Forty Malaysian Casino Websites, One Back Office: What Actually Links Them

Desk research, checked 21 August 2026 and re-checked 29 September and 1 October 2026. Built from the raw HTML source of the websites named below, the images they serve, DNS records, public domain-registration records, HTTP response headers, the licensor’s own published notice, and repeated resolutions of the sites’ sign-up links. We did not register an account, deposit or request a withdrawal anywhere. Nothing below is a first-hand payment test. How we work: our methodology.

Short answer: forty Malaysia-facing casino websites, carrying twenty-six different brand names, load their images from one single Cloudflare Images account. Seventeen of them display the same image file of a licence seal belonging to a licensor that shut down in August 2024. All forty route their sign-up buttons through the same handful of link shorteners. And they recommend each other — including one page that offers a “responsible gaming” resource link which leads to another casino site in the same set.

We did not go looking for this. It surfaced twice, a day apart, while checking two brands that have nothing to do with each other: JQK on 20 August and MyTown33 on 21 August. The second one is what turned a coincidence into a map.

First, what this article is not saying

This matters enough to put before the evidence rather than after it.

What follows documents websites, not companies. A website that carries a casino brand’s name and logo is not necessarily built, owned or authorised by that casino. Affiliate marketers routinely register brand-keyword domains, put up a WordPress page with the operator’s artwork on it, rank it for people searching that brand, and collect a commission on anyone who signs up. The operator often has no idea the page exists. Sometimes the traffic does not even reach them.

So when the table below lists a domain carrying the name of a brand we review — Uwin33 is on it — that is not a finding against that brand. It is a finding about a domain. We are naming domains because the domains are the evidence, and a reader who lands on one deserves to know what they have landed on. (We no longer recommend Uwin33 either, but for a separate reason: on 29 September 2026 the Malta Gaming Authority’s public register listed no Uwin33 entity to match the MGA logo on its site.)

We also stop short of a claim we cannot source. A shared Cloudflare Images account proves shared infrastructure — somebody has the credentials to that account and is uploading artwork for all of these sites. It does not prove common legal ownership, and we do not assert it. There is no corporate registry entry behind this article, because none of these sites names a company.

The evidence: one image account, forty websites

Cloudflare Images gives every account a fixed hash that appears in the delivery URL of every image it serves: imagedelivery.net/<account hash>/<image id>/public. The hash is not a guess or a fingerprint. It is an account identifier, and it is sitting in the page source of anything that account serves.

The account hash P9OFiVM18PAr1SvRwzgU7w serves the images on all of these. The first fourteen rows were checked on 21 August 2026, the later rows carry the date we first reported them, and every row was re-checked on 29 September 2026 and again on 1 October 2026:

(mytown33.org redirects into mytown33login.com, so we count it once. On 29 September 2026 the same applied to mygardenia888.com and gardenia8888.com, which forward to betgardenia888.com, and to bigbossjudilogin.org, which forwards to bigbossjudimy.net. mudah54.uk.com now forwards to mudah54bet.com, which serves the same brand from the same account; casinojrmy.net, which forwarded to apatucasino.net, is now parked — see the 1 October update.) One row does not look like the others. designbookfair.com is not a casino-sounding domain at all, and we will come back to it, because it is the most revealing entry in the table.

Two honest limits on this list. First, it is a floor, not a ceiling — we found these by following links between the sites, so it only covers what this set links to. Second, not every domain using a brand’s name is on the account: jqklogin.com, jqkslot8.com and jqkmalaysia.com carry JQK branding but serve no images from it, and crown9999.net (which on 29 September 2026 forwarded to crown99my.com) is linked from eight of these pages but serves its images from its own domain, not the shared account — though that day its own Register button also ran through clickylinks.net to JM8, 12Joker and 711kelab, the same three casinos the MyTown33 and Gardenia888 buttons reach. Shared branding and shared back office are different things, and we are only claiming the second.

Update, 24 August 2026 — a fifteenth site. That first limit was the right one to state. Reviewing Gardenia888, a Malaysia-facing brand with no previous connection to this set, we found all forty-one images on betgardenia888.com served from the same account hash. Twelve of them are the identical file as on mytown33login.com, the dead Gaming Curaçao seal (1724bcaa-26e8-4cf2-f68f-c4a78c05e700) among them — making it the eighth site in this set to display it. Its sign-up funnel behaves the same way too: thirty-seven calls to action, all pointing at one clickylinks.net address, which across twenty-five resolutions reached JM8, 12Joker and 711kelab and Gardenia888 not once. It also links out to mibox8888.com, row twelve of the table above, and to crown9999.net, the domain noted above as sitting outside the image account. The domains betgardenia888.com, mygardenia888.com and gardenia8888.com were registered through one NameCheap account within five seconds of each other on 2 December 2025.

