Kedai888 Review
— Lab Badges Where the Licence Should Be

Desk research, checked 1 October 2026. Built from the page source and promotion data of Kedai888’s own lobby, its terms page, public domain-registration records, the Curaçao and Anjouan licence registers, the lobbies of three sister brands, and the other sites that carry the Kedai888 name.

Kedai888’s own lobby is a full casino site in English and Bahasa Malaysia, priced in ringgit, and served identically from kedai888g.com and four other addresses. It opens normally in a browser, so this review quotes it directly.

Where a licence would normally sit, the footer prints this instead: “KEDAI888 is an official verified partner in the 888 Partnership network.” Beside it, under the heading SIJIL & KESELAMATAN (certificate and security), are five badge images: two game-testing labs, two fraud-screening tools and an SSL sticker. Nowhere on the site is there a regulator, a licence number or a company name.

Verdict: 2/10. Not recommended; not on our blacklist. We have no verified case on file of Kedai888 refusing to pay a named player, and we allege none. The score follows our licence-first rule: Kedai888 does not claim a licence at all, and it fills the space with badges that are not licences. Add a free credit that pays out RM10 at most, two different minimum withdrawals on the same site, and a .org domain carrying its name that sends sign-ups to an Indonesian casino called KEDAI168, and there is nothing here a careful player can hold anyone to.

Where the licence should be: a partnership tag and five badges

The lobby’s own code is blunt about what this footer block is for. Its comment reads License / Partner (kept minimal & visible), and the box underneath is named game-license. What it holds is a logo and this paragraph, quoted in full:

KEDAI888 is an official verified partner in the 888 Partnership network. We’re focused on a safe, secure, and premium online casino Malaysia experience with fast withdrawals, transparent promotions, and a curated mix of slots, live casino, fishing, and [sports]. Our processes emphasise clarity first—so sessions feel smooth and predictable on both mobile and desktop.

The footer’s own FAQ answers the question “Trusted?” with: “Yes—888 Partnership-verified, certified providers, encrypted pages.” A partnership network is not a regulator. Nobody issues a “verified partner” status that a player can check, and a domain carrying the network’s name, 888partnership.my, returned a Cloudflare 522 error (its server did not respond) when we tried it on 1 October 2026.

The certificate row carries five images under the line “Games are audited for fairness, RNG tested, and certified by independent labs.” The page’s code labels them “BMM Testlabs”, “iTech Labs / Verified”, “Gaming Labs / iOvation”, “ThreatMetrix / Device Trust” and “Secure Site / SSL”. None of the five is a link, so there is no certificate to click through to. BMM and iTech Labs test game software. iovation and ThreatMetrix screen for fraud. SSL encrypts the connection. None of them licenses a casino, and none of them can help you if a withdrawal is refused. (What a licence actually does.)

We searched the whole page source, just over a megabyte, for the licensing terms we always check: licen, pagcor, curacao, anjouan, JAZ, ALSI and N.V.. Apart from the code’s own names for that footer box, every hit sits in a translation file shared with other casinos on the same software. That file holds ready-made licence sentences for two other brands, LuckyBetAsia and 4D GANG. Kedai888 displays neither sentence, and neither mentions Kedai888. Our Gardenia888 review found the same file in that brand’s lobby.

The footer does print a street address in Mid Valley City, Kuala Lumpur, a mobile number and an email address. It names no company. The same street address appears in the footers of the AP8, BolaKing888 and Gardenia888 lobbies, which we also read on 1 October 2026. We make no claim about who, if anyone, works at that address. The point is narrower: four brands print one address, none of them names a company, and an address is not a licence.

We also checked the registers a reader would reach for. On 1 October 2026 the Anjouan licence register, which lists domains next to each licence, carried 1,540 entries and no Kedai888 domain. The Curaçao Gaming Authority’s online gaming licence registry, last updated 21 September 2026, listed 665 licences and no licensee named Kedai. That second result proves less than it looks: the Curaçao register lists companies, with no brand or website column, and Kedai888 names no company, so there is nothing to look up. Both halves matter. No register we checked mentions Kedai888, and Kedai888 has given no one a name to check.

