Verdict
betpawa.co.ke is low-trust and potentially risky.
Several risk patterns were present. Do not send money or personal details until you have verified this business another way.
| What this site appears to be | Public-facing Kenyan gambling site offering sportsbook, live betting, casino and virtual games. Site displays odds and promotional banners and includes a visible licensing statement claiming regulation by the Kenyan Gambling Regulatory Authority. |
|---|
Evidence status and limitations
Evidence completeness: UNKNOWN
- The real-world operator identity was not independently verified.
- Module-level completeness metadata is unavailable for this legacy report.
At a glance
The checks that decide most of this verdict.
| Malware engines | None flagged itVirusTotal | Clear |
|---|---|---|
| Google Safe Browsing | Not listedGoogle | Clear |
| Abuse reports on the host | 0 reportsAbuseIPDB; shared hosting inflates this count | Noted |
| Domain age | 12 years oldRegistered history | Clear |
| Web archive | Never archivedNo public history of this site | Watch |
| Certificate | Encrypted connectionIssued by WE1 | Noted |
The page as captured
No screenshot is retained for this report.
Key findings
- Automated classification: Sensitive Interaction Risk.
- Domain age: more than 10 years (registration continuity).
- No flags from the reputation services TrustSniffer consulted at assessment time.
- The operator behind the site could not be independently connected to a real-world brand or person.
Full analysis
Overview
betpawa.co.ke is a public-facing Kenyan online gambling platform presenting sportsbook markets, live betting, casino and virtual games, promotional bonuses, odds, and account functions. Its apparent business model is to attract Kenyan customers, require user deposits, and monetize wagers placed across sports and gaming products.
Scam/Impersonation Risk
No contradictions were observed: the available evidence does not identify confirmed phishing, impersonation, malicious reputation, or a conflicting legal identity. The principal concern is interaction risk rather than a confirmed scam indicator. The homepage exposes login, registration, and deposit pathways, while the site’s operating model requires funds before betting or gaming services are provided; this creates material financial exposure even though the business presentation is coherent. Runtime observation also recorded non-whitelisted external requests and substantial page changes after interaction, but no cloaking, hidden forms, wallet-drainer activity, or external password submission was identified. The domain appears long-established, which supports continuity of the web property but does not independently establish the current operator’s identity.
- Domain registration: created 2014-11-29T13:09:26Z; age 11.71 years; expiry 2026-11-29T13:09:26Z.
- Homepage: displays login, signup, and deposit-call-to-action forms for the sportsbook and gaming service.
- Interaction review: 4 external posts and 4 external XHR/fetch requests were observed; 2 external posts and 2 external XHR/fetch requests were non-whitelisted, with a maximum post-interaction DOM difference of 450.
- Homepage content: the business model is explicitly deposit-funded betting and gaming, with “50% Casino Cashback” and “1250% Win Bonus” promotional claims.
Regulatory Verification Notes
The homepage displays a statement claiming regulation by the Kenyan Gambling Regulatory Authority, but the supplied material does not independently verify that claim or provide a license number. The operator’s real-world identity remains unverified, and ownership and governance disclosures are insufficiently established for a low-trust site handling deposits and account credentials. This is a regulatory and transparency verification gap, not evidence of impersonation by itself. External reputation checks did not identify malicious or suspicious detections, and the site has a substantial global traffic footprint; these are supporting signals of an active web presence, not proof of licensing or operator legitimacy. Registration is recorded through HOSTAFRICA EAC.
- Homepage: contains a visible Kenyan regulatory statement but no supplied license number or independent registry confirmation.
- Global traffic ranking: 22,189, with the domain within the top 1,000,000.
- Hosting and transport telemetry: served from AS13335, CLOUDFLARENET - Cloudflare, Inc., US; TLS issued by WE1 at DV validation level, valid to 2026-09-13T09:39:03+00:00.
- External reputation review: 0 malicious detections, 0 suspicious detections, and no confirmed malicious-site result were recorded.