Update, 29 September 2026 — twenty-three sites. We re-fetched every domain in the table: all of them, or the sites they now forward to, still serve every image from the same account, and the MyTown33 and Gardenia888 Register buttons, resolved twelve more times each, still reached only JM8, 12Joker and 711kelab. The table now carries eight more sites on the account. Five came from our own brand reviews: cili888.net (Cili88, reported in our Cili88 review on 2 September), oyen333my.com and oyen33.net (Oyen33, reported in our Oyen333 review on 28 September), aliibaba66.club (Alibaba66, reported in our Alibaba66 review on 28 September) and u88live.net (U88, which u88gaming.net forwards to, found on 29 September while re-checking our U88 review). Following the links on these pages again turned up three more: bigbossjudimy.net (Bigbossjudi, which bigbossjudilogin.org forwards to) and two further Auraasia domains, auraasia88.net and auraasia888.net. Not every new button lands on those three casinos: the one on oyen333my.com sent us to Kaya888 in all ten of our tries, through the same shortslink.org domain. Four of the new sites — aliibaba66.club, bigbossjudimy.net and both new Auraasia domains — carry the same dead Gaming Curaçao seal file, which makes twelve sites showing it. The three Auraasia domains — auraasia88.org, auraasia88.net and auraasia888.net — were registered through NameCheap within nine seconds of each other on 27 January 2026, the same pattern as Gardenia888.

Update, 1 October 2026 — forty sites. We re-ran the test on every domain in the table and on eighteen more that had surfaced while we checked brands for new reviews. Two of the twenty-three existing rows have changed; the rest still reproduce. jqkslot.top has been rebuilt: its logo now comes from its own server and the Gaming Curaçao seal is gone from its homepage, but six of its images still load from the account. And casinojrmy.net has stopped forwarding and become a parked domain, while apatucasino.net, the address it used to forward to, still serves Apatuwallet from the account. The MyTown33 and Gardenia888 Register buttons, resolved ten more times each, again reached only JM8, 12Joker and 711kelab.

Seventeen of the eighteen new domains belong in the table. Every image on each of their homepages loads from the same account hash, and every Register button on each homepage points at one clickylinks.net address. We resolved each of those seventeen addresses ten times. None of the 170 resolutions reached the brand named on the page. Sixteen of the sites landed on registration pages at JM8 (myjm8.com), 12Joker (joker997.net) and 711kelab (711kelabmya.com), the same three casinos as the MyTown33 and Gardenia888 buttons; the seventeenth, siti888.org, landed on 12Joker and 711kelab at two other addresses (12jokermya.com and 711kelab.online), never on Siti88’s own lobby at siti88.com, which we have reviewed since this update (our Siti88 review). Sixteen of the seventeen also link to at least one site already in the table; totoslot888my.com is the exception. Six carry the dead seal file. Eight share identical image files with mytown33login.com, from eight files up to thirty; the other nine share none, so for those the evidence is the account hash and the link funnel. Each site’s signals on 1 October:

The rule at the top of this article applies to every new name: these are findings about domains, not brands. When this update was written, three of the brands had their own reviews on this site, and each runs its own casino lobby elsewhere, none of which loads images from this account: Peluang88 at peluang88.co (its main address, peluang88.com, is blocked in Malaysia and forwards there), Bila2Cuci at addresses including bila2cuci.art, and i4Malaysia at i4malaysia.com. The lookalike addresses above — peluang8888.net, bila2cucii.com, bila2cucislot.com and i4malaysia.club — carry those names, and in forty resolutions their buttons never once reached the brand. Dadu44, reviewed since this update, is the same case: its own lobby runs at dadu44a.com on a different image server, while dadu4444.com in the table above sent all ten tries to JM8, 12Joker or 711kelab (our Dadu44 review).

