Highscore 44 · flagged Friday, October 16, 2026

kibakuli.shop

Appeared in the .shop zone on Friday, October 16, 2026; by the end of that day the census found active website. Full domain report

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

What matched

page asks for credentials
matched: Sign In to your Account
+30
login form
matched: has_form+login words
+14
Registrar
Namecheap, Inc.
Nameserver provider
Nameservers
ns1.orangehost.com, ns2.orangehost.com
First-day state
active website
HTTP status
200
Page title
Sign In - Kisinia
Has a form
yes
Brand echoed
—

Model opinions

First passsuspiciousconfidence 72%· claude-haiku-4-5

The domain kibakuli.shop hosts a login form posting to itself with no offsite links—the sealed-room phishing pattern—and displays a 'Kisinia Shop' brand. However, Kisinia appears to be the attacker's own brand (not an impersonated organisation), making this a generic credential harvester rather than impersonation phishing. The strong phishing infrastructure (self-posting form, no legitimate brand links, .shop TLD, fresh registration) and the scorer's high signal (44) indicate active malicious in

A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.

What the page looked like on Friday, October 16, 2026

Screenshot of kibakuli.shop taken by the zone census on 2026-10-16

Same data as JSON: /api/zone/domain/kibakuli.shop. This page is not indexed by search engines and does not link to the site it describes.