What to Verify Next
Before any sensitive interaction, the claimed operator should be matched to the current register of the Kenyan gambling regulator, including the exact legal entity, license status, approved domain, and permitted product scope. The terms, responsible-gambling, withdrawal, dispute, and privacy pages should be checked for a consistent legal entity and clear handling of deposits and withdrawals. Contact and payment channels should be confirmed through an independently sourced official route rather than relying solely on information presented by the website. Until those checks are complete, browsing should remain limited and no funds or reusable credentials should be committed.
- Regulatory verification control: confirm the homepage claim against the relevant Kenyan regulator’s current public register.
- Identity-control review: compare the legal name across the terms, privacy, responsible-gambling, and contact pages.
- Transaction-control review: confirm withdrawal conditions, dispute mechanisms, payment-recipient identity, and applicable deposit protections before funding an account.
Summary Verdict
The overall posture is low trust, with sensitive-interaction risk driven primarily by insufficiently established governance around a deposit-funded service. The available technical, traffic, and reputation signals indicate a functioning and established web presence, but they do not overcome the unresolved question of who operates the service or whether its regulatory claim is independently valid.
Infrastructure Integrity
The website is protected by Cloudflare CDN/WAF infrastructure, and the observed addresses were CDN edge delivery points rather than a directly exposed origin. This reduces direct origin exposure and is a mitigating infrastructure control, but it does not establish operator legitimacy or prevent rapid changes in site content.
- Infrastructure: Cloudflare CDN/WAF detected; 2 edge IP addresses observed and 0 likely origin IP candidates identified.
- Edge delivery: 31.185.108.14 and 31.185.108.236 were observed on AS13335.
- Hosting geography: the observed infrastructure resolved through DE-based edge delivery.
Closing Assessment
A prospective user should defer login, credential reuse, and financial transactions until the operator, license, domain authorization, and withdrawal protections have been independently confirmed through authoritative channels.
Written analysis generated 2026-08-13 by the TrustSniffer Analysis Engine from the evidence in this report.
What the analysis found
2 findings contributed to this verdict, raised by registration and ownership, behaviour in a sandbox.
01 Governance Risk
- The public registration record for this domain is incomplete.Registration and ownership
rule:KF_WHOIS_INCOMPLETE
02 Sensitive Interaction Risk
- The page sent data to a destination TrustSniffer does not recognise.Behaviour in a sandbox
rule:BEHAV_NONWHITELISTED_POSTS - The structure of the page changed sharply while it was loading.Behaviour in a sandbox
rule:BEHAV_DOM_DENSITY_SPIKE
Identity verification
| Status | UNVERIFIED |
|---|---|
| Identity score | 30/100 |
| Identity verification confidence | 50% |
- No on-site identity signals detected
Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence.
What TrustSniffer observed
First-party facts recorded during the assessment of betpawa.co.ke.
- The request stayed on betpawa.co.ke. It was not redirected to another domain. Clear
- Registration is published under HOSTAFRICA EAC. Clear
- DNS for this domain is served by cloudflare.com, across 2 name servers. Noted
- The registration is paid up to 2026-11-29. Noted
- It is hosted on CLOUDFLARENET, from a server in DE. Noted
Domain intelligence
| Registrar | HOSTAFRICA EAC |
|---|---|
| Hosting | CLOUDFLARENET - Cloudflare, Inc., US |
| Country | DE |
| Server IP | 31.185.108.236 |
| Name servers | isla.ns.cloudflare.com, damian.ns.cloudflare.com |
| SSL issuer | WE1 |
| SSL expiry | 2026-09-13 |
| Domain age | 11.71 years (continuous registration) |
| Domain expiry | 2026-11-29 |
| Archive first seen | Not available |
| Archive snapshots | 0 |
| Reputation | VirusTotal: 0 flagged | AbuseIPDB: 0 reports | Google Safe Browsing: 0 matches |
About this assessment
A trust score summarises the evidence TrustSniffer could collect about betpawa.co.ke at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present.
TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed.