Recognising clone and scam sites

Anything of value on the internet acquires a copy, and gambling brands are among the most copied. Clone sites reproduce the design of a well-known platform on a similar domain, collect login details and card data on convincing forms, and vanish. Recognising one takes seconds once you know what to look at.

This page covers the practical checks, the common lures and what to do if you have already entered details.

The domain is the first thing to read

A clone cannot use the genuine domain, so it alters it subtly: a character replaced, an extra word, a different ending, or a hyphen inserted where none belongs. Read the address bar character by character, from the beginning to the ending, before typing anything.

The ending is the part most often missed. A familiar brand name with an unfamiliar country code is a warning, not a variation. Bookmarking the genuine address once is the simplest permanent defence.

How a clone page feels wrong

Copying a website is easy; copying it completely is not. Clones usually have broken links, images that do not load, missing page sections, a login form that posts nowhere, or text in a language that does not match the brand's usual voice. Small inconsistencies accumulate into an obvious picture.

A genuine encrypted connection is necessary and not sufficient. Certificates are free, so a padlock on a clone proves only that the clone bought a certificate.

The classic lures

• A message claiming your account is blocked and needs verification.
• An offer that promises guaranteed winnings or a working system.
• A request to install an application from a link in a chat.
• A support agent who asks for a code or remote access.
• A login page reached from an advertisement rather than typed.

The guaranteed win is the most reliable single indicator. No legitimate operator can promise a gambling result, because no one controls a random outcome.

Checks that take under a minute

Working through these five checks in order catches the great majority of clones, and none of them requires any technical tooling.

If you have already entered details

Change the password immediately from a device you trust, then check the recovery details on the account, because those are the first thing an attacker alters. Review recent transactions and active sessions, and report the clone to the genuine operator's support so the domain can be investigated.

If card details were entered, contact the card issuer and ask for the card to be blocked and reissued. Speed matters: the sooner a card is blocked, the smaller the exposure.

Building the habit

Type the address or use your own bookmark, and never arrive at a login page through a message, a search advertisement or a social post. When a message creates urgency, treat the urgency itself as the warning sign rather than as a reason to act quickly.

It also helps to remember what a real operator's communications look like. Genuine notifications tend to tell you to log in yourself rather than to follow a link to enter credentials.

Reporting and aftercare

Reporting a clone helps other people: the operator can pursue the domain, and a regulator can add it to a warning list. The report costs a few minutes and does not require you to have lost anything.

If details were entered, the aftercare order matters more than the reporting. Change the password, secure the recovery channel, review transactions and sessions, then deal with the card issuer if payment data was involved.

It is also worth telling anyone who might have received the same message. Clone campaigns are sent in bulk, and a warning to a group chat prevents the next person from making the mistake you just avoided.

In short

Clones are detected by the address bar, the arrival route and the promises on the page. A wrong domain ending, a login page reached from a message, or a claim of guaranteed winnings each identifies the site on their own. Type the address, read it closely, and never enter credentials on a page a message sent you to.