cosis[.]cbe[.]ac[.]tz

The domain cosis.cbe.ac.tz was registered on February 27, 2026 and currently resolves to the IPv4 address 102.219.83.100. The web server returns HTTP 200 and presents a login page titled “CoSIS - Login”. The page is built with Bootstrap, jQuery, metisMenu and is served by Apache HTTP Server with HSTS enabled. The TLS certificate is issued by Let’s Encrypt and is currently valid, indicating the operator has taken steps to make the site appear legitimate.

Infrastructure analysis shows the IP belongs to the AS328845 block owned by The Governing Body of College of Business Education in Tanzania. The same address hosts other domains that have been reported for credential harvesting, suggesting a shared hosting environment used for phishing campaigns. The low Gridinsoft trust score of 0/100 and the presence on a single security blocklist (PhishDestroy) further corroborate malicious intent.

Threat intelligence feeds flag this domain as a credential phishing site. VirusTotal scans have resulted in 3 out of 95 security vendors marking the host as malicious, which aligns with the observed collection of login credentials. The combination of a convincingly branded login interface, a valid TLS certificate, and the use of common web frameworks is typical of credential‑stealing kits designed to evade casual inspection.

Defenders should block network traffic to 102.219.83.100 and add cosis.cbe.ac.tz to URL filtering rules. Email gateways should be tuned to detect messages that reference the CoSIS service or contain links to this domain. Incident response teams should monitor for attempted logins using compromised credentials associated with the target institution and consider credential rotation for affected users. Continuous monitoring of the IP’s hosting provider for new phishing deployments is also advised.