Fourteen Malaysian Casino Websites, One Back Office: What Actually Links Them

Desk research, checked 21 August 2026. Built from the raw HTML source of the websites named below, the images they serve, DNS records, HTTP response headers, the licensor’s own published notice, and twelve consecutive resolutions of one site’s sign-up link. We did not register an account, deposit or request a withdrawal anywhere. Nothing below is a first-hand payment test. How we work: our methodology.

Short answer: fourteen Malaysia-facing casino websites, carrying about a dozen different brand names, serve every image on their pages from one single Cloudflare Images account. Seven of them display the same image file of a licence seal belonging to a licensor that shut down in August 2024. All fourteen route their sign-up buttons through the same handful of link shorteners. And they recommend each other — including one page that offers a “responsible gaming” resource link which leads to another casino site in the same set.

We did not go looking for this. It surfaced twice, three days apart, while checking two brands that have nothing to do with each other: JQK on 20 August and MyTown33 on 21 August. The second one is what turned a coincidence into a map.

First, what this article is not saying

This matters enough to put before the evidence rather than after it.

What follows documents websites, not companies. A website that carries a casino brand’s name and logo is not necessarily built, owned or authorised by that casino. Affiliate marketers routinely register brand-keyword domains, put up a WordPress page with the operator’s artwork on it, rank it for people searching that brand, and collect a commission on anyone who signs up. The operator often has no idea the page exists. Sometimes the traffic does not even reach them.

So when the table below lists a domain carrying the name of a brand we rate well — Uwin33 is on it — that is not a finding against that brand. It is a finding about a domain. We are naming domains because the domains are the evidence, and a reader who lands on one deserves to know what they have landed on.

We also stop short of a claim we cannot source. A shared Cloudflare Images account proves shared infrastructure — somebody has the credentials to that account and is uploading artwork for all of these sites. It does not prove common legal ownership, and we do not assert it. There is no corporate registry entry behind this article, because none of these sites names a company.

The evidence: one image account, fourteen websites

Cloudflare Images gives every account a fixed hash that appears in the delivery URL of every image it serves: imagedelivery.net/<account hash>/<image id>/public. The hash is not a guess or a fingerprint. It is an account identifier, and it is sitting in the page source of anything that account serves.

The account hash P9OFiVM18PAr1SvRwzgU7w serves the images on all of these, checked on 21 August 2026:

(mytown33.org redirects into mytown33login.com, so we count it once.) One row does not look like the others. designbookfair.com is not a casino-sounding domain at all, and we will come back to it, because it is the most revealing entry in the table.

Two honest limits on this list. First, it is a floor, not a ceiling — we found these by following links between the sites, so it only covers what this set links to. Second, not every domain using a brand’s name is on the account: jqklogin.com, jqkslot8.com and jqkmalaysia.com carry JQK branding but serve no images from it, and crown9999.net is linked from two of these pages while sitting on different infrastructure. Shared branding and shared back office are different things, and we are only claiming the second.

Update, 24 August 2026 — a fifteenth site. That first limit was the right one to state. Reviewing Gardenia888, a Malaysia-facing brand with no previous connection to this set, we found all forty-one images on betgardenia888.com served from the same account hash. Twelve of them are the identical file as on mytown33login.com, the dead Gaming Curaçao seal (1724bcaa-26e8-4cf2-f68f-c4a78c05e700) among them — making it the eighth site in this set to display it. Its sign-up funnel behaves the same way too: thirty-seven calls to action, all pointing at one clickylinks.net address, which across twenty-five resolutions reached JM8, 12Joker and 711kelab and Gardenia888 not once. It also links out to mibox8888.com, row twelve of the table above, and to crown9999.net, the domain noted above as linked-to from separate infrastructure. The domains betgardenia888.com, mygardenia888.com and gardenia8888.com were registered through one NameCheap account within five seconds of each other on 2 December 2025.

Seven of them show the same dead licence seal

Most of these sites carry a footer heading in Bahasa Malaysia — LESEN PERMAINAN, “gaming licence” — with an image under it instead of a licence number.

The image is the Gaming Curaçao logo. And it is not merely the same logo on each site; it is the same file, served from the shared account with the identical image ID 1724bcaa-26e8-4cf2-f68f-c4a78c05e700, on seven of the fourteen: jqkslot.us, jqkslot.top, mytown33login.com, mudah54.uk.com, my11login.org, auraasia88.org and magnum8888.net.

Gaming Curaçao was a master-licence holder that issued sub-licences to online casinos under Curaçao master licence 365/JAZ. Its website is still up. The whole page now reads:

GAMING CURACAO HAS CEASED OPERATIONS ON AUGUST 18TH 2024. ON THIS DATE ALL ACTIVE SUB-LICENSES ISSUED BY GAMING CURACAO UNDER GAMING SERVICES PROVIDER N.V. 365/JAZ WILL EXPIRE AND ALL SEALS RENDERED INACTIVE. ANY ATTEMPT TO DISPLAY ACTIVE SEALS OR CONVEY AN EXTENSION OF EITHER THE SUB-LICENSE OR MASTER LICENSE WILL BE CONSIDERED FRAUDULENT AND ILLEGAL.