Seven domains, one lobby — and the .org that leads somewhere else

“Kedai888” is not one web address. This is what each domain carrying the name returned on 1 October 2026:

Public registration records show how the lobby domains were bought. Six of them — the a, b, g, i, m and z .com addresses — were registered at GoDaddy on 25 June 2025 between 14:55:02 and 14:55:04 UTC: one bulk purchase made within the same three seconds. kedai888.live was registered the same day. The footer itself names kedai888i.com as the brand’s website, but the link behind that text opens kedai888m.com. A rotating set of letter-suffixed mirrors is common in Malaysia and has an innocent reason (blocked domains get replaced) as well as a bad one (a player cannot easily tell a real mirror from a clone). It also means the brand’s web estate is about fifteen months old — older than the “Grand Opening 26/11/2025” date the affiliate site FPStation gives it would suggest.

kedai888.org is a different story. Its page source still carries a US print-on-demand shop’s metadata: its og:site_name is TeePublic, it carries a leftover product record (product:retailer_item_id 74165272D1V), and its menu still includes “Halloween T-Shirts”, “Music T-Shirts” and “Sport T-Shirts” beside keyword links such as “LINK KEDAI888” and “KEDAI888 TERPERCAYA”. Its prices are declared in Indonesian rupiah and its copy is in Indonesian, not Malay.

Its LOGIN and DAFTAR buttons, eight links in all, point to kedai888-apexspin.pages.dev, a free Cloudflare Pages address. On 1 October 2026 that address served a page for a brand called JACKPOT77, whose own DAFTAR button points to kd168p.link/register. We followed that link three times. All three ended on kedai168chip.com, an Indonesian-language casino titled “KEDAI168 | Situs Resmi” (official site) and priced in rupiah. Not one reached Kedai888.

We are not saying Kedai888’s operators built this page. kedai888.org was registered on 10 August 2023, nearly two years before the brand’s own domains, and a keyword page on a borrowed template fits a third party chasing the name at least as well as it fits the brand. The practical point holds either way: a Malaysian searching “kedai888” can land on a page that is not in ringgit, not in Malay, and does not lead to Kedai888.

One check came back negative, and it is worth saying so. None of these domains loads images from the Cloudflare account behind the doorway network we mapped, and none routes sign-ups through that network’s link services. On that test, Kedai888 is not part of it.

Bonus terms: what the lobby’s own promotion cards say

Kedai888 prints its bonus terms on each promotion card. We read them on 1 October 2026 from the promotion data the lobby loads, the same data that draws the cards on its promotion page. These are the operator’s own figures:

Three things in that table matter more than the headline amounts.

The no-deposit free credit is worth RM10 at most. On the RM10 card, the balance has to grow thirty-fold to RM300 before a withdrawal is allowed, and then the card pays out RM10. The RM40 sign-up card asks for a RM600 balance and caps the withdrawal at RM10. Read literally, as our Doktor Judi review reads the identical “RM600 minimum, RM10 maximum” pair on that brand, those two limits cannot both be met. Read as a balance target, which is how the RM10 card’s “maximum payment” wording suggests the operator means it, the most the “free RM40” can become is RM10 in cash. Neither reading gets you more than RM10.

On these cards, “turnover” means a balance target, not wagering. The 50% card’s own worked example reads: “Deposit: RM20 + Bonus: RM10 x 3 (Turnover) = RM90 (Win Over) Dapat RM80.” So the balance must reach three times your deposit plus bonus before you can cash out, and the bonus is taken back when you do. The 100% card’s example is “RM500 (Deposit) + RM500 (Bonus) x 7 (Turnover) = RM7000 (Win Over) Dapat RM6500”: a RM1,000 balance has to become RM7,000 before anything leaves. Our wagering and rollover explainer covers how win-over targets differ from ordinary rollover.

