89PHP Legit Site Checks: Tell a Real Page From a Copy

A legit site is one you have checked yourself before typing a password or sending money, not one that merely looks right. Copies of gaming lobbies are easy to build, so the logo, the colours and even the padlock prove nothing alone. These seven checks take a few minutes, and each one has a page behind it.

Legit site checks at a glance

Run the checks top to bottom and stop at the first one that fails.

Read the address bar before anything else

A copy usually lives at an address that looks close to the real one. Take a made-up brand, examplebrand.com. Copies tend to look like these:

1. examplebrand.co, one letter dropped.
2. examplebrand-login.com, a word added.
3. examp1ebrand.com, a digit swapped for a letter.
4. examplebrand.com.promo-page.net, where the real name sits in front but the page belongs to the last two parts.

Read the hostname only up to the first slash. Its last two parts, such as promo-page.net in the fourth case, show who the page belongs to. If you typed the address yourself from a source you trust, such as the 89PHP link list, you already skipped the biggest trap.

Secure website: what the padlock proves and what it does not

A secure website, in the browser’s sense, is one whose connection is encrypted. Chrome’s own help page says its security symbol tells you whether Chrome has established a secure and private connection with a site. That is the whole claim.

Anyone can get an encrypted connection for any address they own, including a copy. So the padlock answers “can others read this traffic?” and leaves “is this the brand I mean?” open.

Short links, forwarding and mirror claims

A short link is a brief address that sends your browser on to a longer one. Gaming brands, chat groups and ads use them because they fit in a message. Scammers use them for the same reason, since the real destination is hidden until you open it.

Three habits help:

1. Press and hold the link to preview its destination before you open it.
2. After the page loads, read the address bar again, because the final address is the one that counts.
3. Treat a message that calls a new address “the mirror” as a claim to check, not a fact.

The longer version is on the page about reading a short link safely.

Switch on your browser’s Safe Browsing setting

Chrome offers three protection levels: Enhanced, Standard and No protection. Standard is the default, and Chrome’s help page says Enhanced adds protection from new dangers as well as known ones. On iPhone, Safari has a Fraudulent Website Warning switch under Settings, Apps, Safari.

A red screen reading “Dangerous site” is the browser telling you the address is on a list of risky pages. Go back. The menu paths for Android and iPhone are on the Safe Browsing setup steps.

Check the regulator’s own published lists

PAGCOR publishes two lists, each dated “as of October 8, 2026” on the copies this site read on 12 October 2026. One covers accredited gaming system administrators with their registered brands and domain names. The other covers the approved registered brands and domain names of licensed casinos.

To use a list, search it for the brand and then for the exact hostname you are on. If the brand and hostname are not there, the list gives you nothing to rely on, so keep checking before you register or pay. A logo or a certificate picture on a page proves nothing, because PAGCOR warned on 29 June 2026 that fake sites were using its logo with fabricated licence certificates.

The look-up method is on the registered brand look-up page. For the 89PHP brand, the walk-through is on the 89PHP legit check.

Phishing signs and real versus fake channels

CISA lists the common signs: urgent or emotional language, requests for personal and financial information, untrusted shortened URLs, and incorrect email addresses or links. Apple’s guidance adds a rule worth keeping: never enter a password or security code into a page someone sent you to.

The 89PHP lobby carries the same rule in its notice window, in Tagalog. It says customer service staff do not contact you first, and that you should never share an account, a password or a one-time code. A message that breaks that rule is a copy, whatever name or logo it carries.

Spotting a copy page is covered in how a phishing website copies a lobby, and impostor groups in telling a real Telegram channel apart.

Report a copy and keep your play in check

If you entered a password on a copy, change it on the real page first and anywhere else you reused it. Then report the copy. A useful report carries four things:

1. The full address as it appeared in the bar.
2. A screenshot of the page and of the message that sent you there.
3. The time you opened it.
4. What you typed or sent, such as a mobile number, a password or a payment.

The routes are on how to report a scam website.

A calm, careful routine also helps your play. Set a limit before you open any lobby, and read the responsible play pages for the helplines they carry.