That notice has been published since August 2024. The MyTown33 pages carrying the seal were published in January 2026. We report the licensor’s position in its own words and leave the characterisation to it.

The practical point for a reader is narrower and more useful: none of the seven publishes a licence number. A real licence gives you a number you can type into a regulator’s public register. Curaçao’s regulator, now the Curaçao Gaming Authority, publishes one free at cga.cw — but it lists companies, by licence and registration number, with no brand column and no website column. Since none of these sites names a company, there is nothing to look up. An image is not a licence, and an image of a licensor that closed two years ago is not even a claim.

We have now seen this specific dead seal on SpinCity99 and MyTown33 in separate reviews a week apart. The difference is instructive: SpinCity99 at least publishes the master-licence number #1168/JAZ, so the claim can be tested and fails. The sites in this set publish the logo with no number at all, so there is nothing for a reader to catch.

The link layer, and why the button moves

None of these sites links to a casino lobby directly. Every Register button and promotional banner goes to a shortener first, and the shorteners are not public tools that anyone can use.

shortslink.org answers with the HTTP header x-powered-by: Short.io/Edge and describes itself as “a custom short domain… configured for link redirection”. On Short.io a branded domain belongs to one account. Its paths are keyed by brand — /jm8link, /jokerlink, /s11link, /b2ulink — which is what a single affiliate’s link estate looks like when it holds deals with several operators at once.

clickylinks.net, the shortener behind the largest group in the table, is a CNAME to links.switchy.io — Switchy, another commercial link manager — and its link identifiers follow Airtable’s record-ID format, which suggests the destinations are managed from a spreadsheet.

That matters because a spreadsheet-managed link can be changed without touching the website, and it can serve different people different destinations. We tested exactly that on MyTown33. The result is the finding in that review, and it is worth repeating here because it is the clearest demonstration of what this whole structure is for:

Twelve consecutive clicks of the Register button on a MyTown33-branded page produced live registration forms at three other casinos, in an even rotation, and never once reached MyTown33. The interstitial’s own social-preview metadata reads “1BET2U” on every fetch — a fifth brand, whose own domain 1bet2umy.net currently resolves to 175.139.142.25, the MCMC block address, meaning it is DNS-blocked to Malaysian users while its alternate domain serves the lobby normally.

The closed loop: the network recommends itself

This is the part that changes how you should read every “honest review” page in this segment.

MyTown33’s homepage carries a cautionary article about a player who lost RM200 and could not get a reply. It is well written and it reads like consumer journalism. It ends by pointing readers somewhere safer — to Mudah54, described as having “built a reputation for responsive customer service”, and to Magnum888’s games, “with reportedly more consistent customer service”.

Both mudah54.uk.com and magnum8888.net are in the table above. Same image account.

Then it goes further. The same article offers readers a link to “learn more about responsible gaming practices and how to identify trustworthy platforms”. That link goes to designbookfair.com. We opened it. Its page title is “Play Online Casino Malaysia at JM8 – Slots & Live”, its navigation reads “JM8 Login / JM8 Register”, and its images come from the same Cloudflare account as everything else in this article.

The responsible-gambling resource is a casino sign-up page.

So the full loop, on one screen, is: a warning about brand A, an endorsement of brands B and C, and a safety resource that is brand D’s sign-up funnel — with A, B, C and D all served from one account, and the Register button routing to yet another set of brands entirely. The criticism is real, the alternatives are real, and all of it is inventory.

What this means if you are the one depositing

You do not need to care who runs any of this. Three consequences are enough.

• The site you researched may not be the site that takes your money. Brand-name page, rotating button, different casino. Whatever terms you read on the way in do not attach to the account you end up with.
• A recommendation on one of these pages carries no information. Not because it is necessarily wrong, but because the page has no way to be wrong — it earns either way. The same is true of the warnings.
• A licence seal is not a licence. Seven sites here display the same picture of a shut-down licensor. None publishes a number. A number is the whole point; without one there is nothing to verify and no register that can help you.

How to check any casino site yourself in two minutes

All of this was found with a browser and no special tools. You can run the same checks.

1. Right-click an image on the page and choose “Open image in new tab”. If the URL starts imagedelivery.net/, the string after it is the account hash. Paste that hash into a search engine along with another casino’s name and see what else shares it.
2. Hover the Register button and read the status bar. If it points at a shortener rather than a named casino lobby, you cannot know in advance where you are going — and it may not be the same place twice.
3. Look for a licence number, not a logo. Then look that number up on the regulator’s own register. No number means no licence you can rely on, whatever the picture shows.
4. Check for a terms page, an About page and a contact address. Most sites in this set have none of the three. A business asking for your bank details and publishing no terms has given you nothing to hold it to.

