Ekatoto mirrors and payment safety

A mirror is an alternative address showing the same site. Because gambling sites are blocked by Komdigi in Indonesia, alternative addresses circulate widely. This page does not explain how to reach blocked sites. It focuses on the risk that comes with them: cloned sites built to steal balances and personal data.

The legal position first

Blocking gambling sites is part of how Indonesia enforces its prohibition on gambling. Reaching a blocked site does not change the legal status of the activity. We say so plainly so that nobody mistakes an alternative address for a safe route.

Why alternative addresses are risky

Anyone can build a site that looks identical, with the same logo, colours and buttons. The difference is behind the scenes: payments go to a fraudster's account, and the login details or KTP you enter end up with someone else. Links like these travel through chat groups, private messages and social media comments.

Signs of a clone

• An address that differs by a letter or two from the one you know.
• Deposit instructions pointing to a personal bank account or wallet.
• Requests for a PIN, a one-time code or a crypto recovery phrase.
• Promotions that are too large and too urgent.

Check the merchant name before paying

A QRIS or e-wallet confirmation screen shows the name of the merchant receiving the money. Read it before entering your PIN. If it is a private individual's name or one you do not recognise, cancel. A payment already sent to a fraudster is almost impossible to recover.

PINs and OTPs are never shared

A legitimate operator never needs your wallet PIN, a one-time code or your banking password. Anyone asking for them, by chat, phone or web page, is trying to take your money.

Messages from an "admin"

A message claiming to come from an admin or agent, offering a new address with a special bonus and urging you to deposit to a particular account, is a very common scam pattern. Ignore it, do not click the link, and block the number if needed.

If you have already paid

Contact your bank or wallet provider straight away, report the transaction, and change your passwords and PIN. Keep all evidence; documentation tips are on the complaints page.

Your KTP

A KTP photo uploaded to a clone can be misused to open online loans or other accounts in your name. Upload documents only on an account you are sure is genuine, and never send them by private message.

Simple safe habits

Bookmark the address you trust and do not open links from messages. Turn on transaction notifications in your wallet and banking apps so any payment you do not recognise shows up immediately. Use different passwords for the casino account and for your email or banking.