scamwatch.gov.au
Scamwatch is a website run by the Australian Competition and Consumer Commission (ACCC), and provides information to consumers and small businesses about how to recognise, avoid and report scams.
At a glance
- Category
- Government & Public Services
- Language
- English
- Paid-content signal
- No paid content foundObserved
- Registered
- Unknown
- Hosting
- AkamaiInferred
- HTTPS certificate trusted
- PassedObserved
- Last updated
Related questions
More questions →How to Use Ahrefs for Your First SEO Audit: A Step-by-Step Tutorial
If you're new to Ahrefs and want to run your first SEO audit, the fastest path is: open Site Explorer, enter your target URL, review the Overview for a health snapshot, then dig into Organic Keywords, Top Pages, and Site Audit to find specific problems. From there, build a short prioritized to-do list instead of trying to fix everything at once.
This tutorial walks through that workflow using a realistic starting scenario, explains what the numbers mean, and shows how to turn findings into actions.
Before You Start: Pick a Narrow Scope
A common beginner mistake is auditing an entire large website on day one. The reports become overwhelming, and you can't tell which issues matter.
Instead, choose one of these starting points:
- A single important page (your homepage or a key product/service page)
- A small site (under ~50 pages, e.g., a personal blog or small business site)
- One section of a bigger site (e.g.,
/blog/)
For this tutorial, assume you're auditing a small business site with about 30 pages. The same steps scale up later.
You'll need an Ahrefs account to follow along. Ahrefs offers paid plans, and pricing and feature limits change over time, so check the current Pricing page for what's included in each tier before committing.
Step 1: Enter Your Target in Site Explorer
Site Explorer is Ahrefs' core tool for analyzing any website or URL.
- Open Site Explorer from the top navigation.
- In the search box, paste your domain (e.g.,
example.com). - Choose the Exact URL or Domain mode depending on scope. For a full-site view, use Domain or Prefix; for a single page, use Exact URL.
- Press Enter.
You'll land on the Overview report. Don't try to absorb everything — focus on four numbers first.
Reading the Overview Snapshot
| Metric | What it tells you | How to use it |
|---|---|---|
| Ahrefs Rank (AR) | Relative strength of the site's backlink profile vs. others in the database | Useful for comparing against competitors, not as a standalone goal |
| Organic traffic | Estimated monthly visits from search | A rough trend indicator, not exact analytics |
| Organic keywords | Estimated number of keywords the site ranks for | Shows breadth of visibility |
| Backlinks / Referring domains | Total links and unique sites linking to you | Referring domains matter more than raw backlink count |
Important caveat: Ahrefs' traffic and keyword numbers are estimates based on its own data. They won't match Google Search Console or your analytics exactly. Treat them as directional, not absolute.
Step 2: See What You Already Rank For
Go to Organic Keywords in the left sidebar. This shows queries where your site appears in search results.
Sort by Traffic (descending) to see which pages bring the most estimated visitors. Then look for:
- Keywords ranking in positions 4–15 — these are often the easiest wins. A small content or on-page improvement can push them onto page one.
- Keywords with high volume but low position — potential opportunities if the topic is relevant.
- Irrelevant keywords — if you rank for something off-topic, it may signal thin or mismatched content.
Write down 5–10 of the position 4–15 keywords. These become your first optimization targets.
Step 3: Find Your Best and Weakest Pages
Open Top Pages. This ranks your URLs by estimated organic traffic.
Look for two things:
- Your top performers — understand what topics and formats work. Can you create more content like this?
- Pages with traffic but poor rankings — these may need on-page fixes (title, headings, internal links).
If a page gets zero traffic and targets a topic you care about, it's a candidate for a rewrite or consolidation.
Step 4: Run a Technical Site Audit
Now move to Site Audit. This crawls your site and flags technical and on-page issues.
- Click Site Audit → New project.
- Enter your domain and set crawl settings (default is usually fine for a small site).
- Start the crawl and wait for it to finish.
Once complete, you'll see a Health Score and a list of issues grouped by category.