Public domain-registration records add a timing pattern. All seventeen new domains were registered through NameCheap, several in tight clusters. peluang8888.net, spd88login.net, spd8888.org, spd8888.net, dadu4444.com, siti888.org, siti8888.com and siti88vip.com — eight domains for four brand names — were registered within 151 seconds of each other on 17 December 2025. totoslot888my.com was registered about twenty seconds after the three Gardenia888 domains on 2 December 2025. bila2cucii.com and bila2cucislot.com were registered in the same second, under a minute before the three Auraasia domains, on 27 January 2026. apatulogin.com followed apatucasino.net by six seconds on 23 December 2025, and the two Bolaking domains in the table were registered five seconds apart on 19 May 2026 (on 2 October our BolaKing review found two more BolaKing-named sites on the same image account, bolaking.club and bolaking.vip; none of the four sites' buttons reached the BolaKing888 lobby, which does not use this account). Like the shared image account, registration timing shows coordinated set-up. It does not show who owns the sites.

The eighteenth domain sits outside the image account, like crown9999.net. mymeta888.com (Meta888) serves its images from its own WordPress uploads, but all ten of its Register buttons point at one clickylinks.net address, which in ten tries reached JM8 six times, 711kelab three times and 12Joker once. It is not in the table, because the table counts only sites on the image account.

With these, the table holds forty sites on the account (counting apatucasino.net in place of the now-parked casinojrmy.net), carrying twenty-six brand names, and seventeen of them show the dead seal: eleven of the original twelve plus the six marked above.

Seventeen of them show the same dead licence seal

Seventeen of these sites carry a footer heading in Bahasa Malaysia — LESEN PERMAINAN, “gaming licence” — with an image under it instead of a licence number.

The image is the Gaming Curaçao logo. And it is not merely the same logo on each site; it is the same file, served from the shared account with the identical image ID 1724bcaa-26e8-4cf2-f68f-c4a78c05e700, on seventeen of the forty when we checked on 1 October 2026: jqkslot.us, mytown33login.com, mudah54.uk.com, my11login.org, auraasia88.org, magnum8888.net, betgardenia888.com, aliibaba66.club, bigbossjudimy.net, auraasia88.net, auraasia888.net, peluang8888.net, bila2cucislot.com, siti88vip.com, spd88login.net, berjaya88-my.net and apatulogin.com. (jqkslot.top also showed it on 29 September; its rebuilt homepage no longer does.)

Gaming Curaçao was a master-licence holder that issued sub-licences to online casinos under Curaçao master licence 365/JAZ. Its website is still up. The whole page now reads:

GAMING CURACAO HAS CEASED OPERATIONS ON AUGUST 18TH 2024. ON THIS DATE ALL ACTIVE SUB-LICENSES ISSUED BY GAMING CURACAO UNDER GAMING SERVICES PROVIDER N.V. 365/JAZ WILL EXPIRE AND ALL SEALS RENDERED INACTIVE. ANY ATTEMPT TO DISPLAY ACTIVE SEALS OR CONVEY AN EXTENSION OF EITHER THE SUB-LICENSE OR MASTER LICENSE WILL BE CONSIDERED FRAUDULENT AND ILLEGAL.

That notice has been published since August 2024. The MyTown33 pages carrying the seal were published in January 2026. We report the licensor’s position in its own words and leave the characterisation to it.

The seal outlives this network, too. On 26 August 2026 we found the same Gaming Curaçao logo in the footer of Telur33 — a brand with no connection to the image account above, running its own separate shared-image setup on a BunnyCDN pull zone alongside Mahkota8, GK9 and LKB8. Two unrelated Malaysia-facing networks, the same expired seal.

The practical point for a reader is narrower and more useful: none of the seventeen publishes a licence number. A real licence gives you a number you can type into a regulator’s public register. Curaçao’s regulator, now the Curaçao Gaming Authority, publishes one free at cga.cw — but it lists companies, by licence and registration number, with no brand column and no website column. Since none of these sites names a company, there is nothing to look up. An image is not a licence, and an image of a licensor that closed two years ago is not even a claim.

We have now seen this specific dead seal on SpinCity99 and MyTown33 in separate reviews three days apart. The difference is instructive: SpinCity99 at least publishes a licence number, #1168/JAZ, which it calls a master licence, so the claim can be tested and fails. The sites in this set publish the logo with no number at all, so there is nothing for a reader to catch.

The link layer, and why the button moves

None of these sites links to a casino lobby directly. Every Register button and promotional banner goes to a shortener first, and the shorteners are not public tools that anyone can use.

shortslink.org answers with the HTTP header x-powered-by: Short.io/Edge and describes itself as “a custom short domain… configured for link redirection”. On Short.io a branded domain belongs to one account. Its paths are keyed by brand — /jm8link, /jokerlink, /s11link, /b2ulink — which is what a single affiliate’s link estate looks like when it holds deals with several operators at once.

clickylinks.net, the shortener behind the largest group in the table, is a CNAME to links.switchy.io — Switchy, another commercial link manager — and its link identifiers follow Airtable’s record-ID format, which suggests the destinations are managed from a spreadsheet.

