How can I tell a phishing website from the real lobby?

Read the hostname in the address bar letter by letter. A copy has the same logo and layout but a different hostname, and it often arrives through a message you did not ask for.

Can a phishing website have the padlock?

Yes. The padlock shows that the connection is encrypted, not who runs the site, so use it together with the hostname check.

Ano ang gagawin ko kung nailagay ko na ang password ko?

Palitan agad ang password sa tamang site na tina-type mo mismo ang address, at palitan din ito saanman mo ito ginamit. Pagkatapos, i-report ang site.

89PHP Phishing Website: Signs From Google and CISA

In this section
Fact	Value
89PHP How to Report a Scam Website in the Philippines, Step by Step	Save the address and screenshots, report the transaction to your wallet, then call hotline 1326 and file with the NBI or the PNP Anti-Cybercrime Group.
89PHP HTTPS Meaning	HTTPS means the connection between your browser and the site is encrypted.
89PHP Registered Brand	A registered brand is a brand name and web address that PAGCOR itself prints on one of its published lists.
89PHP Safe Browsing Setup for Android and iPhone	In Chrome on Android or iPhone, tap More, Settings, Privacy and security, Safe Browsing, then choose Enhanced or Standard protection.
89PHP Short Link and URL Redirect	A short link is a brief address that forwards your browser to a longer one.
89PHP Telegram Channel Check	Reach a brand's Telegram channel from the brand's own page, look for Telegram's verification badge, and compare the username letter by letter.

A phishing website is a page built to look like a site you already use, so that you type your login, your password or a code into it. Google describes phishing as deceptive emails, messages, ads or sites that look similar to sites you already use. When the copy is of a casino lobby, the prize for the person behind it is your account and the wallet linked to it. Start with the general routine in how to check a legit site, then use the signs below.

How a phishing website copies a casino lobby

A copy needs no clever code. The person behind it saves the logo, the colours and the layout of a lobby and places them on a hostname they control. A login form on the copy looks the same as the real one, but it keeps what you type instead of signing you in.

Three parts of the copy do the work:

The same logo and page layout, which make the page feel familiar.
A different hostname in the address bar, which is the part nobody bothers to copy.
A form that keeps your mobile number, your password and any code you type.

CISA, the United States cyber agency, gives a plain example of the hostname trick: an incorrect link such as amazan.com in place of the real name. The same single-letter swap works on any casino name.

Red flags that give a phishing website away

Look at the address first, then at what the page and the message ask of you. The table pairs each sign with the check that settles it.

Red flag	What to check
Hostname off by one character, an extra word or a different ending	Compare it letter by letter with an address you saved from a source you trust
A message saying staff contacted you first	The 89PHP lobby’s own Tagalog notice says customer service staff do not contact players first
A request for a one-time code	The same notice says never to share an account, a password or a one-time code
Urgent or emotional language, such as an account closing today	CISA lists urgent language and dire consequences as a common sign
A shortened link in the message	CISA lists untrusted shortened URLs; open the short link page before you tap
A red “Dangerous site” screen in Chrome	Google says to stay away when Chrome shows that warning

Treat any one of these as enough to stop. A page can pass four checks and fail the fifth. Perfect spelling proves nothing: CISA notes that some phishing emails now have perfect grammar and spelling.

What a phishing page asks for

A copy of a login page asks for what the real one asks for, plus a little more. The extras are where it gives itself away.

Your mobile number and password, which is what the real login panel also asks for.
A one-time code sent to your phone. No staff member or support chat needs it from you.
A wallet PIN, card details or a “verification payment”. Apple’s phishing guidance says never to enter security codes into a page someone directs you to.
A fee to release winnings or to reopen an account.

What to do if you typed your details

Act in the order below, quickly. The point is to cut off access before the person behind the copy uses it.

Close the page and go back to the lobby only through an address you typed or saved yourself.
Change your password on the real site. Google’s account-recovery help says to change the password on every other site where you used the same one.
If you typed a one-time code or a wallet detail, open your wallet’s own help route and report it. The reporting routes are laid out in how to report a scam website.
Turn on two-step sign-in where it exists; Apple’s phishing page says to do this after you may have entered details on a scam website.
Block the sender, and keep screenshots of the page, the address and the message for your report.

Where phishing travels: messages and channels

The link rarely comes from a search. It comes in a text, an ad or a chat, with a reason to hurry. A message in a channel or from a “support” account is the same kind of bait, so read how to tell a real Telegram channel from a copy before you reply to one. PAGCOR also warned on 29 June 2026 about gaming sites that use its logo and fabricated certificates, so a picture of a certificate is not proof of anything.

89PHP Phishing Website Red Flags: How a Lobby Gets Copied