porinisafaricamps[.]com

Analysis indicates that the domain porinisafaricamps.com was registered on March 06, 2026 through Bluehost Inc. and is currently active. The site presents a page titled "Porini Camps – Kenya Safaris" and is served over HTTPS using a Let’s Encrypt certificate (E7). The use of a recent registration date combined with a legitimate‑looking brand name suggests an attempt to lure users seeking Kenyan safari services.

Infrastructure analysis reveals that the domain resolves to IP address 141.193.213.10, which is associated with AS209242 Cloudflare London, LLC and reports a United States location. Nameservers ns1.bluehost.com and ns2.bluehost.com are in use, reflecting the registrar’s default configuration. The site returns HTTP 200 responses, and its Gridinsoft trust score is 0 out of 100, indicating a lack of reputation. PhishDestroy has already blocked the domain, and it appears on one external security blocklist. VirusTotal scans show that 11 out of 95 security vendors flag the domain as malicious, reinforcing the suspicion of hostile intent.

The observed page title and branding are consistent with a credential harvesting campaign targeting travelers interested in Porini Camps. No malicious payloads or redirects have been captured, leaving the exact data collection mechanism uncertain. However, the combination of a brand‑spoofing landing page, low trust scores, and multiple vendor detections aligns with the generic_phishing classification assigned to the domain.

Defenders should add porinisafaricamps.com to blocklists at the network perimeter and endpoint security solutions. Monitoring for outbound connections to the identified IP address and for DNS queries to the domain’s nameservers can help detect compromised hosts. Updating URL filtering rules to include the domain and educating users about fraudulent Kenya safari offers will reduce exposure to this high‑risk credential harvesting operation.