Cili88 Review 2026
— One Name, Five Sites, a Dead Licence Number

Desk research, checked 28 August 2026: built from the Cili88-branded sites we could read, the licensor’s own closure notice, the Curaçao regulator’s public register, and infrastructure evidence we had already mapped for other brands. We did not register an account, deposit, or request a withdrawal, so nothing below is a first-hand test result.

Most Malaysia-facing brands hide their licensing behind a picture. Cili88 does something rarer: it publishes an actual number. The footer of cili88my.vip reads “Licence: Gaming Curacao 8048/JAZ”.

A number is checkable — which is the whole point of a licence. This one fails twice over. 8048/JAZ was never Gaming Curaçao’s reference; it belonged to Antillephone N.V., a different master licensee. And both of those master licences are gone: Gaming Curaçao’s 365/JAZ expired on 18 August 2024, Antillephone’s 8048/JAZ ended in late 2024 (its own validator notice puts the termination at 1 November 2024, other sources at 28 November — either way it cannot be current), and Curaçao scrapped the master-licence model altogether on 24 December 2024.

Verdict: 2/10 — blacklist candidate. That matches the score we gave Telur33, MyTown33 and SpinCity99 for displaying a dead Curaçao seal, and Cili88 arguably earns it more directly, because it published a specific reference rather than just a picture.

What is Cili88?

Cili88 (cili = chilli, hence the “pedas” branding) is a Malaysia-facing gambling brand offering slots, live casino, sportsbook, fishing games and 4D. Its marketing runs almost entirely on free-credit and welcome-bonus figures.

The complication is that there is no single Cili88. Searching the brand name in Malaysia surfaces at least five live properties carrying it, and they do not agree with each other about anything material — not the bonus, not the minimum deposit, not even whether an app exists.

We report those figures as published; we are not asserting which is true. That is exactly the problem. A player who reads RM888 at 150% and lands on the RM30 free-credit funnel has not been told the same thing twice.

Two contradictions are worth isolating because they are not rounding errors:

• Minimum deposit: RM50 or RM1. cili88my.vip says “Deposit from RM50”; a third-party review says RM1. That is a fiftyfold spread on the single number a cautious first-timer cares about most. Neither figure is verified — both come from marketing pages, and we could not read a logged-in cashier screen to settle it. Treat both as unconfirmed and read the cashier total on screen before you authorise anything.
• The app. The Syukur668 listing advertises a “Free Credit App RM18”. cili888.net runs a section headed “download Cili88 mobile apps” with Android and Apple buttons — and then, further down the same page, states: “Currently, Cili88 doesn’t offer this option.” Both download buttons are also malformed, pointing at a http://https:// address that cannot resolve at all.

The licence number does not match the licensor

Curaçao never had one gambling licensor. Until the law changed it had four master licensees, each with its own reference: Cyberluck 1668/JAZ, Gaming Curaçao (Gaming Services Provider N.V.) 365/JAZ, Curaçao Interactive Licensing 5536/JAZ and Antillephone 8048/JAZ. An xxxx/JAZ number is not automatically a Gaming Curaçao reference — and 8048/JAZ is not one. It is Antillephone’s. The Cili88 footer has stapled one licensor’s name to another licensor’s number.

Even read charitably, both halves are dead:

1. Gaming Curaçao’s 365/JAZ expired on 18 August 2024. Its own domain now serves a closure notice stating that use of its logo or licence after that date is not supported or endorsed by the Curaçao government.
2. Antillephone’s 8048/JAZ ended in late 2024. Antillephone’s own validator notice puts the termination at 1 November 2024; other sources give 28 November. Either date puts it well outside 2026.
3. The whole model was superseded. The National Ordinance on Games of Chance (LOK) came into force on 24 December 2024, ending master-licensee sub-licensing. Licences are now issued directly by the Curaçao Gaming Authority (CGA).

So 8048/JAZ is not a licence that is hard to check. It is a reference that cannot be current in 2026, in a format today’s regulator no longer issues.

What you can check yourself, in about two minutes. The CGA runs a live certificate checker at cert.cga.cw and a public licensee register at cga.cw. A genuine CGA seal clicks through to cert.cga.cw and returns the licensed company’s legal name, its current status and the exact domain covered. A seal that opens a PDF, an image, or nothing at all is not a licence.

Two honest limits on our own check. First, no Cili88 property we could read names a corporate entity, a registered address or a company number, so there is nothing to search a register with — we could not verify a current licence for Cili88 under any name. Second, the CGA register lists licensed companies, not brands or domains, so the absence of a “Cili88” row would not by itself prove anything either way. The finding here is the published reference, not a missing row.

The “iTech Labs” RNG-audit badge sits in the same position. iTech Labs is an ISO-accredited testing house, not a licensor, and it publishes no public client register we could search; no certificate is linked from the page making the claim. That makes the badge not publicly verifiable — which is not the same as false, and we are not calling it false.

Shared infrastructure: two networks and a self-declared partnership

This is where Cili88 stops looking like one small brand.

The Cloudflare Images account. Cloudflare Images gives every account a fixed hash that appears in the URL of every image it serves. The hash P9OFiVM18PAr1SvRwzgU7w already served fifteen Malaysia-facing sites as of 24 August 2026, mapped in our Malaysian casino doorway networks investigation — among them MyTown33 and Gardenia888. Every image on cili888.net is served from that same account, which makes a sixteenth site.

cili888.net then closes the loop by itself. Its “visit the promotions page” link points at mibox8888.com, already on our list. Its closing paragraph tells readers to explore “other alternatives mentioned on designbookfair.com” — the single most revealing entry in that investigation, a domain that presents as a design event and resolves to a casino login page. And its calls to action run through clickylinks.net, the shortener used by nine sites in the set. A Cili88 page recommending two other members of the same image account is not independent commentary; it is the network’s internal link graph, visible.

