Scam Watch #1: The Seven Malaysian Casino Brands We Checked in Three Weeks

Desk research. This roundup summarises seven operator reviews built from the brands’ own published pages, their mirror domains, public regulator registers and third-party casino databases, checked between 23 July and 10 August 2026. We have not registered an account, deposited, played or requested a withdrawal at any of the seven. Nothing below is a first-hand payment test. How we work: our methodology.

Short answer: we ran full checks on seven Malaysia-facing casino brands in three weeks. Not one of them published a licence number we could look up on an issuing regulator’s public register. Two claimed licences that independent databases flag as fake. One advertises a “Malaysian licence” that does not exist as a category. One’s main domain was dead the day we checked it.

This is Scam Watch #1 — the first in a monthly roundup that collects everything our review desk found, names the patterns, and gives you a check you can run yourself in two minutes. Every brand below links to its full review.

The Three-Week Scoreboard

Two words matter in that last column. Blacklisted means we judged the brand unsafe on the evidence. Watchlist means we found no evidence of player harm — only that there is nothing to verify. We do not accuse operators of theft we cannot document, and we say so on every review. Our full blacklist explains the criteria.

The Four Patterns That Repeated

Seven brands, four failure modes — and they show up together often enough to be a checklist.

1. The mirror-domain cluster

Alibaba66 ran on at least seven domains. i5 Malaysia on six. Waja33 on eleven, plus a link-hub page. Oyen333’s main .com was dead while the brand traded on .me, with satellites on .live and .top.

This is not a technical accident. Between 1 January 2025 and 31 May 2026, internet service providers blocked 1,778 gambling websites at MCMC’s request, and took down 457,562 pieces of gambling-related content — 98% of the takedown requests submitted (Communications Ministry written parliamentary reply, 16 July 2026). Operators respond by running a rotating stable of domains so a block costs them a day, not a business.

The cost lands on you. If the domain you registered on stops resolving, your balance, your login and your chat history are on the other side of it — and there is no regulator to ask. It also makes phishing trivial: a working new mirror and a clone built to harvest your login look identical in a WhatsApp forward.

2. The licence claim that cannot be checked

A real licence is a number on a public register. That is the whole test.

• Curaçao — the LOK reform replaced the old master/sub-licence chain, and the Curaçao Gaming Authority now runs a live public licence register with clickable seals resolving to cert.cga.cw, naming the exact domain covered.
• PAGCOR (Philippines) — publishes its list of internet gaming licensees. Note that offshore (POGO-era) licensing was abolished outright by the Anti-POGO Act, which is why a 2026 “PAGCOR licence” on a Malaysia-facing site does not survive scrutiny.
• MGA (Malta) — online gaming licence register, searchable by company name.
• UKGC — every holder is named on the public register. A UKGC licence authorises the Great Britain market; a Malaysia-facing site wearing that badge is not a UKGC licensee.
• Isle of Man GSC — licence holders list. A .im domain is sold commercially worldwide and confers nothing.

Four of our seven brands named no regulator at all. Two named regulators that independent databases record as fake. One invented a national licence that does not exist. Zero published a number we could look up.

3. No published terms — especially no wagering terms

Waja33, i2 Malaysia and Oyen333 published no terms and conditions we could find. CM2 published terms, but none covering its bonuses. Oyen333 advertises 30-plus promotions without a single stated rollover.

A bonus with no published wagering requirement is not a generous bonus. It is a bonus whose terms can be told to you after you deposit — at the moment you try to withdraw. The clauses that decide whether an offer is worth anything are the rollover multiple, the game-weighting table, the max-bet-while-bonus-active rule and the withdrawal cap. We explain all four in wagering and rollover explained and in the bonus terms glossary; the casino bonus types guide covers what each offer type should disclose.

4. Bonus numbers that disagree with themselves

Across mirrors and affiliate pages, the same brand advertised different free-credit amounts. i2 Malaysia: RM6 on one page, RM88 on another — and neither figure appeared on any i2 domain we checked. Waja33’s mirrors could not agree on the RM100 offer. WinMy’s headline bonus differed across three sources.

When a brand’s own marketing cannot agree on what it is offering, the offer is bait, not a product. Our verified free-credit list only carries offers we can find on the operator’s own page, and we re-check it weekly. The same pattern runs through the app-brand searches too — we traced it amount by amount in our 918Kiss free credit RM10 guide.

The Two-Minute Check Before You Deposit

You do not need our review to run this. It works on any brand.

1. Find the licence number. Scroll to the footer. No number, or an image you cannot click? Stop there. A seal that is a static picture is decoration.
2. Look the number up on the regulator’s own site. Not the casino’s page about the regulator — the register itself, from the list above. The entry should name a company and, for Curaçao, the exact domain.
3. Find the company name. If no legal entity is named anywhere, there is nobody to pursue if a withdrawal never arrives.
4. Open the T&Cs and find the rollover. If the bonus page has no wagering requirement, assume the worst number you have ever seen.
5. Check the payee before you transfer. Whatever account or number the cashier gives you, run it through PDRM’s Semak Mule first. At our last check the database held roughly 299,500 flagged bank accounts and 233,500 phone numbers reported in commercial-crime cases.

