impressengineering[.]co[.]ke

The domain impressengineering.co.ke is currently active and resolves to the IPv4 address 46.165.235.143, which is advertised as part of AS28753 Leaseweb Deutschland GmbH located in Germany. The site returns HTTP 200 and presents a page title of “Home - Impress Engineering”. Technical fingerprinting reveals a WordPress stack backed by MySQL and PHP, served through LiteSpeed, and includes front‑end libraries such as Swiper, jQuery, jQuery Migrate and Font Awesome. The domain was registered on 8 November 2023 through HostPinnacle Cloud Limited and uses a Let’s Encrypt R12 certificate, indicating that TLS is properly configured.

VirusTotal records show that two of ninety‑three scanning engines have flagged the domain, and the domain is listed on two public blocklists, specifically PhishDestroy and ScamSniffer. Both blocklists classify the activity as banking phishing, which aligns with the supplied scam type label. Nameservers rs51‑rs54.rcnoc.com are associated with the same hosting provider. No additional intelligence on the page content or the specific credential‑harvesting mechanism is presently available, so the exact phishing lure remains unconfirmed.

However, the combination of a recent registration, active hosting, a valid TLS certificate, and detection by multiple security vendors and blocklists strongly suggests a malicious intent aimed at credential theft. Defensive teams should continue to block the domain at network perimeters, add the IP address 46.165.235.143 to deny‑list rules, and monitor DNS queries for the associated nameservers. Organizations that process banking credentials should treat any communications from this domain as hostile and educate users to avoid interacting with the site. Continuous re‑scanning on VirusTotal and inclusion in threat‑intel feeds are recommended to capture any future changes in the payload or hosting infrastructure.