Report

Send us what you saw

Phishing messages, impersonation of any brand, credential-harvesting pages, or anything targeting an identity system. threat@uniauth.id

Before anything else

Capture first. Analyse second.

Screenshot the message before deleting it, and copy the address as text rather than retyping it. Campaign infrastructure is often live for hours, not days — by the time a report is written, the evidence frequently no longer exists. A screenshot with a visible timestamp is worth more than a careful description written afterwards.

What helps most

The full message, unedited. Including the sender ID or number, and any tracking parameters in the link. Details that look irrelevant are often what ties two campaigns to one operator.
When you received it. With a timezone. Timing is frequently what proves two waves are the same operator rather than a copycat.
What you did next. Including if you tapped something. Nobody is judged for that here — it also tells us what the page did on a real device, which we often cannot see any other way.
Whether anything happened to an account. Approximate is fine. We never publish anything that identifies a person or an account.

Please don’t

Open the link again to check it. Many of these pages fingerprint the visitor and behave differently on a second visit, or serve nothing at all once they have seen you. You can destroy the evidence by looking at it.
Send credentials, seed phrases or recovery codes. Not even partially, and not even to show what was asked for. We never need them, and we will delete them unread.
Wait until you are certain. An uncertain report sent within the hour is more useful than a confident one sent tomorrow.

What we do with it

We analyse it, report the infrastructure to whoever can act — registrar, DNS provider, host, and the impersonated brand — and where it is useful to others, we publish an advisory. Advisories name infrastructure and never victims. If you reported something, we will not connect you to it publicly, and we will not confirm to anyone that a given report came from a particular person.

If you would rather we published nothing at all, say so and we will keep it to the abuse reports.

Before anything else

Capture first. Analyse second.

What helps most

The full message, unedited. Including the sender ID or number, and any tracking parameters in the link. Details that look irrelevant are often what ties two campaigns to one operator.

When you received it. With a timezone. Timing is frequently what proves two waves are the same operator rather than a copycat.

What you did next. Including if you tapped something. Nobody is judged for that here — it also tells us what the page did on a real device, which we often cannot see any other way.

Whether anything happened to an account. Approximate is fine. We never publish anything that identifies a person or an account.

Please don’t

Open the link again to check it. Many of these pages fingerprint the visitor and behave differently on a second visit, or serve nothing at all once they have seen you. You can destroy the evidence by looking at it.

Send credentials, seed phrases or recovery codes. Not even partially, and not even to show what was asked for. We never need them, and we will delete them unread.

Wait until you are certain. An uncertain report sent within the hour is more useful than a confident one sent tomorrow.

What we do with it

If you would rather we published nothing at all, say so and we will keep it to the abuse reports.