Is carrosel.co.ke a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This is a Kenya-based cleaning-services website for Carrosel Cleaning Services Ltd, presenting residential and commercial cleaning, pest control, post-construction cleaning, service-area information, FAQs, contact details, and a quote-request process intended to generate paid service engagements in Nairobi and surrounding counties.

Scam/Impersonation Risk

The site’s content presents a conventional local-services business and the reviewed pages contain no login form, hidden sensitive form, wallet function, or explicit phishing mechanism. However, this benign presentation is outweighed by confirmed external threat detections: four malicious and one suspicious detections were recorded, and the domain appears on external blacklist sources. These signals create a material risk that the website or its infrastructure may be unsafe for sensitive interaction, even though the page-level content itself contains no explicit fraud red flags. No separate identity inconsistency or brand-impersonation finding was identified in the supplied evidence.

Regulatory Verification Notes

The About and homepage content identifies the business as Carrosel Cleaning Services Ltd and describes it as a Kenya-based contract cleaning company. The site claims “15+ Years Experience,” “1000+ Clients Served,” “24/7 Support,” and a “4.9” client-trust figure, but the supplied pages provide no supporting evidence for those counters or claims. No licence, registration number, or regulatory authority is disclosed in the reviewed content; for a cleaning contractor this is principally a verification and transparency gap rather than standalone evidence of fraud. The real-world operator identity remains unverified, and the apparent business identity should not be treated as independently established.

What to Verify Next

Before any commercial engagement, an independent registry or corporate-record check should confirm the operating entity associated with the site and the legal capacity to contract. The quoted scope, beneficiary details, physical operating presence, insurance position, and references should be validated through independently sourced channels rather than relying solely on the website. Any payment should use a method providing dispute or recovery protections, and sensitive account or credential activity should remain suspended unless the external threat findings are resolved.

Summary Verdict

The overall posture is critical risk. The website’s professional local-business presentation does not offset the confirmed external threat and blacklist signals, while the operator’s identity remains unverified. Sensitive interaction, credential submission, and financial engagement are not appropriate on the available evidence.

Infrastructure Integrity

The site is hosted directly on one identified likely-origin address in Safaricom Limited’s AS37061 network in Kenya, with no detected CDN or WAF layer and no edge-IP separation. The DV TLS certificate provides transport encryption but does not authenticate the business operator; infrastructure therefore offers no meaningful basis for reducing the external reputation concern.

Closing Assessment

The appropriate disposition is to restrict activity to passive review and defer login, credential submission, payment, or contractual commitment until independent business verification and resolution of the external security detections have been completed.