How to spot a website that's still being built or quietly redacted

A mate sends you a link over a flat white in Brunswick, you tap it on the train between Redfern and Central, and all that loads is a faded logo, the words "Click here to proceed", and a URL so long it runs off the screen. Half the time you shrug, screenshot it, and move on. The other half you want to know what's really going on. Is the business just renovating its pages, or is someone deliberately hiding the front door? In Australia, where scammers increasingly clone local brands like the big four banks and Services Australia, the difference matters more than most people think.

The good news is you don't need to be a coder to read the signs. A handful of visual tells, a couple of free look-up tools, and a basic understanding of how domains and hosting work will usually settle the question within a few minutes. The notes below are a field guide for anyone who has ever stared at a single lonely link and wondered whether to click it, report it, or simply close the tab.

The anatomy of a placeholder page

A page that's genuinely under construction tends to be honest about it. You'll see phrases like "site coming soon", "launching in 2026", or a maintenance banner with a real date attached. There's usually a name, a contact, maybe an ABN lookup hint, and at least one working sub-page such as a privacy policy. The body copy is thin but not empty, and the styling looks unfinished rather than suspicious.

A page that's deliberately hidden looks quite different. The content is almost aggressively minimal: a single line of text, a generic stock illustration, and a button that goes somewhere you didn't intend. There's no footer, no menu, no "about" link. The whole thing has the feel of a shopfront with the lights off and a sign pointing down an alley. If you see the same template on half a dozen different domains, you've probably stumbled onto a parked landing page.

One quick test: try to find a physical address, a phone number that matches a 02, 03, 07, or 08 area code, or a business name that shows up in the ASIC register. Genuine Australian operations, even tiny ones, almost always leave some breadcrumb. Hidden pages usually don't.

What the source code quietly gives away

Right-click anywhere on a mystery page and select "View Page Source" (or "Inspect" in Chrome). What you're looking for is whether the file is full of meaningful HTML or whether it's basically a wrapper around one anchor tag. A real under-construction site will still have a head filled with meta descriptions, Open Graph tags, structured data, and a few paragraphs of copy even if the visible content looks plain.

A deliberately hidden site often has a body that contains little more than the obfuscated link itself. The meta description might be blank, the title tag might be something generic like "Index of /", and the language attribute might be set to a locale that doesn't match the supposed audience. None of this is proof of anything on its own, but it's the same fingerprint you'll find on scam clones and SEO squat pages.

If the page does include links to social profiles or other domains, hover over them before you click. The status bar at the bottom of the browser will reveal where they really point. An Australian site linking out to a Chinese association site such as China NSW for "sister city" content is one thing; the same link on a supposed Bendigo accountant's homepage is another. Context still matters.

Reading DNS and registration records like a local

When the visual layer tells you nothing, the next layer down almost always does. WHOIS lookups in Australia are handled through auDA, the .au administrator, and the public service will show who registered the domain, when, and through which registrar. A domain registered last week, with privacy on, hosted overseas, and pointing at a one-page redirect is a strong signal nobody is building a real business there.

Check the name servers too. If a site claims to be a community organisation but its DNS points to a bulk-hosting provider you've never heard of, or to a server farm in another country, that's worth noting. A community publication such as the one that ran the Special Olympics support story is going to be hosted somewhere stable, with a real publishing history, and with a registrant you can actually trace.

You can also use DNS history services to see if the domain used to point somewhere else entirely. A lot of suspicious .com.au addresses are recycled from old businesses that closed down years ago, and the new owners inherit the SEO weight without any of the legitimacy.

Why "click here" links deserve suspicion

The phrase "Click here to proceed" is one of the oldest tricks on the web, and it's still common because it works. It defers the real destination, hides it from search engines, and lets the page owner swap the target whenever they like. If the link is also wrapped in a JavaScript redirect or an obfuscated URL parameter, that's two layers of evasion stacked on top of each other.

