5 Fake MDAC Websites to Avoid — And How to Spot Them

looks_oneSign 1: the domain doesn't end in .gov.my

Malaysian federal government agencies exclusively use domains ending in .gov.my. Commercial entities cannot register under this suffix. Copycat MDAC sites instead use generic, open top-level domains — .org, .net, .co, or .online — sometimes with "-gov" or "official" appended to the name itself specifically to mislead a quick glance at the address bar.

credit_card_offSign 2: any payment or checkout screen

This is the clearest signal of all. The genuine MDAC has no fee under any circumstance, and the real government portal simply has no payment gateway to charge you through even if it wanted to. If a site takes you to a page requesting card details, billing address, or a currency selector before letting you submit your details, you are on a commercial third-party site — close the tab.

ads_clickSign 3: it's a paid search ad, not the top organic result

Search ads are sold to the highest bidder, and copycat visa-processing agencies routinely outbid the organic ranking of the actual government page for high-intent queries like "MDAC registration" or "Malaysia arrival card online." Look for the small "Ad" or "Sponsored" label next to a result — it doesn't mean the site is automatically fraudulent, but it means it hasn't been vetted the way an organic government result implicitly has. When in doubt, type the known official address directly rather than clicking a search result.

visibility_offSign 4 & 5: cloned visual branding, and buried disclaimers

Sign 4 — visual mimicry. Many copycat sites deliberately copy government-adjacent colour palettes (deep greens, official-looking crests or shield icons) specifically to look authoritative at a glance, even though nothing about the design is actually verified or affiliated with any ministry.

Sign 5 — disclaimers hidden in tiny text. Most of these sites do technically disclose, somewhere in 9–10px grey footer text, that they are a private company unaffiliated with the Malaysian government — this is often what keeps them on the right side of advertising law. It's rarely visible without deliberately scrolling and squinting for it.

patternWhat these copycat domains typically look like

Fake MDAC sites don't use one fixed set of domains — new ones appear and get taken down constantly, so a static blacklist goes stale fast. What stays consistent is the pattern. The table below illustrates the recurring tricks and typical fee ranges reported by travellers, using example domain styles rather than a real-time list of currently active sites.

shieldThe safest way to file your MDAC without ever seeing a scam site

The simplest defence is never clicking a search result for this at all: bookmark the official address, or navigate here first and use our official-portal link, which routes you straight to imigresen-online.imi.gov.my. If you want a plain-language walkthrough of the form itself before you go, our field-by-field filing guide covers exactly what the real form asks for — useful context for recognising when a copycat site is asking for something the genuine form never would, like payment details or a passport photo upload.