Verdict up front: A site headed “Malaysia Securities Exchange” asks visitors to log in or register, and displays the Bursa Malaysia logo — the mark of the country’s actual national exchange — twice. It runs on a free auto-generated Netlify subdomain, its telephone field defaults to +86, the dialling code for China, and it is named on the Securities Commission Malaysia Investor Alert List.
Site facts — checked 24 September 2026
- Address: musical-panda-099fcc.netlify.app — a free, randomly generated Netlify subdomain, not a purchased domain
- Regulator: named on the Securities Commission Malaysia Investor Alert List
- Presents itself as: “🌍 Malaysia Securities Exchange · Professional · Secure · Reliable”
- Logo used: the BURSA MALAYSIA mark, displayed twice — in the page header and again on the login card
- Phone field default: +86 — China. Malaysia is +60
- Entire site: a login box, a “Quick registration” link and nothing else — no prices, listings, rules, fees or contact
- Not disclosed: no company, address, licence, regulator, officers or exchange rules
Malaysia’s actual exchange is not this
Malaysia has one national stock exchange. It is a listed public company, it publishes its rules, its board, its annual report and its daily trade data, and it is supervised by the Securities Commission Malaysia.
What sits at this address is a login form on a free hosting subdomain whose name — musical-panda-099fcc — was generated at random when somebody clicked deploy. Nothing about the page resembles an exchange except the words at the top.
It is using the national exchange logo
This is not a lookalike name on its own. The page carries the BURSA MALAYSIA mark in its header and repeats it on the login card, which puts the identity of a listed, supervised national institution on a login form nobody at that institution built.
A visitor who recognises the logo has been given the answer to the only question that mattered before they type a password. That is the point of taking it, and it is what separates this from a merely unlicensed site: the operator is not inventing a brand, it is wearing one.
The dialling code is the tell
The registration field opens on +86. A page built for Malaysians would open on +60, because that is the code every one of them would need.
The default was set by whoever built the form, in the place they were sitting. It is the same class of artefact as a US placeholder number on a Malaysian page: the template was not made for the market it is pointed at, and nobody checked the field before it went live.
A free subdomain is a decision about cost
A domain costs a few dollars a year. A free deploy subdomain costs nothing, takes a minute, and can be replaced the moment it is reported — which is exactly why an operation that expects to be reported uses one.
It also carries no history and can be revoked by the host at any time. Anyone who deposits here is trusting an institution-sized claim to an address the operator does not own and has not paid for.
There is no product behind the door
An exchange publishes listings, prices, trading hours, membership rules, settlement arrangements and fees, because participants cannot trade without them. None of that exists on this site — not even behind a marketing page, because there is no marketing page.
The whole surface is a credential prompt. The only thing a visitor can do is create an account and hand over a telephone number, which makes the login screen the product.
- Check the address bar for a free host — .netlify.app, .vercel.app, .jimdofree.com, .web.app.
- A familiar logo proves nothing. Images copy in one click; licences do not.
- A random two-word-plus-hex subdomain is an auto-generated deploy name.
- Check the phone field’s default country. It shows where the page was built.
- A national exchange publishes rules and listings. A login box is not an exchange.
If you have already paid
Do not register or send identity documents, and if you already have, treat that name, number and ID as exposed. Stop depositing, screenshot everything, and report it to the Securities Commission Malaysia and to your bank. Report the page to Netlify’s abuse team so the subdomain can be taken down.