Sometimes the destination is harmless, like a verification step or an age gate. Plenty of legitimate publishers use them for legal reasons. But when that's the only content on the page, with no explanation of where you're being sent or why, treat it the way you'd treat a stranger in a Kings Cross car park offering you a lift. A reasonable site tells you where you're going.

If you do want to peek, copy the link and run it through a URL expander such as URLVoid, VirusTotal, or even just a Google search of the bare domain. If the destination is a known affiliate tracker, a gambling sign-up, or a file host you've never heard of, you'll usually find someone else has flagged it already.

Construction versus cloaking versus parking

These three things get conflated all the time, and the language Australians use online doesn't help. "Parked domain" usually means a registrar is holding the address and showing ads while the owner does nothing. "Under construction" means a human is actively building something, even if slowly. "Cloaking" or "hiding" means the owner is intentionally showing one thing to visitors and another to search engines, often to dodge filters.

The technical signatures are different. A parked page often belongs to the registrar itself, with nameservers pointing to a parking service. A construction page usually belongs to a real person or business, with a recent registration date and a hosting account under their name. A cloaked page might have a long history, redirect rules in the .htaccess file, and inconsistent content depending on how you reach it.

Niche travel sites, such as a working holiday guide aimed at backpackers, can look sparse because the audience is small and the content updates in real time. The difference is that those sites still have a publishing trail, an author, and a way to contact the people behind them. Parked and cloaked sites rarely bother, and comparing the page in a normal browser to a cached version in the Wayback Machine will usually reveal whether the content has shifted in suspicious ways.

Free Australian-friendly tools to dig deeper

You don't have to spend a cent to investigate. The Australian Cyber Security Centre runs ReportCyber, which is the proper channel for forwarding dodgy sites to law enforcement. ACMA maintains a complaints register for prohibited content. The ACCC's Scamwatch publishes the latest domain patterns impersonating banks, telcos, and government services, and it's worth checking if the address in question has appeared in a recent alert.

For technical checks, a combination of DNSdumpster, SecurityTrails, and the free tier of Shodan will tell you more about a domain's infrastructure than most paid services. Pair that with a reverse image search on the logo (often the only "content" on a hidden page) and you'll usually find the original artwork somewhere. A lot of these placeholder sites lift their visuals from free template galleries, and the templates themselves are listed publicly.

Browser extensions like uBlock Origin and HTTPS Everywhere also help, because they strip a lot of the redirect chains and tracking pixels that cloaked sites rely on. On a Telstra or Optus home connection in particular, running a quick ad-block test can reveal whether the page is trying to push you through three different redirects before the final page even loads.

When the evidence still isn't enough

Sometimes you do all of the above and you're still none the wiser. The page is too new, the WHOIS data is hidden behind a privacy proxy, the destination of the link is plausible, and the visual design is generic but not obviously stolen. In that situation the safest move is simply not to click through, especially from a device that holds your banking apps or work email.

If you have a reason to be on the site, such as a booking confirmation from a small operator or a link a friend actually meant to send, contact the business through a channel you already trust. Look up their number on Google, not on the page itself. Call them and ask whether the URL is theirs. Most under-construction sites will happily confirm; most hidden ones will either not answer or give you a different URL entirely.

For travel and regional sites that look unusually thin, cross-check against a known regional portal index before you book anything. You can also contribute to the public record. Report the domain to Scamwatch, add it to a community blocklist, and if it's impersonating an Australian brand, send the evidence to the brand's abuse address. The next person who lands on that blank page will benefit from your half hour of work.

The next time you land on a page that feels off, spend ten minutes on the steps above before you click anything that matters. Pull up the source, run a WHOIS, scan the URL, and if the picture still doesn't add up, walk away. Your data, your money, and your peace of mind are worth more than a curiosity tap on a stranger's link.

More importantly, share what you find. Drop the domain into Scamwatch, flag it on a community blocklist, or simply send a quick warning to whoever passed the link along. The web gets safer when each of us treats a suspicious page as a public problem rather than a private inconvenience.