Check the URL bar
The URL bar should show iplfantasylive.com as the domain. Watch for look-alike domains: ipl-fantasy-live.com, iplfantasylive.net, etc.
How to verify the official IPL Fantasy Live site.
Phishing and copycat sites are common in the fantasy sports industry. Here's how to verify you are on the real site.
Official website
How to verify you are on the official IPL Fantasy Live site.
Phishing and copycat sites are common in the fantasy sports industry. This page explains how to verify you are on the official IPL Fantasy Live site, and what to do if you land on a suspected copycat.
Official domain: The only official IPL Fantasy Live domain is iplfantasylive.com. We do not operate any other domain. Any other site claiming to be IPL Fantasy Live is not affiliated with us.
Check the SSL certificate
The padlock icon in the URL bar confirms an SSL certificate is in place. Click the padlock to view the certificate issuer and the registered domain.
Bookmark the official site
Once you have verified the URL, bookmark it in your browser. Use the bookmark for future visits - never follow a link in a promotional email or SMS without verifying.
Use the mobile app
For routine use, the mobile app is the most reliable way to access the platform. Download it from the official App Store or Google Play listing, not from a link in an email or SMS.
Reporting a copycat site
How to flag a suspected phishing or copycat site.
If you suspect a copycat
Copycat and phishing sites often mimic a real brand's look and feel, but use a slightly different domain. If you land on a site that looks like IPL Fantasy Live but the URL is not iplfantasylive.com, do not enter any personal information.
How to report
Report the suspected site to the CERT-In (Indian Computer Emergency Response Team) via the official phishing-reporting page. You can also report to Google Safe Browsing and Microsoft SmartScreen if the site is impersonating our brand.
What we will do
If you send us the suspected URL via our contact page, we will review it within 48 hours and, where appropriate, request takedown action through CERT-In and the hosting provider.
Common phishing tactics
Three patterns the desk sees most often.
Phishing sites evolve quickly, but the underlying tactics stay the same. Here are the three most common patterns.
📧
Email phishing
An email that looks like it is from a legitimate brand, with a link to a copycat site. The email may claim your account is locked, your KYC needs updating, or you have won a prize.
📱
SMS phishing
An SMS claiming to be from a legitimate brand, with a short link. SMS is a particularly common phishing vector in India because most users trust SMS more than email.
🔍
Search engine ads
Copycat sites that buy Google Ads targeting the legitimate brand's name. The ad looks like the real site, but the URL is different. Always check the URL bar, not just the ad copy.
What to do if you clicked a phishing link
Damage-control steps.
If you have already clicked a phishing link and entered personal information, work through these steps in order.
Disconnect from the network
If you entered KYC details, disconnect from the network immediately. The phishing site may be exfiltrating data in real time.
Document the URL and screenshot
Take a screenshot of the URL bar and the page you landed on. This evidence is useful for reporting.
Change passwords on any account that shares the same password
If you used the same password on any other account, change those passwords immediately. Use unique passwords going forward.
Monitor your bank statements
If you entered bank account details, monitor your statements for unauthorised transactions. Contact your bank immediately if you see any.
Report the incident
Report the URL to the legitimate brand (us, in this case), to CERT-In via the official portal, and to Google Safe Browsing if the URL appears in search results.
Browser bookmarks
The simplest defence against phishing.
The single most effective defence against phishing is a browser bookmark to the legitimate site. Once you have bookmarked iplfantasylive.com, use the bookmark - never a search engine link or an email link.
Bookmark in your browser
Open the site, click the star icon in the URL bar, save the bookmark to your bookmarks bar. Pin it for one-click access.
Add to home screen
On iOS Safari, tap the share button and choose "Add to Home Screen". On Android Chrome, tap the menu and choose "Add to Home Screen". This creates a one-tap icon on your phone's home screen.
FAQ
Common official-site questions.
What is the official IPL Fantasy Live domain?
The only official domain is iplfantasylive.com. We do not operate any other domain.
Does IPL Fantasy Live have a mobile app?
We do not currently publish a mobile app. The site is mobile-optimised and can be added to your home screen as a PWA for quick access.
