Phishing is the most common way players lose an account. Nobody guesses the password; the player types it into a page that only looks official. Because the platform uses several legitimate domains, scammers count on people assuming that any address with a familiar logo is just another mirror. The checks below take the guesswork out of it.
Check 1: Compare the exact domain with the verified list
This is the only check that settles the question on its own. Look at the address bar, not the page content, and compare the domain character by character with the verified URL directory. You can also paste the address into the checker on the home page, which strips "https://" and "www." and compares what is left.
Pay special attention to:
- Extra or swapped characters: a doubled letter, a number in place of a letter, or two characters transposed.
- Hyphens and add-ons: words like "login", "bonus", "vip" or "official" added to the name.
- Different endings: the same name on .top, .xyz, .site, .vip or another extension that is not on the list.
- Subdomain tricks: a familiar name placed in front of an unrelated domain, such as familiar-name.unrelated-site.com. Only the part right before the final extension counts.
Check 2: Notice how you got the link
Genuine players rarely receive a login link out of nowhere. Be suspicious of links that arrive in a message from someone you have not spoken to before, links posted under videos promising a "new bonus site", and adverts that open straight onto a login screen. A bookmark you created after verifying the domain yourself is far safer than any link sent to you.
Check 3: Watch what the site asks for first
A genuine sign-in asks for your mobile number and password, and sometimes a verification code sent by text. A phishing page often pushes for more, or asks in the wrong order:
- a deposit before you can log in or "activate" the account;
- your bank PIN, card CVV or UPI PIN on a form rather than inside your own banking app;
- the one-time code you just received, typed into a chat window or pop-up;
- permission to install a separate app before you can see the lobby.
Check 4: Follow the money
On the real platform, deposits go through the payment screens inside your account and the transaction appears in your history with a reference number. Fake sites tend to give themselves away at this point: they show a personal UPI ID or a QR code with a private individual's name, ask you to send a screenshot to a chat agent, or move you to a payment page on yet another domain. Any of these is a reason to stop.
Check 5: Test the offer against common sense
Copy sites need a reason for you to choose them over the address you already use, so they advertise something the real platform does not: unusually large sign-up bonuses, "guaranteed" prediction results, unlimited gift codes, or a "VIP server" with better odds. Game results are random and no website can predict them. If the main attraction is a promise of easy money, you are almost certainly on the wrong site.
Check 6: Look for the account you already have
Every verified domain opens the same account. If you already play, log in from a bookmark you trust and compare. On a genuine mirror your balance, user ID and transaction history are identical. A page that says your account "needs migration", shows a zero balance with a message about transferring funds, or rejects your correct password and then asks for a code is not a mirror.
Check 7: Downloads and support contacts
Fake sites often push an APK download early, because an installed app can read messages and capture codes. Only install the app by following the official app download steps from a verified domain. The same goes for support: fake sites list their own Telegram or WhatsApp contacts. The official channels are listed on the customer care page.
What scammers do with a stolen login
Understanding the goal makes the warning signs easier to spot. Once someone has your number and password, and especially a one-time code, they typically try to change the bank account bound for withdrawals, withdraw whatever balance is there, and then use the account to send more fake links to your contacts or agent network. Some keep the account quiet and wait for your next deposit. That is why a quick reaction matters more than anything else.
If you already entered your details on a fake site
- Change your password now, from a domain on the verified list or the official app. If you used the same password anywhere else, change it there too.
- Check your bound withdrawal details in the account area. If they have changed, contact customer service immediately.
- Contact in-app customer service with your user ID, the fake address and the time you used it. Never send your new password.
- If you paid money on the fake site, report it to your bank or UPI app straight away and keep screenshots of the payment and the page.
- Warn whoever sent you the link; their account or phone may be compromised.
A simple routine that prevents almost all of this
Verify a domain once, bookmark it, and use only that bookmark or the installed app from then on. When a bookmark stops working, come back to the verified list rather than searching for a new link or asking in a group. It sounds basic, but nearly every phishing loss starts with a link that someone clicked instead of their own bookmark. For the normal sign-in steps, password resets and code problems, see the login guide.