paying or replying.
Set the Log’s Purpose and Boundaries
Start by defining what the log is for. Most useful entries answer four points: the exact address, its source, the unusual feature and the action taken. Keep the scope narrow enough that you will maintain it. A household member checking a delivery text, a sole trader validating an invoice and a university administrator reviewing a login alert can use the same format while assigning different response levels.
Australian context belongs in the process, but legal categories should not be confused with technical verdicts. For covered organisations, the Privacy Act 1988 can govern the handling of personal information, while the Spam Act 2003 sets rules for commercial electronic messages. ACCC Scamwatch and the Australian Signals Directorate provide relevant reporting channels. A log supports those processes; it does not replace legal advice, an incident plan or a police report.
Keep the Records Secure
Store entries in an encrypted password manager, an access-controlled note or a protected offline file. Avoid shared photo albums, open spreadsheets and devices that anyone can access. A known URL such as a travel notes reference can be compared as plain text with a message claiming to replace an itinerary, but the message link itself should not be opened merely to perform that check. Record what you can see without turning the test into an engagement.
Protect the evidence as carefully as the information. Keep the original message available, record the local date and time, and note the channel, such as SMS, email or a social-media direct message. Redact account numbers and other sensitive details in any copy you share. If several people need access, give them the minimum necessary and keep the master record under one owner.
Capture Details That Matter
Create a repeatable entry with a short description, the full URL including its subdomain, path and query string, the apparent sender, the date and the reason for concern. Preserve spelling exactly, including extra letters, hyphens, unfamiliar endings and unusual character encodings. A screenshot can help, but retain the text address because images are harder to search and may be edited. Record any action already taken, such as deleting the message or contacting an institution.
If a page opened by mistake, stop interacting with it rather than exploring every button. Where appropriate, a trusted hidden source guide can explain how to inspect saved source for redirects, forms or concealed text. Treat that reading as a lead, not a verdict. The Australian .com.au suffix is familiar, yet seeing it does not prove local ownership, and a convincing page can still sit on a domain registered for unrelated purposes.
Classify the Risk Without Jumping to Conclusions
Classify entries by the behaviour you observed: credential harvesting, malware delivery, invoice or payment fraud, aggressive marketing, impersonation of a known organisation, or a compromised legitimate account. Several categories can overlap. A request for a one-time code deserves urgent attention, while an unexpected newsletter may simply reflect poor list hygiene. The category should follow the evidence and indicate the safest proportionate response.
An advertisement for an online pokies guide shows why publisher, advertiser and destination must be recorded separately. Online pokies promotions are familiar in the Australian market, and gambling advertising rules differ between states, yet an ad does not establish who controls every linked domain. Likewise, a news article can mention a suspicious domain without endorsing it. Record the relationship between the page and the address instead of assigning blame by appearance.
Check Through Low-Risk Methods
Use low-risk checks before acting. Compare the address character by character with the organisation’s official details, find official contact points through a trusted app or card, and search for prior warnings without opening the suspect link. Domain age, hosting changes and certificate details may add context, but they are not guarantees. If money or credentials are involved, rely on instructions obtained through a known channel rather than details supplied by the questionable message.
Suppose a familiar social account shares a lifestyle reading page. That pairing can be legitimate, paid promotion, account compromise or an unrelated link inserted by an attacker; the post and destination require separate observations. Do not investigate while signed in to online banking on café Wi-Fi in Brisbane or over a shared airport connection. Close the page, protect the trusted device and contact the relevant bank or service through its official channel if you entered information.
Compare Patterns and Choose a Response
Group entries by recurring patterns rather than by whether a domain looks familiar. Look for repeated senders, reused wording, common hosting details, new registrations and the same destination appearing under several brands. A useful log shows where the observation lies: the exact message text is a fact, a likely impersonation method is an interpretation, and a blocked or reported status is an action.
Use a response ladder: record and monitor, report or block, and escalate urgent financial or credential exposure. Keep those decisions separate for each entry. A harmless false positive can remain in the archive for context, while a domain linked to a payment request should be escalated even when the sender claims it was a test. The response records what you did and when, which is more useful than an unexplained risk score.
| Recorded pattern | What it may indicate | Sensible next step | Evidence to preserve |
|---|---|---|---|
| Extra, missing or substituted characters | Typo-style impersonation | Compare with the official address; do not use contact details from the message | Exact URL, screenshot, sender and time |
| A login form following an urgent message | Credential phishing | Close the page and contact the service through a known channel | Original message, headers or email |
| A link appearing in an unrelated advertisement | Advertising, tracking or deceptive placement | Block it if unverified and report a misleading advertisement | Page URL, advertisement text and redirect details |
| A familiar domain with an unusual path | Site compromise or an unrelated subdomain | Verify through official navigation and alert the owner | Full path, page capture and date |
| The same address across several senders | A reused campaign infrastructure | Correlate the entries and report the pattern | Sender list, wording and timestamps |
Escalate entries involving bank transfers, passwords, one-time codes or identity documents as soon as practical. Contact the financial institution promptly if information may have been submitted, and preserve the original message and headers. Australian users can report phishing through the Australian Signals Directorate, impersonation or marketplace fraud to the relevant platform, and broader scams through ACCC Scamwatch. If a business is affected, move the evidence into its formal incident process rather than circulating accusations publicly.
Make the Log a Regular Habit
Review the log on a fixed schedule and whenever a new suspicious contact arrives. Add a new observation to an existing entry when the address repeats, but do not overwrite the earlier date or source. Keep unresolved items, close false positives with a short reason and periodically remove entries that no longer have value. The aim is a usable history, not an endless archive or an amateur investigation.
Create one protected entry today using the most recent suspicious message you received, capture its exact address and take the first safe action that matches its severity. Then schedule the next review and make the log part of your routine before online banking, payments or ticket purchases.