The footer describes rules the cards do not use. A long guide in the lobby footer, “Turnover Without the Noise”, asks you to “imagine a Free Kredit card offering RM30 with 10× turnover on slots at 100% contribution, live at 20%, fishing at 50%”. None of the cards on the promotion page publishes game weightings like these. They simply limit each bonus to slots or to “event games”, and most of them use “turnover” to mean a balance target. The affiliate site FPStation, which rates Kedai888 4.7 out of 5 and links to it with its own referral code, repeats the footer’s imaginary RM30-at-10× example and gives the minimum withdrawal as “sekitar RM50” (about RM50), echoing the footer’s “Commonly RM50”. The free-credit listing site linkfree.online files Kedai888 under “New-register free RM50” in one table, while its own brand card for Kedai888 advertises “TOPUP FREE RM249”, which matches Kedai888’s partnership page.

Kedai888’s terms page adds the rules that decide whether you keep anything: “If leftover credit still exists, withdrawal allowed up to RM50 only”, bonuses cannot be mixed with rebates or commission, and “If Any Rule Is Violated, All Remaining Balance, Winnings, And Credits Will Be Forfeited Without Notice.” That page names no company, no regulator and no governing law. And the footer’s own “Terms & Conditions” link does not reach it: on 1 October 2026 that link, like the footer’s “Contact Us”, led back to the homepage. The working terms page sits at a different address, linked from the promotion cards. Before you claim any free credit, read our list of bonus terms worth reading twice.

Free credit Kedai888 — apa sebenarnya anda dapat

Kad “Free Credit 365 Days” beri RM10, tetapi baki mesti capai RM300 sebelum boleh cuci, dan bayaran maksimum hanya RM10. Kad “New Register Free” RM40 pula minta baki RM600, dengan cuci maksimum RM10. Maknanya, kredit percuma ini paling banyak jadi RM10 tunai. Untuk bonus deposit, “turnover” bermaksud sasaran baki (win over), bukan jumlah pertaruhan, dan bonus ditolak semasa cuci. Ambil screenshot kad promosi sebelum anda tuntut. Itu sahaja rekod yang anda ada.

Payments: two minimum withdrawals and logos the terms don’t list

The cashier widget in the lobby reads “Minimum Deposit: 1.00” and “Minimum Withdrawal: 25.00”, and the site’s own settings say the same (RM1 in, RM25 out). The footer FAQ on the same pages says the minimum withdrawal is “Commonly RM50 via FPX or Malaysian e-wallets”. Both are Kedai888’s own figures, read on 1 October 2026. We report both because the operator publishes both. Our RM10 minimum deposit guide explains why the way out matters more than the way in.

The terms page lists three ways to deposit: bank transfer, e-wallets (Touch ’n Go, Boost, GrabPay) and telco reload PINs (Digi, Maxis, Celcom, U Mobile and TNG PIN). It adds that telco and TNG deposits cannot claim any bonus, that your registered name must match your bank account, and that the bank account cannot be changed after registration. The footer’s payment strip also shows Bitcoin, TRX, Ethereum, Visa, Mastercard, DuitNow and iBayar logos, none of which the terms mention. If e-wallet deposits are why you are here, our e-wallet casino guide covers what to check first.

The 888 Partnership: a ring of 36 brands

Kedai888 advertises itself into a network, and its own pages show how big that network is. Its “888 Partnership” promotion card lists fourteen brands: Kedai888, Aladdin888, Stitch888, Wau888, Batik888, Mixue888, Ramly888, BabyShark22, Dior88, Gardenia888, Minion888, Popmart89, M8Play and Mamak24. Its partnership page shows the same fourteen with their current offers.

The page source goes further. It carries referral links, each tagged with an “RF” tracking code, to the domains of 36 brand names. They include AP8, BolaKing888, Meta888, Bearbrick888, Richman888, JudiKiss88 and a run of football-club-styled names such as Arsenal888, Chelsea888, Barcelona888 and PSG888. Kedai888’s footer stylesheet even carries the note “KEDAI888 cloned from JUDIKISS88”.