That matters because a spreadsheet-managed link can be changed without touching the website, and it can serve different people different destinations. We tested exactly that on MyTown33. The result is the finding in that review, and it is worth repeating here because it is the clearest demonstration of what this whole structure is for:

Twelve consecutive clicks of the Register button on a MyTown33-branded page produced live registration forms at three other casinos, in an even rotation, and never once reached MyTown33. The interstitial’s own social-preview metadata reads “1BET2U” on every fetch — a fifth brand, whose own domain 1bet2umy.net currently resolves to 175.139.142.25, the MCMC block address, meaning it is DNS-blocked to Malaysian users while its alternate domain serves the lobby normally.

The closed loop: the network recommends itself

This is the part that changes how you should read every “honest review” page in this segment.

MyTown33’s homepage carries a cautionary article about a player who lost RM200 and could not get a reply. It is well written and it reads like consumer journalism. It ends by pointing readers somewhere safer — to Mudah54, described as having “built a reputation for responsive customer service”, and to Magnum888’s games, “with reportedly more consistent customer service”.

Both mudah54.uk.com and magnum8888.net are in the table above. Same image account.

Then it goes further. The same article offers readers a link to “learn more about responsible gaming practices and how to identify trustworthy platforms”. That link goes to designbookfair.com. We opened it. Its page title is “Play Online Casino Malaysia at JM8 – Slots & Live”, its navigation reads “JM8 Login / JM8 Register”, and its images come from the same Cloudflare account as everything else in this article.

The responsible-gambling resource is a casino sign-up page.

So the full loop, on one screen, is: a warning about brand A, an endorsement of brands B and C, and a safety resource that is brand D’s sign-up funnel — with A, B, C and D all served from one account, and the Register button routing to yet another set of brands entirely. The criticism is real, the alternatives are real, and all of it is inventory.

What this means if you are the one depositing

You do not need to care who runs any of this. Three consequences are enough.

• The site you researched may not be the site that takes your money. Brand-name page, rotating button, different casino. Whatever terms you read on the way in do not attach to the account you end up with.
• A recommendation on one of these pages carries no information. Not because it is necessarily wrong, but because the page has no way to be wrong — it earns either way. The same is true of the warnings.
• A licence seal is not a licence. Seventeen sites here display the same picture of a shut-down licensor. None publishes a number. A number is the whole point; without one there is nothing to verify and no register that can help you.

How to check any casino site yourself in two minutes

All of this was found with a browser and no special tools. You can run the same checks.

1. Right-click an image on the page and choose “Open image in new tab”. If the URL starts imagedelivery.net/, the string after it is the account hash. Paste that hash into a search engine along with another casino’s name and see what else shares it.
2. Hover the Register button and read the status bar. If it points at a shortener rather than a named casino lobby, you cannot know in advance where you are going — and it may not be the same place twice.
3. Look for a licence number, not a logo. Then look that number up on the regulator’s own register and read its expiry date, not just its status (our checklist for before you register shows why). No number means no licence you can rely on, whatever the picture shows.
4. Check for a terms page, an About page and a contact address. Most sites in this set have none of the three. A business asking for your bank details and publishing no terms has given you nothing to hold it to.

Our Scam Watch roundups apply the same checks brand by brand (Scam Watch #1; Scam Watch #2, which traces two supposedly independent i4 Malaysia reviews to this image account), and the blacklist and watchlist records what each one produced.

If you have already deposited and cannot withdraw

1. Find out which brand actually holds your account. If you signed up through one of these pages, the name on your cashier may not be the name on the site you came from. That name is who you are chasing.
2. Call the National Scam Response Centre on 997. The two government listings currently disagree about its hours — the NFCC’s own NSRC page states 8.00am–8.00pm daily, the malaysia.gov.my portal says 24 hours. Your bank’s own 24-hour fraud hotline genuinely does run around the clock and is the right first call outside office hours. The window to freeze a transfer is measured in hours.
3. Lodge a police report within 24 hours anyway. Calling 997 does not replace it; the NFCC’s own FAQ is explicit that without a police report, follow-up action cannot be carried out.
4. Check any payee account on Semak Mule before you transfer. A personal bank account rather than a company account is the loudest red flag in this market.

