Mostbet logo

Fake Mostbet apps, mirrors and phishing pages

Because betting sites are blocked in Bangladesh, people search for new addresses and apps every week, and scammers use that. Fake mirrors copy the design of a real site to steal passwords and deposits; fake APK files can take over your phone. Here is how to recognise them.

See the warning signs

Updated by The Millennium Falcon

Cover for the guide on fake betting apps and phishing mirror sites

How the scheme works

A fake mirror is a page that looks exactly like a betting site: the same logo, colours and buttons. It is built for one purpose, to collect what you type. Some copies only steal the login and password; others also show a fake cashier where your deposit goes straight to the scammer. Fake apps go further: once installed, they can read SMS codes, show fake payment screens or open your wallet app in the background.

Links to such copies are spread through Facebook groups, Telegram chats, YouTube comments, SMS and paid search ads. They often promise a "new working link", an "unblocked app" or a "bonus that only works today".

Warning signs of a fake mirror

  • The address has small differences: an extra letter, a hyphen, an unusual ending such as .top, .xyz or .click.
  • The link came from a stranger in a private message, not from a source you used before.
  • The login page asks for your wallet PIN, an OTP code or your NID number.
  • After login the balance and bet history are empty or look different.
  • The cashier asks you to send money to a personal bKash or Nagad number.
  • The page pushes urgency: "bonus ends in 10 minutes", "last working link".

Fake APK files and mod versions

Files called "mod APK", "hack version", "unlimited balance" or "Aviator predictor" are the most dangerous. No app can change game results or add money: results are decided on the operator's or game provider's servers. What such files can do is ask for access to SMS, accessibility services or "display over other apps". With these permissions an app can read one-time codes and approve wallet transfers without you noticing.

If an app asks for access to SMS or accessibility services to "activate a bonus", delete it at once. No betting or casino app needs these permissions.

How to check a link before you open it

  1. Copy the address and read it letter by letter. Compare it with the one you used before.
  2. Search the exact domain name together with the word "scam" or "phishing".
  3. Check the domain age with a WHOIS service: a domain registered a few days ago is a red flag.
  4. Never log in from a link received in a chat. Type addresses yourself or use bookmarks.

If you already entered your password

  1. Change the password on the real account and on any other site where you used the same one.
  2. If you entered a wallet PIN or OTP, call your wallet provider's official helpline from the app and ask to block the account.
  3. Delete the fake app, then check the phone's list of apps with accessibility or SMS permissions.
  4. Write down the address of the fake site, screenshots and transaction IDs. Our page on what to do after a scam explains the next steps.

Keep in mind that online gambling itself is prohibited in Bangladesh; see the law explained. The safest way to avoid these traps is not to look for betting sites at all.

FAQ

How do I know if a betting mirror is fake?

Check the exact address, where the link came from, and whether the site asks for wallet PINs, OTP codes or payments to a personal number. Any of these is a strong sign of a fake.

Are mod APK versions of betting apps real?

No. Results are decided on the server, so no app can change them. Mod APK files are used to steal logins and wallet access.

What should I do if I entered my password on a fake site?

Change the password everywhere you used it, contact your wallet provider if you shared a PIN or code, and remove any app you installed from that source.

Read also