--- title: How ngrok Actively Combats Phishing Attacks | daily.dev description: Ngrok explains its layered defenses against phishing abuse of its tunneling service: unauthenticated users cannot serve HTML, free accounts get an interstitial... canonical: https://daily.dev/posts/how-ngrok-actively-combats-phishing-attacks-lkj4a8x20 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: How ngrok Actively Combats Phishing Attacks | daily.dev og:description: Ngrok explains its layered defenses against phishing abuse of its tunneling service: unauthenticated users cannot serve HTML, free accounts get an interstitial... og:url: https://daily.dev/posts/how-ngrok-actively-combats-phishing-attacks-lkj4a8x20 og:image: https://api.daily.dev/og/posts/Lkj4A8X20.png og:image:alt: How ngrok Actively Combats Phishing Attacks og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # How ngrok Actively Combats Phishing Attacks **[ngrok Blog](https://daily.dev/sources/ngrok)** · 4 min read · 0 upvotes · 0 comments ## Summary Ngrok explains its layered defenses against phishing abuse of its tunneling service: unauthenticated users cannot serve HTML, free accounts get an interstitial warning page plus fuzzy-matching content scans that auto-ban suspicious accounts, and an abuse email address is available for reports. Enterprise customers get custom domains, IP restrictions/ACLs, and observability tooling to further lock down agent access. The post also addresses why hackers are drawn to ngrok's simplicity and argues that, used correctly, ngrok poses no significant security risk to organizations. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does ngrok prevent free accounts from being used for phishing? Unauthenticated ngrok users are blocked entirely from serving HTML content over HTTP tunnels, with their IP address embedded in the URL and headers. Free authenticated accounts can serve HTML but every visitor sees a warning interstitial page naming the hosting IP, and ngrok runs fuzzy matching on HTML content to detect phishing patterns and auto-ban offending accounts. _daily.dev surfaces security writeups like this for teams hardening their tunneling and ingress setups._ ### What can I do if I find a phishing site hosted on ngrok? Email abuse@ngrok.com with the specific link being used in the attack. Ngrok states it will review the report and ban the account if it is confirmed to be hosting phishing pages. _developers tracking abuse-reporting workflows for third-party services can find similar guides on daily.dev._ ### How can enterprise customers restrict who can use their ngrok tunnels? Ngrok Enterprise customers can configure a custom domain for agents, blocking the default tunnel domains so only traffic through their preferred addresses is allowed; agents attempting to connect outside the approved account are blocked. They can further lock things down with IP restrictions and access control lists (ACLs), so a compromised token can't be used to start endpoints from other IP addresses. _teams securing remote access tooling often compare these lockdown options on daily.dev._ --- Tags: [#security](https://daily.dev/tags/security), [#devtools](https://daily.dev/tags/devtools), [#phishing](https://daily.dev/tags/phishing) [View this post on daily.dev](https://daily.dev/posts/how-ngrok-actively-combats-phishing-attacks-lkj4a8x20) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"How ngrok Actively Combats Phishing Attacks","url":"https://daily.dev/posts/how-ngrok-actively-combats-phishing-attacks-lkj4a8x20","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/how-ngrok-actively-combats-phishing-attacks-lkj4a8x20"},"datePublished":"2026-08-23T07:21:33.507Z","dateModified":"2026-08-23T07:28:42.274Z","description":"Ngrok explains its layered defenses against phishing abuse of its tunneling service: unauthenticated users cannot serve HTML, free accounts get an interstitial...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/fb955ede9f062179fa91003abc86b119?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/fb955ede9f062179fa91003abc86b119?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"ngrok Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"ngrok Blog","logo":"https://media.daily.dev/image/upload/s--718XXxvE--/f_auto,q_auto/v1787469610/logos/ngrok?_a=BAMAMicg0","url":"https://daily.dev/sources/ngrok"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/how-ngrok-actively-combats-phishing-attacks-lkj4a8x20","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,devtools,phishing","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"ngrok Blog","item":"https://daily.dev/sources/ngrok"},{"@type":"ListItem","position":3,"name":"How ngrok Actively Combats Phishing Attacks"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/how-ngrok-actively-combats-phishing-attacks-lkj4a8x20#faq","mainEntity":[{"@type":"Question","name":"How does ngrok prevent free accounts from being used for phishing?","acceptedAnswer":{"@type":"Answer","text":"Unauthenticated ngrok users are blocked entirely from serving HTML content over HTTP tunnels, with their IP address embedded in the URL and headers. Free authenticated accounts can serve HTML but every visitor sees a warning interstitial page naming the hosting IP, and ngrok runs fuzzy matching on HTML content to detect phishing patterns and auto-ban offending accounts. daily.dev surfaces security writeups like this for teams hardening their tunneling and ingress setups."}},{"@type":"Question","name":"What can I do if I find a phishing site hosted on ngrok?","acceptedAnswer":{"@type":"Answer","text":"Email abuse@ngrok.com with the specific link being used in the attack. Ngrok states it will review the report and ban the account if it is confirmed to be hosting phishing pages. developers tracking abuse-reporting workflows for third-party services can find similar guides on daily.dev."}},{"@type":"Question","name":"How can enterprise customers restrict who can use their ngrok tunnels?","acceptedAnswer":{"@type":"Answer","text":"Ngrok Enterprise customers can configure a custom domain for agents, blocking the default tunnel domains so only traffic through their preferred addresses is allowed; agents attempting to connect outside the approved account are blocked. They can further lock things down with IP restrictions and access control lists (ACLs), so a compromised token can't be used to start endpoints from other IP addresses. teams securing remote access tooling often compare these lockdown options on daily.dev."}}]} ```