Report abuse

A person reads every report. We answer within 48 hours, and we act on clear violations without waiting to be asked twice.

[email protected] CSAM and imminent threats are escalated immediately.

What to send us

The more of this you include, the faster we can act. The first item alone is enough to start.

  • The full URL. Including the subdomain and the path, for example https://abc123.tunnels.host/login.html
  • The date and time, with a timezone. Tunnels are temporary. A timestamp lets us find the session in our logs even after the URL has gone.
  • What you saw. A sentence is enough. "A fake Instagram login form" tells us what to look for.
  • A screenshot, if you have one. Useful when the page is already gone by the time we look.

You do not need an account with us, and you do not need to identify yourself.

What happens next

When we confirm a violation of our Terms of Service, we do all of the following.

  1. Terminate the tunnel, so the URL stops serving at once.
  2. Suspend the account behind it.
  3. Revoke its API tokens and active sessions, so it cannot simply reconnect.
  4. Record the action, the reason and the evidence in an audit log.

We do not require a court order to act on a clear violation of our own Terms.

What we prohibit

The full list is in our Terms of Service. These are the ones most often reported.

  • Credential harvesting. Fake login pages, credential interception, and man-in-the-middle attacks.
  • Phishing, spam and fraud. Including brand impersonation.
  • Malware distribution.
  • Child sexual abuse material. Zero tolerance. Accounts are terminated immediately and reported to the National Center for Missing & Exploited Children and the Canadian Centre for Child Protection.

For registries, registrars and law enforcement

Please write to us before suspending a domain. We answer, and we act.

tunnels.io is a tunneling service. Our users run a client on their own machine, and we give them a temporary public URL that forwards to it. Subdomains are generated per session and are user-created. We do not author, host or control the content served through a tunnel, and a subdomain that served abuse yesterday belongs to nobody today.

That is why a report to [email protected] removes the content faster than a domain-level action. A suspension of the parent domain also removes service for unrelated customers who have no connection to the report, including small businesses serving their own websites through us.

We can supply, on request: database audit records, server logs with timestamps, and written confirmation of the account suspension.