Report Abuse

Phishing, malware, and unauthorized access violate our Terms of Service. We investigate suspected abuse, ban abusive accounts, and work with security vendors and ISPs to take down phishing and malware campaigns.

Email abuse@ngrok.com with the endpoint URL and a description of what you observed. Report the specific page or connection involved so our team can identify the activity. Include the following details when available:

The full URL, including the path, or the hostname and port for a non-HTTP connection.
The date, time, and time zone when you observed the activity.
What happened, such as a request for credentials, a malware download, or an unauthorized connection.
Relevant screenshots, detection names, or log excerpts, with unrelated personal data and secrets removed.
For an ngrok agent that you didn't install, the authtoken from its configuration file or command line. The authtoken identifies the account behind the agent, so we can disable it.

Use evidence you already have. You don't need to enter credentials, download a suspicious file, or revisit a site to submit a report. Don't send your own passwords, ngrok authtokens, API keys, or unredacted configuration files.

When you report abuse by email, you receive a confirmation that your report has been submitted and is under review. A dedicated team reads and triages every report and takes action against abusive accounts and endpoints.

A report helps us investigate activity on ngrok. If you also suspect a compromised device or account, contact your IT or security team to address the local incident.

How we combat abuse

Detection and investigation

Automated systems monitor edge traffic and account activity in real time, and disable abusive accounts and endpoints without waiting for human review. Our abuse team investigates what automation doesn't catch, using reports from users and third-party security researchers.

Enforcement and cooperation

We ban abusive accounts and work with security vendors and ISPs to take down phishing and malware campaigns. Researchers and fraud prevention teams can submit reports through our abuse reporting API. Contact abuse@ngrok.com to discuss access for a high volume of reports.

Controls that discourage misuse

Free accounts must add a valid payment method before they can use TCP endpoints. We also show a browser warning before HTML content served through free-tier endpoints. It identifies ngrok as the service that carries the connection and reminds visitors to trust the sender before entering sensitive information.

The warning is not a certification that a site is safe, and its absence does not establish that a site is trustworthy. See the browser warning documentation for when it appears.

Found ngrok on your device?

ngrok is legitimate software, but an authentic binary can still be used without your permission. Check who installed it, which services it connects, and whether that use is authorized before you allowlist an antivirus alert. Our installation assessment guide covers publisher verification, running processes, startup services, and suspected misuse.

Reporting a vulnerability in ngrok

For a vulnerability in ngrok itself, contact security@ngrok.com. For phishing, malware, or other misuse of an endpoint, use abuse@ngrok.com. Our security page describes the platform's security controls and shared responsibilities.