A brand that fails steps 1–3 is not a “risky” casino. It is an anonymous stranger holding your money under rules it has not written down.

If You Have Already Deposited and Cannot Withdraw

Act inside the first 24 hours — that is the window in which transferred funds can still be frozen.

1. Screenshot everything now. Balance, withdrawal request, transaction receipt, the exact domain you used, and every support chat.
2. Call 997 — the National Scam Response Centre, run by PDRM and operating 24 hours daily. The centre brings PDRM, Bank Negara, MCMC and the banks into one line specifically to freeze outgoing transfers.
3. Lodge a police report at the nearest station as well. Since September 2025 a 997 call is officially treated as a police report, but the government’s own NSRC page still lists making a report among the steps — official sources conflict, so do both and lose nothing.
4. Check the payee on Semak Mule and include the result in your report.
5. Stop depositing. Do not send more money to “unlock” a withdrawal. That request is itself the scam.

For scale: the NSRC has frozen about RM32.5 million since it began and returned RM10.9 million of it to victims; between January and May 2026 it froze RM7.25 million and returned RM3.57 million, or 49%. Over those same five months Malaysians reported losing roughly RM830 million to online scams, per Home Ministry figures reported in June 2026 (The Sun; The Vibes). Freezing works, but only if the call happens fast, and most money is never recovered.

Where the Safe Options Are

None of this means every offshore brand is a scam. It means the verifiable ones are a much smaller set than the search results suggest.

Operators that passed our 25-step review process — a licence on a public register, published binding terms, a named company behind the cashier — are ranked with their scoring at best online casino Malaysia, currently led by BK8, 12Play and UEA8. For deposit rails specifically, our e-wallet casino guide covers Touch ’n Go, DuitNow and GrabPay.

And the legal position, plainly: under the Common Gaming Houses Act 1953 and the Betting Act 1953, Malaysia does not license online casino gambling at all. Every site serving this market is offshore. The only question worth asking is which foreign regulator stands behind it — and this month, seven times out of seven, we could not answer it.

18+ only. Gambling should be entertainment, never income. The house holds a mathematical edge on every game, over every session, without exception. Set a deposit limit before you play and never chase a loss. If gambling is affecting your finances, work or relationships, please read our responsible gambling page.

Right of reply: if you represent any brand named here and can supply a licence number that appears on an issuing regulator’s public register, we will verify it and update the relevant review within 48 hours.

Scam Watch is published monthly. Next edition: September 2026.

Scam Watch #1 FAQ

How do I know if an online casino is a scam? (Macam mana nak tahu casino online scam?)

Run the two-minute check above. The fastest single test: find the licence number in the footer and look it up on the regulator’s own public register. No number, or a number that does not appear on the register, means no licence. Add an undisclosed owner and missing T&Cs, and you have the profile of every brand in this roundup.

Adakah semua casino online di Malaysia haram?

Ya — dari segi pelesenan. Di bawah Akta Rumah Judi Terbuka 1953 dan Akta Pertaruhan 1953, Malaysia tidak mengeluarkan sebarang lesen kasino dalam talian. Semua jenama yang beroperasi di sini adalah luar negara. Soalan sebenar bukan “ada lesen Malaysia?” — tetapi “pengawal selia asing mana yang menyokongnya, dan boleh saya semak nombor lesen itu?”

What is the difference between your blacklist and your watchlist?

Blacklisted means we judged the brand unsafe based on documented findings — fake licence claims, spam networks on hacked sites, or similar. Watchlist means we found no evidence of player harm, but nothing about the operator’s safety claims could be verified either. Both mean the same thing in practice: we do not recommend depositing. See the blacklist for the full criteria.

Kena scam casino online — apa nak buat? (I got scammed by an online casino — what do I do?)

Simpan semua bukti (tangkap layar baki akaun, permintaan pengeluaran, resit transaksi, sembang sokongan). Telefon 997, talian Pusat Respons Penipuan Nasional (NSRC) yang beroperasi 24 jam. Buat juga laporan polis di balai berhampiran — sumber rasmi masih berbeza pendapat sama ada panggilan 997 sahaja sudah memadai. Semak akaun penerima di Semak Mule. Jangan hantar wang tambahan untuk “buka” pengeluaran. Bertindak dalam 24 jam pertama.

Why do these casinos keep changing their website address?

Because their addresses keep getting blocked — 1,778 gambling sites were blocked at MCMC’s request between January 2025 and May 2026. Operators pre-register mirror domains so a block costs them a day. For players, it means the site holding your balance can disappear overnight, and that any “new link” circulating on Telegram might be a phishing clone.

Will you review my casino if I send it to you?

Yes. Send us the domain and what happened through our contact page. We check every submission against the same 25-step process, and reader reports set much of the queue for the next Scam Watch.