Scams to Avoid: Cloned Domains That Look Exactly Like the Real Site
A cloned site is the cheapest fraud to build: copy the pages, register an address that differs by a hyphen, and wait for people to type their login. This page explains how to tell, then covers the scams that usually arrive alongside it. TAYA365 is an independent guide, not a casino; it takes no deposits, runs no games and cannot vouch for any site using a similar name. 21+.
What a clone is
A clone reproduces a real operator's design on a different domain. It may show working games in demo mode, a familiar logo and even the genuine licensee's licence number in the footer. The cashier, however, belongs to whoever registered the address. Deposits go to them. Logins typed there are tried on the real site minutes later.
Clones are cheap to replace. When one address is reported and taken down, the same pages reappear on another within days, which is why the defence has to be a habit on your side, the bookmark and the list check, rather than a hope that the fakes get removed.
Some clones go further and relay your login to the genuine site in the background, so that the balance and history you see are real while every deposit you make is diverted.
How clones reach you
- Paid search ads that sit above the genuine result.
- Links in Facebook comments, Telegram groups and SMS.
- QR codes on posters or in videos.
- 'New link' or 'backup link' messages claiming the usual address is under maintenance.
- Typing errors: a missing hyphen or a different ending lands on a squatter.
Notice that none of these routes involves you typing the address you already know. Clones depend on being handed to you. An address you entered yourself, or opened from a bookmark you made after checking, is the one route they cannot occupy.
Reading the address bar
| What you see | What it may mean | Action |
|---|---|---|
| An extra or missing hyphen, digit or letter | A typosquat registered to catch mistakes | Close it and use your bookmark |
| Same name, different ending (.vip, .win, .net, .ph) | A different owner entirely; endings are separate registrations | Check that exact domain against the regulator's list |
| Brand name as a subdomain of something else | The real domain is the part just before the ending | Read the address from right to left |
| A padlock icon | Only that the connection is encrypted; clones have padlocks too | Do not treat it as proof of identity |
| Licence number in the footer | Possibly copied from the genuine licensee | Match corporate name and domain on PAGCOR's list |
Claims a clone makes
| Claim | Why it is false | What to do |
|---|---|---|
| 'This is our new official link' | Licensed operators do not migrate players through chat messages | Verify on the regulator's list; keep using the address you bookmarked |
| 'Log in again to keep your balance' | A balance lives on the operator's servers and is not lost by ignoring a message | Do not log in from the link; change your password on the real site |
| 'Deposit here to unlock your pending withdrawal' | Withdrawals are not released by further deposits | Pay nothing; contact support inside the genuine site |
| 'Download the updated app from this page' | An installer from a clone is a fake build | Do not install; see the operator's own domain for app information |
Scams that travel with clones
Fake agents on Telegram and Facebook point victims at cloned sites or ask for transfers to personal wallets. Phishing pages collect a wallet number, MPIN and one-time code under the pretext of a prize. Predictor apps claim to see the next spin and deliver malware instead. Advance-fee demands, labelled tax or clearance, block a withdrawal that was never going to be paid. The common thread is that money or credentials are sent somewhere other than the verified operator's own cashier.
What a real KYC request never asks for
Identity verification is a legal duty for casinos under anti-money-laundering rules, so an ID and a selfie submitted in your account area are expected. A genuine request stops there. It does not ask for:
- An e-wallet MPIN, banking password or card security code.
- A one-time code read out to a person or pasted into a chat.
- A 'verification deposit' or any fee to process documents.
- ID photos sent to a private messaging account.
- Screen sharing or a remote-control app.
If you entered details on a clone
- Go to the genuine site through your own bookmark and change the password immediately.
- If you typed wallet details or a code, change the wallet MPIN and review recent transactions.
- Report any unauthorised transfer through the wallet's in-app help centre straight away.
- Save the cloned address and screenshots; they are the evidence a report needs.
If you uploaded an ID or selfie to the clone as part of a fake verification step, keep a record of the date and the address. Identity documents can be reused to open accounts elsewhere, so mention the upload when you report, and be alert to messages about accounts or loans you did not apply for.
Where to take it
Work upward in this order. First, the operator's own support, reached from inside its verified site, so the brand knows it is being impersonated. Second, your e-wallet's in-app helpline for anything involving a transfer; do not use a phone number supplied in a message. Third, PAGCOR's published complaint channel on the regulator's website, which also handles reports of unlicensed sites misusing a licence. Fourth, the cybercrime route: the PNP Anti-Cybercrime Group or the NBI Cybercrime Division. Scam reports can additionally go to the CICC's Inter-Agency Response Center on hotline 1326.
Frequently Asked Questions
Is taya-365.win itself an operator's site?
No. This is an information guide. It has no login, no cashier and no games, and it cannot confirm who runs any other site with a similar name.
Does HTTPS mean the casino site is genuine?
No. The padlock shows the connection is encrypted. Fraudulent sites obtain certificates as easily as honest ones.
How do I know which domain is the licensed one?
Find the operator's corporate name in its terms, look that name up on PAGCOR's published list, and compare the domain listed there with your address bar character by character.
A site says the old link is blocked and gives a new one. Should I use it?
Not on the strength of the message. Check the regulator's list first. 'Backup link' messages are a standard way clones recruit.
Can I get money back from a cloned site?
Recovery is unlikely once a transfer is authorised, but a fast report through your wallet's in-app help centre and to the authorities gives the best chance and helps shut the site down.