Fake .gov.in Domains Hosting Yono Game Downloads

This isn’t a hypothetical warning. While checking where Yono Games and Yono Rummy downloads are hosted, we found real, currently observable download pages for platforms including Hi Rummy and Yono Rummy hosted on subdomains carrying Indian government-style addresses — including patterns matching Andaman & Nicobar administration and Ministry of Health and Family Welfare domains, and a “new version” listing on a Maharashtra government-style address. None of these are official government services. They appear to be subdomains that were compromised, misconfigured, or otherwise misused to host unrelated gaming-app downloads.

Why this matters more than a generic warning

A .gov.in address carries real, earned trust — it’s the kind of domain people are taught to treat as authoritative. That’s precisely why it’s valuable to whoever set these pages up: the address itself does work that the content on the page hasn’t earned. It probably also explains why searches for “yono games” so often turn up alongside unrelated government portal names (LSGD Kerala, GFMS, AP/MP Gov, Webland): the compromised pages sit on those portals’ own domains. It’s more likely evidence of the same underlying pattern: gaming-app promotion piggybacking on government domain trust, at scale.

How to recognize this pattern

• A gaming app download hosted on any address ending in .gov.in, or on a subdomain of one, is not more trustworthy for it — treat it as the opposite. Real government services do not host third-party gaming APKs.
• Look at the full domain, not just whether “gov” appears somewhere in it. A subdomain like yono-rummy-new-version.gam.maharashtra.gov.in is using a real government domain’s authority for unrelated content.
• Urgency language (“limited time,” bonus amounts, “verify now”) on a page using this kind of address is a stronger signal of a problem, not a weaker one.

What to do if you’ve already used one of these

Treat any information you entered — passwords, phone numbers, payment details — as potentially exposed, and follow the incident-response steps rather than prevention-only advice: change reused passwords, monitor the relevant accounts, and don’t reuse the same credentials elsewhere. See our APK safety checklist and login safety checklist for the fuller versions of this guidance.

We’re publishing this because it’s a concrete, current finding from our own research, not a generalized caution — and because it gives a real answer to a question this site’s own methodology raised: why so many search queries around this space accidentally include government portal names in the first place.

New domains confirmed, October 2026

Checking download sources for specific platforms in this directory (Rumble Rummy, Jaiho91) turned up five more examples of this exact pattern, each found as a live Google search result rather than inferred: ap.gov.in/online/yono-all-games-indo-rummy-apk-19533t3.htm, ap.gov.in/uono/all-rummy-yono-app-download-apk-4613t1.htm, rummy91.games.maharashtra.gov.in, rumble-rummy.gam.maharashtra.gov.in, and wb.gov.in/apps-jaiho-91.html (a second West Bengal subdomain, wb.gov.in/apps-rumble-rummy-yono, also appeared). That’s three different state government domain families — Andhra Pradesh, Maharashtra, and West Bengal — confirmed hosting this exact pattern across just two of the fourteen platforms in this directory, which strongly suggests the pattern is systemic across Indian state government infrastructure rather than a handful of isolated incidents.

Note the repetition within a single state, too: Maharashtra and West Bengal each had two separately-pathed subdomains turn up independently, for two different game names. Whatever is being exploited to host this content doesn’t appear to be a one-time compromise of a single page — it looks closer to a repeatable method being applied across multiple subdomains.