It's 9:15 pm in Bangalore. The Mumbai Indians are chasing 162 against Chennai, you've got ₹2,000 riding on the chase, and the Wi-Fi at your flat drops for a second. You fumble for the FairPlay app, but the icon's buried in a folder. Muscle memory types "fairplay" into Chrome, hits enter, and a login screen appears. Looks right. Green header. Same font. You punch in your mobile and OTP. Nothing happens. The spinner just spins. Ten minutes later Hardik Pandya finishes it with a six — your bet would have paid. You try the app proper, log in fine, but the balance is unchanged. The site you visited wasn't FairPlay. It was a mirror that harvested your credentials.
Why the URL bar is your first line of defence
Phishing kits are cheap. A scammer buys a domain like fairplay-login-in.com, copies the HTML, swaps the form action to their own server, and pushes the link through WhatsApp forwards, Telegram channels, or even sponsored Google ads. The page loads fast because it's static. The only thing they can't fake — not without a valid TLS certificate for the real domain — is the address bar. That's why the single most reliable check costs you zero rupees and takes two seconds: read the URL from right to left.
Most people read left to right. They see "fairplay" somewhere in the string and relax. Attackers know this. They stuff the brand name into subdomains, paths, or query parameters: security-fairplay.com.verification.phishersite.net, or fairplay.com.phishersite.net/login. The browser highlights the registered domain (the eTLD+1) in a slightly darker shade, but on mobile Chrome the highlight is subtle. If you train yourself to jump straight to the rightmost label before the first slash — the true hostname — you'll catch every clone.
Read the domain right to left — the habit that stops clones
Take a real FairPlay address: https://fairplay.com/sports/cricket. Start at the far right of the hostname. The last label before the TLD is "fairplay". The TLD is "com". That's it. The registered owner of fairplay.com controls everything to the left — subdomains like m.fairplay.com, api.fairplay.com, blog.fairplay.com. Anything else is noise.
Now look at a typical fake: https://fairplay-india-login.verification-services.xyz/account. Read right to left. TLD: "xyz". Second-level: "verification-services". Third-level: "fairplay-india-login". The brand name sits in a subdomain three levels down. The actual owner is whoever registered verification-services.xyz. That's not FairPlay. Close the tab.
Another variant: https://fairplay.com.phishersite.net/. Right to left: TLD "net", second-level "phishersite", third-level "com", fourth-level "fairplay". The domain is phishersite.net. The "fairplay.com" part is just a subdomain label. It means nothing.
Practise on your phone now. Open Chrome, tap the address bar, and say the labels out loud backwards: "com — fairplay". Do it five times a day for a week. It becomes automatic. When you're tired, half-watching a Punjab Kings match in Mohali, your fingers will still type the right thing and your eyes will still check the right spot.
Common FairPlay lookalikes and what gives them away
Scammers rotate domains fast. By the time a list is published, half are burnt. But the patterns stay the same. Watch for these structures:
- Brand in subdomain: fairplay.login.secure-access.top, fairplay.bet.verification.click
- Brand with hyphens in second-level: fairplay-india.com, fairplay-betting.net, fairplay-login.org
- Brand plus TLD variation: fairplay.in.net, fairplay.co.in.phishersite.com
- Brand plus action words: fairplay-withdrawal.com, fairplay-deposit.xyz, fairplay-bonus.club
- Punycode homographs: fаirplay.com (Cyrillic 'а'), fairplаy.com (mixed script) — Chrome usually shows these as xn-- strings, but not always on older Android WebViews
If you're ever unsure, open a fresh incognito tab and type the address manually: fairplay.com. No search. No copied link. Bookmark the real landing page after you've verified it once. The FairPlay homepage loads clean, shows the current IPL markets, and the padlock icon matches the organisation name in the certificate details.
Mobile app users have it easier. The FairPlay app from the official site pins the certificate. Even if DNS is hijacked on a public Wi-Fi at a Delhi cafe, the app will refuse to connect. But the web version is what most people hit first — especially when a friend forwards a "special bonus" link at 11 pm during a Kabaddi final.
What to do if you've already clicked a bad link
Don't panic. If you entered credentials on a fake site, change your password immediately from the real app or site. Use a different device if you can — malware on your phone could be logging keystrokes. Enable two-factor authentication if you haven't. FairPlay supports OTP via SMS and Google Authenticator; turn both on.
Check your transaction history. Look for deposits or withdrawals you didn't make. UPI mandates show up in your bank app instantly. If something looks off, contact your bank's fraud helpline first, then reach out to FairPlay customer support with the exact URL you visited, a screenshot if you have one, and the approximate time. They can flag the phishing domain upstream.
Clear browser data for that domain. On Chrome Android: Settings → Privacy → Clear browsing data → Advanced → Site settings → View permissions and data stored across sites → search the fake domain → delete. This removes any session cookies the phisher might try to replay.
Report the link. Forward it to the National Cyber Crime Reporting Portal (cybercrime.gov.in) and to FairPlay via their contact page. The more reports, the faster registrars and browsers blacklist the domain.
Make the right-to-left glance a reflex
You wouldn't hand your wallet to a stranger wearing a FairPlay t-shirt. Don't hand your login to a domain wearing the FairPlay name in a subdomain. The address bar is the only source of truth the browser gives you for free. Read it right to left. Every time. Whether you're on Jio 5G in Mumbai, Airtel fiber in Hyderabad, or a spotty hotspot at a dhaba outside Pune. The match won't wait. Your money shouldn't either.
Next time you open the FairPlay login screen, pause. Glance up. Say "com — fairplay". Then tap. That two-second habit is the difference between watching the chase with a live bet and watching it with an empty account.
More on how we approach numbers is on about FairPlay, and the tools for setting your own limits are on responsible gaming.