Which Issues to Fix First
Not all issues are equal. Prioritize in this order:
| Priority | Issue type | Why it matters |
|---|---|---|
| 1 | Broken links (404s) | Bad for users and crawl efficiency |
| 2 | Pages blocked from indexing | They can't rank at all |
| 3 | Missing or duplicate title tags | Directly affects click-through and relevance |
| 4 | Slow-loading pages | Affects experience and rankings |
| 5 | Thin content | Low value to users and search engines |
Ignore low-impact warnings (like minor meta description length) until the big items are handled.
Step 5: Turn Findings Into a To-Do List
You now have raw data. Convert it into a short, actionable list. Example:
- Fix 3 broken links found in Site Audit.
- Rewrite title tags on 5 pages with duplicate titles.
- Improve 4 pages ranking in positions 6–12 by adding missing subtopics and internal links.
- Remove or update 2 thin pages with no traffic.
Keep the list to 5–10 items max for your first audit. Finishing a short list beats starting a long one.
Common Beginner Mistakes
- Chasing every red flag. Site Audit flags many minor issues. Fix what affects rankings and users first.
- Trusting estimates as exact numbers. Ahrefs data is modeled, not measured from your analytics.
- Auditing a huge site too early. Start small to learn the interface.
- Ignoring search intent. A page can be technically perfect but still fail if it doesn't match what searchers want.
- Forgetting to re-crawl. After fixes, run Site Audit again to confirm improvements.
Where to Go Next
Once your first audit is done:
- Compare with competitors using Site Explorer's Competing Domains and Content Gap reports.
- Track keyword rankings over time with Rank Tracker.
- Explore backlink opportunities in the Backlinks and Link Intersect reports.
- Set up recurring Site Audit crawls so new issues surface automatically.
Your first audit isn't about perfection — it's about building a repeatable habit: enter a target, read the key reports, pick the highest-impact fixes, and act. Do that once a month and your site's health compounds.
What Is a Nigerian 419 Scam and How Do You Recognize and Avoid It?
A Nigerian 419 scam is an advance-fee fraud: someone promises you a large sum of money, a prize, an inheritance, or a lucrative deal, then invents reasons why you must send smaller payments first to "unlock" it. The name comes from section 419 of the Nigerian Criminal Code, which covers this kind of fraud, and the 419 Coalition — a counter-fraud site established in 1996 — describes it as Nigerian Advance Fee Fraud and transnational crime. The pattern is not limited to Nigeria or to email; it shows up in romance contacts, fake purchase orders, and stranded-traveler stories. The rule that protects you is simple: never pay to receive money you were promised.
How the scam works
Advance-fee fraud runs on one engine: you pay first, and the promised payout never arrives. The pitch is the bait; the fee is the product.
Typical sequence:
- Contact — an unexpected email, message, or social media approach, often claiming to be an official, a lawyer, a businessperson, or a romantic interest.
- The hook — a large benefit is dangled: lottery winnings, an unclaimed inheritance, a share of a fortune that needs a foreign account, an overpayment that must be refunded, or a purchase order for goods.
- The ask — a smaller, urgent payment is required: "processing fees," "taxes," "legal costs," "customs," or a "good-faith deposit."
- Escalation — once you pay, new obstacles appear, each with its own fee. The total climbs.
- Disappearance or conversion — contact stops, or you are recruited into receiving and forwarding money for others.
The 419 Coalition's framing is useful here: this is organized transnational crime, not a lone trickster, which is why scripts, documents, and follow-up stories are often polished.
Common hooks to recognize
| Hook | What it looks like | The tell |
|---|---|---|
| Lottery or prize | "You've won a draw you never entered" | You cannot win a lottery you did not enter |
| Inheritance | A distant relative or stranger left you money | Real estates do not cold-contact beneficiaries by email |
| Overpayment | A "buyer" or "employer" sends too much and asks for a refund | The original payment later bounces or is reversed |
| Romance | Weeks of affection, then a crisis needing money | The emergency always requires your transfer |
| Fake purchase order | A large order for goods, with fees requested up front | Legitimate buyers do not charge sellers to be paid |
| Stranded traveler | A friend or relative "stuck abroad" needs urgent funds | Verify through a second channel before acting |
The FBI has documented purchase-order variants that leave a trail of victims, and the Canadian Anti-Fraud Centre classifies these as advance-payment scams — both are consistent with the same core mechanism.
