onstudies[.]co[.]ke

On July 23, 2026, the domain onstudies.co.ke was recorded as offline. The site resolved to the IP address 84.16.229.230, which is hosted by Leaseweb Deutschland GmbH in Germany. Registration data show the domain was created on September 10, 2021 through HostPinnacle Cloud Limited. The authoritative nameservers are ns1.noc254.com, ns2.noc254.com, rs11.rcnoc.com, and rs12.rcnoc.com. An SSL certificate issued by Let’s Encrypt (R13) was present at the time of capture, indicating HTTPS support. The page title returned “OnStudies – onstudies”, and server‑side technologies identified include WordPress, MySQL, PHP, LiteSpeed, and HTTP/3.

Gridinsoft assigned a trust score of 17 out of 100, reflecting a low confidence rating. The domain appears on a single security blocklist, specifically PhishDestroy, which has blocked it. VirusTotal analysis recorded 12 detections out of 91 scanned engines, confirming malicious classification. MX records consist of a single entry pointing to onstudies.co.ke with priority 0, suggesting a self‑hosted mail configuration. Analysis indicates that the infrastructure aligns with typical phishing deployments: a reputable hosting provider, a legitimate‑looking TLS certificate, and a content management system that can be easily repurposed. The low Gridinsoft score and multiple vendor detections reinforce the suspicion that the site was used for credential harvesting or similar fraudulent activity.

However, the precise phishing payload, target brand, or victim interaction flow cannot be confirmed because no visual or functional details were captured. Defenders should continue to block traffic to 84.16.229.230 and to the domain itself at DNS and proxy layers. Updating local blocklists with the PhishDestroy entry and adding the domain to email security filters will reduce exposure. Monitoring for newly registered subdomains under the same registrar or similar name server patterns is advised, as threat actors often recycle infrastructure.