Our Scam Watch roundup applies the same checks brand by brand, and the blacklist and watchlist records what each one produced.

If you have already deposited and cannot withdraw

1. Find out which brand actually holds your account. If you signed up through one of these pages, the name on your cashier may not be the name on the site you came from. That name is who you are chasing.
2. Call the National Scam Response Centre on 997. The two government listings currently disagree about its hours — the NFCC’s own NSRC page states 8.00am–8.00pm daily, the malaysia.gov.my portal says 24 hours. Your bank’s own 24-hour fraud hotline genuinely does run around the clock and is the right first call outside office hours. The window to freeze a transfer is measured in hours.
3. Lodge a police report within 24 hours anyway. Calling 997 does not replace it; the NFCC’s own FAQ is explicit that without a police report, follow-up action cannot be carried out.
4. Check any payee account on Semak Mule before you transfer. A personal bank account rather than a company account is the loudest red flag in this market.

Under the Common Gaming Houses Act 1953 and the Betting Act 1953, online gambling is not legal for Malaysian players and there is no local regulator to appeal to over a payout. That is precisely why a licence you can verify on a public register is worth something, and why a picture of a logo is worth nothing.

Rangkaian laman pintu masuk — apa yang perlu anda tahu

Empat belas laman web kasino berbeza, dengan lebih sepuluh nama jenama, menghidangkan semua gambar mereka dari satu akaun Cloudflare Images yang sama. Tujuh daripadanya memaparkan fail imej yang sama — logo Gaming Curaçao — di bawah tajuk “LESEN PERMAINAN”, sedangkan Gaming Curaçao telah berhenti beroperasi pada 18 Ogos 2024. Tiada satu pun menerbitkan nombor lesen.

Yang paling penting: butang Register tidak semestinya membawa anda ke jenama yang tertera. Pada laman MyTown33, dua belas kali kami klik, dua belas kali ia mendarat di kasino lain — JM8, 12Joker, 711kelab — dan tidak sekali pun di MyTown33. Artikel “amaran” di laman itu pula mengesyorkan Mudah54 dan Magnum888, yang berada dalam rangkaian yang sama, dan pautan “responsible gaming”-nya membawa ke halaman pendaftaran JM8.

Sebelum deposit: cari nombor lesen, bukan logo; periksa nama jenama pada halaman pendaftaran yang anda sampai; dan ambil screenshot terma yang anda baca. Itu sahaja rekod yang anda ada.

Frequently Asked Questions

What is a casino doorway site?

A website built to rank for a casino brand’s name that is not run by that casino. It carries the operator’s logo and artwork, publishes bonus figures, and sends anyone who clicks Register to a sign-up page through an affiliate link. The operator may not know it exists. It looks like the brand’s official site because that is the point.

How can you tell these fourteen sites are connected?

Every image on all fourteen is served from one Cloudflare Images account, hash P9OFiVM18PAr1SvRwzgU7w. Cloudflare puts that account identifier in the delivery URL of every image, so it is visible in the page source. Seven of them also display the same licence-seal image file, and they link to each other. That evidences a shared back office — not common legal ownership, which we do not claim.

Does this mean the casino brands named here are scams?

No, and that is an important distinction. This article documents domains, not companies. A doorway site carrying a brand’s name does not mean that brand built it, authorised it or benefits from it — affiliates register brand-keyword domains without permission all the time. One of the brands named, Uwin33, rates well in our own reviews. The finding is about the websites.

Kenapa butang Register bawa saya ke kasino lain?

Kerana butang itu bukan pautan terus ke lobi — ia melalui link shortener yang destinasinya boleh ditukar bila-bila masa. Pada laman MyTown33, dua belas kali kami klik, dua belas kali ia mendarat di jenama lain: JM8, 12Joker dan 711kelab, empat kali setiap satu, dan tidak sekali pun di MyTown33. Sentiasa periksa nama jenama pada halaman pendaftaran sebelum anda daftar.

Is a Gaming Curaçao seal still valid?

No. Gaming Curaçao’s own website states it ceased operations on 18 August 2024, that all sub-licences it issued under master licence 365/JAZ expired that day, and that any attempt to display its seals afterwards “will be considered fraudulent and illegal”. Seven sites in this article still display it. None of them publishes a licence number, so there is nothing to check on a regulator’s register either way.

Can I trust a review or a warning published on one of these sites?

Treat it as advertising. MyTown33’s homepage runs a genuine-sounding cautionary story about a player losing RM200, then recommends Mudah54 and Magnum888 — both on the same image account — and offers a “responsible gaming” link that opens a JM8 sign-up page. The criticism and the recommendation are inventory on the same shelf.

How do I check a site myself before depositing?

Open any image on the page in a new tab and look for imagedelivery.net/ in the URL — the string after it is the shared account hash. Hover the Register button and see whether it points at a named lobby or a shortener. Look for a licence number rather than a logo, then look that number up on the regulator’s own register. And check the site has a terms page, an About page and a contact address; most of the sites here have none of the three.