Red flags in the first message
- Urgency and secrecy — "act within 48 hours," "keep this confidential."
- Upfront payment — any fee, tax, or deposit before you receive anything.
- Payment methods that are hard to reverse — wire transfers, gift cards, crypto, or money-transfer apps.
- Spoofed official documents — letters with logos, "certificates," or government letterheads that cannot be verified independently.
- Inconsistent details — changing names, mismatched grammar, or a story that shifts when questioned.
- Pressure to move off-platform — from a dating app or marketplace to private email or messaging.
One red flag is enough to stop. You do not need to prove it is a scam to decline.
How to verify before you send anything
Do not verify by replying to the sender or using contact details they gave you. Verify independently:
- Check the email headers — the visible "From" name can be forged; the routing information often reveals a different origin.
- Check the domain — a domain registered days or weeks ago is a strong warning sign for an "official" organization.
- Search the exact wording — scam scripts are reused; a phrase search often surfaces identical reports.
- Contact the real institution — call the bank, regulator, or company using a number you look up yourself, not one from the message.
- Consult anti-fraud sources — the 419 Coalition, the FBI's fraud pages, and the Canadian Anti-Fraud Centre publish current patterns and reporting routes.
If a "prize" or "inheritance" cannot be confirmed through an independent channel, treat it as nonexistent.
If you are targeted or already involved
If you have not paid:
- Stop contact. Do not reply, argue, or negotiate.
- Do not send money, personal data, or identity documents.
- Preserve the messages and report them.
If you have paid or shared information:
- Contact your bank or payment provider immediately — speed matters for reversals.
- Report to your local anti-fraud agency and, where relevant, the platform used.
- Change passwords and watch for identity misuse if you shared documents.
- Warn others, especially if the contact came through a shared community, workplace, or dating platform.
If you were asked to receive or forward money: This is the money-mule role. Moving funds for someone else — even unknowingly — can expose you to legal liability and to having your accounts frozen or closed. Stop, keep records, and seek advice from your bank or a qualified professional before doing anything further.
Why people get pulled in
Victims are not naive by definition. The scripts exploit real human levers: hope of a windfall, loneliness, authority, urgency, and the sunk-cost effect — once you have paid something, paying a little more to "recover" it feels rational. Understanding this is part of avoiding it: the moment you feel pressure to pay to unlock a benefit, that pressure is the scam.
The durable defense is a single rule. Money that is genuinely yours never requires an upfront fee, a gift card, or a wire transfer to a stranger to release it.
Website Overview
The available information shows a mix of normal operation and configuration gaps. Depending on how the website is used, these gaps may affect secure access or the consistency of its public presentation.
Domain and Registration
Transfer-protection status is present, helping reduce the risk of unauthorized domain transfers. The domain uses the common .au extension, which is not an independent safety signal.
DNS and Email
The lowest TTL is 20 seconds, supporting rapid record changes at the cost of more frequent lookups. Nameservers are provided by Amazon Route 53, indicating managed DNS hosting. MX records point to the Microsoft 365 email service. SPF and DMARC are configured. DKIM status is unknown. TXT records include verification markers for Microsoft. Such markers may also remain after a service stops being used.
TLS and Certificates
The public key uses EC with 256 bits. The server supplied a complete certificate chain. No organization name is present in the certificate; the available fields are consistent with domain validation. The certificate was issued by Let's Encrypt, commonly associated with automated certificate services. The certificate's total validity is about 89 days, consistent with a short renewal cycle.
HTTP and Browser Security
The response lacks these common security headers: Referrer-Policy, Permissions-Policy. No X-Powered-By header was found, reducing one common source of backend fingerprinting information. No obvious internal addresses or debug information were found in the headers. No explicit CDN or WAF marker was found in the response headers. No CORS permission header was found, so browsers normally restrict cross-origin script access.