How do I know if a promotional email is from IPL Fantasy Live?
All official emails come from an @iplfantasylive.com address. We will never ask for your password or KYC documents via email.
What if I entered my details on a copycat site?
Change your password immediately on any account that shares the same password. If you entered KYC details, contact the relevant app's customer support to flag the incident.
SSL certificates
How to verify the SSL certificate.
Every legitimate website has an SSL certificate issued by a trusted certificate authority. Here is how to verify it.
Look for the padlock icon
The padlock icon in the URL bar confirms an SSL certificate is in place. Most browsers also show "Connection is secure" when you click the padlock.
Click the padlock for details
Click the padlock to view the certificate issuer, the issuing certificate authority, and the registered domain. The issuer should be a recognised certificate authority like Let's Encrypt, DigiCert, or Comodo.
Check the registered domain
The certificate should be issued for the exact domain you are visiting. A certificate for a different domain is a strong red flag.
Check the validity period
SSL certificates have a validity period - typically 90 days for Let's Encrypt or 1 year for paid certificates. An expired certificate is a red flag.
Browser bookmarks
The simplest defence against phishing.
Once you have verified the official domain and SSL certificate, bookmark it in your browser. Use the bookmark for future visits - never a search engine link or an email link.
Bookmark in your browser
Open the site, click the star icon in the URL bar, save the bookmark to your bookmarks bar. Pin it for one-click access.
Add to home screen
On iOS Safari, tap the share button and choose "Add to Home Screen". On Android Chrome, tap the menu and choose "Add to Home Screen". This creates a one-tap icon on your phone's home screen.
SSL certificates
How to verify the SSL certificate.
Every legitimate website has an SSL certificate issued by a trusted certificate authority. Here is how to verify it.
Look for the padlock icon
The padlock icon in the URL bar confirms an SSL certificate is in place. Most browsers also show "Connection is secure" when you click the padlock.
Click the padlock for details
Click the padlock to view the certificate issuer, the issuing certificate authority, and the registered domain. The issuer should be a recognised certificate authority like Let's Encrypt, DigiCert, or Comodo.
Check the registered domain
The certificate should be issued for the exact domain you are visiting. A certificate for a different domain is a strong red flag.
Check the validity period
SSL certificates have a validity period - typically 90 days for Let's Encrypt or 1 year for paid certificates. An expired certificate is a red flag.
Browser bookmarks
The simplest defence against phishing.
Once you have verified the official domain and SSL certificate, bookmark it in your browser. Use the bookmark for future visits - never a search engine link or an email link.
Bookmark in your browser
Open the site, click the star icon in the URL bar, save the bookmark to your bookmarks bar. Pin it for one-click access.
Add to home screen
On iOS Safari, tap the share button and choose "Add to Home Screen". On Android Chrome, tap the menu and choose "Add to Home Screen". This creates a one-tap icon on your phone's home screen.
Mobile PWA
Add the site to your home screen.
For mobile users, the simplest way to access the official site is to add it to your phone's home screen as a PWA (Progressive Web App). One tap, no browser UI.
Add to Home Screen
Open the site in Safari, tap the share button (square with an arrow), scroll down and tap "Add to Home Screen". The site appears as an icon on your home screen.
Install App
Open the site in Chrome, tap the three-dot menu, tap "Add to Home Screen" or "Install App". The site appears as an icon on your home screen.
Reporting channels
Where to report a suspected phishing site.
Three reporting channels for suspected phishing sites that impersonate IPL Fantasy Live or related brands.
🇮🇳
CERT-In
The Indian Computer Emergency Response Team accepts phishing reports via the official portal. Reports are reviewed within 48 hours and, where appropriate, takedown action is requested.
🔍
Google Safe Browsing
Google's Safe Browsing programme accepts phishing reports via the official report form. Reported sites are flagged in Chrome and other Google services.
🛡
Microsoft SmartScreen
Microsoft's SmartScreen filter accepts phishing reports for sites that target Microsoft Edge users. Reports are reviewed within 24 hours.