The ring is not one-sided. On 1 October 2026, 23 of those 36 names also appeared in the referral lists on the AP8 and BolaKing888 lobbies, brands that linkfree.online files under a separate “Elite Group”. Gardenia888’s lobby linked back to Kedai888 using Kedai888’s own internal merchant number. And the five badge images in Kedai888’s certificate row are the identical image files shown on the Gardenia888, AP8 and BolaKing888 lobbies.

Why this matters: we have reviewed one member, and we rated Gardenia888 2/10. Its lobby named no regulator either and printed the same kind of “verified partnership network” line beside the same badges. Its most prominent “official link” page sent all fifty sign-up clicks recorded in that review to three rival casinos, and none to Gardenia888.

We are not saying Kedai888 does what Gardenia888’s doorway page does. Cross-promotion and shared software are not shared ownership, and we claim only the first two. But a brand that offers its “verified partner” status as the answer to “Trusted?” is asking you to treat the network as a credential. The one member we have reviewed in full shows why that credential is worth nothing on its own.

The software behind the lobby

Kedai888 runs on white-label casino software shared with other brands. The same translation file, site-settings format and footer layout, down to the box named game-license, appear on the lobbies of Gardenia888, AP8 and BolaKing888, and its images are served from xt30sf.b-cdn.net, the image server we have recorded on Telur33, Cili88 and Doktor Judi. Many unrelated brands use that server, so it shows a shared platform, not shared ownership or wrongdoing. What it does mean is that the terms, the badges and the “official partner” wording you read on Kedai888 are a template, and you will meet the same template under other names.

Player complaints

We have no verified case on file of Kedai888 refusing to pay a named player, and we allege none. That is a statement about the record, not a clean bill of health. The brand’s lobby domains are fifteen months old, and a business that names no company leaves a player nobody to complain to if something goes wrong.

Verdict and rating rationale — 2/10

Our licence-first rule ranks a casino only when the regulator’s own register confirms its licence. A brand whose licence cannot be confirmed or is contradicted scores 2 or 3 out of 10. Kedai888’s case is the plainer one: it claims no licence at all, and it puts test-lab badges and a partnership tag where the licence should be. With an unnamed operator, a free credit capped at RM10, contradictory withdrawal minimums and broken footer links on top, that is a 2, not a 3. It is not lower because we have nothing showing that Kedai888 has cheated a specific player, and we will not imply it from a template. See our methodology for how the score is built, and our blacklist and watchlist for how the two tiers differ.

Licensed alternatives

If free credit is what brought you here, it pays to play somewhere that names its company and holds a licence you can look up.

• Dafabet, we88, Surewin, BK8, GOD55, Rizzy and Eclbet — the seven casinos in our ranking, each with a licence the regulator’s own register confirms and published bonus terms. Read each full review before you sign up: for BK8 and Eclbet the register lists other domains, not the Malaysian lobbies their players end up on.
• The full ranking is at best online casino Malaysia.
• Before you chase any free credit, read our free credit casino Malaysia guide. At its last check, on 29 September 2026, none of the six casinos then in our ranking published a no-deposit credit at all.

If you have already deposited and cannot withdraw

Treat it as a scam matter rather than a customer-service matter, and do these in order.

1. Check which brand actually holds your account. If you registered through a button on kedai888.org, your account may be at KEDAI168, not Kedai888. The name on your cashier page is who you are chasing.
2. Call the National Scam Response Centre on 997 as soon as you can, then lodge a police report anyway. Calling 997 does not replace a police report. The window to freeze a transfer is short.
3. Check any payee account at Semak Mule, PDRM’s mule-account database, before you transfer anything. A personal bank account rather than a company account is the loudest red flag in Malaysian online gambling.

Understand your legal position too. Under the Common Gaming Houses Act 1953 and the Betting Act 1953, online gambling is not legal for Malaysian players, and there is no local regulator to appeal to for a payout dispute. That is exactly why a licence you can verify on a public register is worth something, and a row of test-lab badges is worth nothing.