usdtoksh[.]co[.]ke

This domain is flagged as a generic phishing site targeting users seeking USD to Kenyan Shilling (KSH) exchange rate services. The fraudulent page impersonates legitimate currency conversion platforms, potentially harvesting financial credentials or personal data under the guise of live rate tracking and instant conversions. Analysis indicates the site was designed to exploit users searching for real-time exchange information, a common tactic in financial phishing campaigns. Infrastructure analysis reveals the domain usdtoksh.co.ke was registered through HostPinnacle Cloud Limited on February 21, 2026, an unusually future-dated creation that may indicate domain spoofing or typosquatting. It resolved to IP address 178.162.196.33 and employed technologies including WordPress, MySQL, PHP, Chart.js, LiteSpeed, jsDelivr, jQuery Migrate, and jQuery. The site used a Let's Encrypt SSL certificate, providing a false sense of security. It was detected by 2 out of 95 security vendors on VirusTotal, appears on one security blocklist, and received a trust score of 0/100. The domain was blocked by PhishDestroy and is currently offline. Mitigation for this type of phishing threat includes verifying domain registration dates via WHOIS lookups, cross-checking exchange rate services with known financial institutions, and using browser-based security tools to detect fraudulent sites. Users should avoid entering credentials on sites offering financial services without multi-factor authentication or institutional verification. Network administrators are advised to block the domain and associated IP (178.162.196.33) at the perimeter, monitor for similar typosquatting patterns (e.g., variations of currency conversion keywords), and educate users on recognizing impersonated financial tools. Security teams should review logs for connections to the domain prior to its takedown and assess potential credential exposure.