Technology Stack Analysis
Unknown
Search and Social Sharing
Unknown
Hosting and Email
Registration details
| Registrar | Department of Finance |
|---|---|
| Registered | Unknown |
| Expires | Unknown |
| Domain status | client delete prohibited、server renew prohibited、client update prohibited |
| Nameservers | ns-1101.awsdns-09.org、ns-1916.awsdns-47.co.uk、ns-434.awsdns-54.com、ns-934.awsdns-52.net |
| DNSSEC | unsigned |
DNS records
| Type | Name | Value | TTL | Priority |
|---|---|---|---|---|
| A | a160.b.akamai.net | 23.213.26.196 | 20 | — |
| A | a160.b.akamai.net | 23.213.26.202 | 20 | — |
| MX | scamwatch.gov.au | scamwatch-gov-au.mail.protection.outlook.com | 300 | 10 |
| NS | scamwatch.gov.au | ns-1101.awsdns-09.org | 172800 | — |
| NS | scamwatch.gov.au | ns-1916.awsdns-47.co.uk | 172800 | — |
| NS | scamwatch.gov.au | ns-434.awsdns-54.com | 172800 | — |
| NS | scamwatch.gov.au | ns-934.awsdns-52.net | 172800 | — |
| TXT | scamwatch.gov.au | MS=ms88820054 | 300 | — |
| TXT | scamwatch.gov.au | Scamwatch | 300 | — |
| TXT | scamwatch.gov.au | v=spf1 include:sge.net include:spf.protection.outlook.com -all | 300 | — |
| CNAME | www.scamwatch.gov.au | accc.edgesuite.net | 300 | — |
| DMARC | _dmarc.scamwatch.gov.au | v=DMARC1; p=reject; rua=mailto:[email protected]; ruf=mailto:[email protected]; | 300 | — |
TLS and certificates
HTTP response headers
| Header | Value |
|---|---|
| content-type | text/html; charset=UTF-8 |
| content-language | en |
| cache-control | public, max-age=300 |
| strict-transport-security | max-age=15768000 |
| content-security-policy | font-src 'self' https://fonts.gstatic.com https://themes.googleusercontent.com data:; script-src 'self' https://heatmaps.monsido.com https://*.google-analytics.com https://*.googletagmanager.com https://www.gstatic.com https://embed.typeform.com cdnjs.cloudflare.com https://app-script.monsido.com https://cdn.jsdelivr.net https://polyfill.io https://unpkg.com https://www.google.com translate.google.com; script-src-attr 'self' 'unsafe-inline'; script-src-elem 'self' 'unsafe-inline' https://heatmaps.monsido.com https://*.googletagmanager.com https://*.google-analytics.com https://www.gstatic.com https://embed.typeform.com cdnjs.cloudflare.com https://app-script.monsido.com https://cdn.jsdelivr.net https://polyfill.io https://unpkg.com https://www.google.com translate.google.com; style-src 'self' 'unsafe-inline' https://*.googletagmanager.com https://fonts.googleapis.com https://embed.typeform.com https://cdn.jsdelivr.net https://unpkg.com; frame-ancestors 'self' |
| x-frame-options | SAMEORIGIN |
| x-content-type-options | nosniff |
Identified technologies
Technology stack: Unknown
Pages, Search and Sharing
| Meta description | Scamwatch is a website run by the Australian Competition and Consumer Commission (ACCC), and provides information to consumers and small businesses about how to recognise, avoid and report scams. |
|---|---|
| Canonical URL | Not detected |
| Language | English (default) |
| Twitter Card | Not detected |
Social Sharing Preview
1 fieldsrobots.txt (opens in a new tab)
HTTP 403Unknown
Sitemaps
0No sitemaps found
Recent Updates
- Domain Registration
- TLS and certificates
- DNS Information
- Pages and Search Information
- HTTP Response Information
- Website profile
- Website Description
- Website Name
- Website profile
- Website Description
- Website Name
User reviews (0)