Under the Common Gaming Houses Act 1953 and the Betting Act 1953, online gambling is not legal for Malaysian players and there is no local regulator to appeal to over a payout. That is precisely why a licence you can verify on a public register is worth something, and why a picture of a logo is worth nothing.

Rangkaian laman pintu masuk — apa yang perlu anda tahu

Empat puluh laman web kasino berbeza, dengan 26 nama jenama, memuatkan gambar mereka dari satu akaun Cloudflare Images yang sama. Tujuh belas daripadanya memaparkan fail imej yang sama — logo Gaming Curaçao — di bawah tajuk “LESEN PERMAINAN”, sedangkan Gaming Curaçao telah berhenti beroperasi pada 18 Ogos 2024. Tiada satu pun menerbitkan nombor lesen.

Yang paling penting: butang Register tidak semestinya membawa anda ke jenama yang tertera. Pada laman MyTown33, dua belas kali kami klik, dua belas kali ia mendarat di kasino lain — JM8, 12Joker, 711kelab — dan tidak sekali pun di MyTown33. Artikel “amaran” di laman itu pula mengesyorkan Mudah54 dan Magnum888, yang berada dalam rangkaian yang sama, dan pautan “responsible gaming”-nya membawa ke halaman pendaftaran JM8.

Pada 1 Oktober 2026 kami menambah tujuh belas laman baharu ke dalam senarai, termasuk laman tiruan yang memakai nama Peluang88, Bila2Cuci dan i4Malaysia. Butang Register pada setiap laman itu kami buka sepuluh kali: semuanya mendarat di JM8, 12Joker atau 711kelab, dan tidak sekali pun di jenama yang tertera pada laman tersebut.

Sebelum deposit: cari nombor lesen, bukan logo; periksa nama jenama pada halaman pendaftaran yang anda sampai; dan ambil screenshot terma yang anda baca. Itu sahaja rekod yang anda ada.

Frequently Asked Questions

What is a casino doorway site?

A website built to rank for a casino brand’s name that is not run by that casino. It carries the operator’s logo and artwork, publishes bonus figures, and sends anyone who clicks Register to a sign-up page through an affiliate link. The operator may not know it exists. It looks like the brand’s official site because that is the point.

How can you tell these forty sites are connected?

All forty load their images from one Cloudflare Images account, hash P9OFiVM18PAr1SvRwzgU7w. Cloudflare puts that account identifier in the delivery URL of every image, so it is visible in the page source. Seventeen of them also display the same licence-seal image file, and they link to each other. That evidences a shared back office — not common legal ownership, which we do not claim.

Does this mean the casino brands named here are scams?

No, and that is an important distinction. This article documents domains, not companies. A doorway site carrying a brand’s name does not mean that brand built it, authorised it or benefits from it — affiliates register brand-keyword domains without permission all the time. One of the brands named, Uwin33, has its own review on this site; we no longer recommend it, but for a separate reason (its licence claim did not check out on 29 September 2026), not because of these domains. The finding is about the websites.

Kenapa butang Register bawa saya ke kasino lain?

Kerana butang itu bukan pautan terus ke lobi — ia melalui link shortener yang destinasinya boleh ditukar bila-bila masa. Pada laman MyTown33, dua belas kali kami klik, dua belas kali ia mendarat di jenama lain: JM8, 12Joker dan 711kelab, empat kali setiap satu, dan tidak sekali pun di MyTown33. Sentiasa periksa nama jenama pada halaman pendaftaran sebelum anda daftar.

Is a Gaming Curaçao seal still valid?

No. Gaming Curaçao’s own website states it ceased operations on 18 August 2024, that all sub-licences it issued under master licence 365/JAZ expired that day, and that any attempt to display its seals afterwards “will be considered fraudulent and illegal”. Seventeen sites in this article still display it. None of them publishes a licence number, so there is nothing to check on a regulator’s register either way.

Can I trust a review or a warning published on one of these sites?

Treat it as advertising. MyTown33’s homepage runs a genuine-sounding cautionary story about a player losing RM200, then recommends Mudah54 and Magnum888 — both on the same image account — and offers a “responsible gaming” link that opens a JM8 sign-up page. The criticism and the recommendation are inventory on the same shelf.

How do I check a site myself before depositing?

Open any image on the page in a new tab and look for imagedelivery.net/ in the URL — the string after it is the shared account hash. Hover the Register button and see whether it points at a named lobby or a shortener. Look for a licence number rather than a logo, then look that number up on the regulator’s own register. And check the site has a terms page, an About page and a contact address; most of the sites here have none of the three.