The BunnyCDN pull zone. cili88.com and cili88.live both serve their social-share image from xt30sf.b-cdn.net — the same single pull-zone hostname recorded on Telur33, Mahkota8, GK9 and LKB8. Cili88 is the first brand we have observed on both documented networks.

The self-declared one. Cili88’s own pages are tagged “Powered by Syukur668 Partnership”, and the Syukur668 partner roster publicly lists Cili88 alongside MyTown33 — a brand already inside the image account, by a completely different route.

Our standing wording rule applies and we mean it: this evidences shared infrastructure, not common legal ownership. No registry source names a company behind any of it. But if you are choosing between Cili88, MyTown33 and Telur33 believing you are spreading your risk across three operators, the choice may be narrower than it looks.

The practical consequence is the one that investigation ends on: the site you researched may not be the site that takes your money. On cili88my.vip this is not even hidden. Every Login and Register button on the page, including the one under “Claim Your RM888 Welcome Bonus”, navigates to kaya88my.com. You read Cili88’s terms and you open a Kaya88 account.

Payments

Across the Cili88 properties we could read, the advertised rails are the standard Malaysian set — Touch ’n Go eWallet, DuitNow QR, DuitNow transfer, FPX with Maybank, CIMB, Public Bank and RHB, Boost and GrabPay — plus, less standard, USDT on TRC20 and ERC20. There is nothing wrong with the list itself; our e-wallet casino guide covers how these rails should work.

Two cautions are specific to Cili88. The minimum deposit is contradicted between RM50 and RM1, so do not plan a small test deposit around the lower figure. And a crypto rail sitting alongside consumer e-wallets is worth noticing on a site with no verifiable licence: USDT transfers are irreversible and sit entirely outside the Malaysian banking dispute process, which a bank transfer or e-wallet payment does not.

Before you send money anywhere, run the payee’s account number, company name or phone number through PDRM’s free Semak Mule portal. If a casino asks you to pay a personal bank account rather than a company one, stop there.

Bonus terms: where the red flags are

cili88my.vip publishes the only complete bonus terms we could read, and two of its own selling points are the warnings.

The rollover basis is not stated. It advertises 150% up to RM888 with a 10× rollover, but never says whether the 10× applies to the bonus alone or to deposit plus bonus — and that omission changes the number enormously. To max the offer you would deposit RM592, which returns RM888 in bonus for RM1,480 in the account:

Same headline, RM5,920 of difference. An operator that leaves this ambiguous on its own promo page has left itself room to pick at cashout. Our wagering and rollover explainer works through why this single ambiguity decides most bonus disputes, and our guide to bonus terms worth refusing covers the rest of the shape.

“No max bet cap.” The page states plainly that there is no max-bet cap during rollover, so high-stake Buy Bonus play is allowed while clearing the bonus. Almost every operator imposes a max-bet rule precisely to stop that, and breaking one is the industry’s most common ground for voiding a win after the fact. A site advertising the rule’s absence is either genuinely unusual or describing a term that will be enforced differently once there is a balance to pay out. Our bonus terms glossary explains what a max-bet clause normally does.

The RTP claim is unconfirmed. The site states that Pragmatic Play’s Gates of Olympus 1000, Starlight Princess 1000 and Sugar Rush 1000 all run at “publisher-certified 96.5%+ RTP”. We have not been able to confirm that against Pragmatic’s published certification, so treat it as an operator claim rather than a fact. Operators can and do configure Pragmatic titles to lower RTP bands, and the figure that matters is the one in the game’s own info panel at the moment you play, not the one on a landing page — our Pragmatic Play hub explains how to read it.

Player complaints

Third-party reports are mixed and none of it is traceable to a named individual, so we report it as what it is: unconfirmed. Aggregator and review sites variously report withdrawals “within 5 minutes to 1 hour” and “1–3 business days”; one URL-reputation scanner rates a cili88.org domain at 48/100 with generic warnings about delayed payouts.

We found no substantiated, documented complaint we could verify, and no Cili88 property publishes a complaints or dispute-resolution route. Treat the absence of complaints as absence of evidence, not evidence of safety — brands on this infrastructure rotate domains faster than complaint histories accumulate.

Verdict and rating rationale

2/10, a blacklist candidate. Five things pushed it past watchlist:

1. A licence reference published as current that pairs one licensor’s name with another’s number — and both expired in 2024.
2. The sign-up funnel on one property routing to an entirely different brand.
3. Welcome offers published at RM888, RM200, RM30 and RM10 across properties carrying the same name.
4. A fiftyfold contradiction on minimum deposit, unresolved on any page we could read.
5. Presence on two separately documented shared-infrastructure networks, plus a self-declared partnership linking it to a third brand.

Brands we have judged unsafe on the evidence are collected on our Malaysia blacklist, and the free-credit offers that keep surfacing under names like this one are picked apart in our free credit casino guide.

If you have already deposited and cannot withdraw

1. Check the payee account at Semak Mule, PDRM’s mule-account database. A personal bank account rather than a company account is the single loudest red flag in Malaysian online gambling.
2. Call the National Scam Response Centre on 997. The two government listings disagree on its hours — the NFCC’s own NSRC page says 8.00am to 8.00pm daily, while malaysia.gov.my says 24 hours — so if it does not answer, call your bank’s own 24-hour fraud line instead.
3. Lodge a police report at the nearest station within 24 hours as well. Official sources still conflict on whether the 997 call alone is enough, so do both.

More brands we are watching are collected in this month’s Scam Watch.