earnify-agency[.]co[.]ke

The domain earnify-agency.co.ke was registered on 12 September 2025 through the registrar HOSTAFRICA EAC. Its authoritative nameservers are celine.ns.cloudflare.com and stan.ns.cloudflare.com, indicating use of Cloudflare DNS infrastructure. The site presented the page title “Earnify Agency” and was identified as a brand‑impersonation campaign targeting TikTok, as indicated by the “Impersonates: tiktok” field. No TLS certificate was observed, leaving the site exposed to unencrypted HTTP traffic. Network resolution points to the IPv4 address 74.50.97.199, which belongs to AS29802 HIVELOCITY, Inc. and is geolocated in the United States. The host received a trust score of 0 out of 100 from Gridinsoft, and it appears on a single security blocklist.

PhishDestroy has listed the domain as blocked, reinforcing the suspicion of malicious use. VirusTotal scanned the URL with 95 antivirus engines, and none reported a detection; however, the absence of detections does not constitute a safety assurance. The domain is currently taken offline, and its operational status is marked as “offline” in the intelligence feed. Analysis indicates that the infrastructure aligns with typical brand‑impersonation setups: a recent registration, Cloudflare DNS, a low trust rating, and explicit targeting of a high‑profile social‑media brand. The lack of an SSL certificate suggests the operator may rely on HTTP‑only delivery, which can simplify credential harvesting.

Uncertainty remains regarding the exact payload or phishing page content, as no visual or HTML evidence was provided. Defenders should continue to block the domain at perimeter filters, monitor DNS queries for the associated IP and nameservers, and consider adding the domain to internal blocklists. Given the single blocklist entry and the zero‑score from Gridinsoft, the domain should be treated as high‑risk.