Verdict
kilimall.co.ke appears legitimate.
Our checks found nothing pointing to fraud. Ordinary care still applies when you pay or sign in.
| What this site appears to be | Marketplace landing/category page for Kilimall focused on Kenyan market: product listings, flash sales, app download prompts, payment and buyer-protection claims, and customer support links. |
|---|
Evidence status and limitations
Evidence completeness: UNKNOWN
- The real-world operator identity was not independently verified.
- Module-level completeness metadata is unavailable for this legacy report.
At a glance
The checks that decide most of this verdict.
| Malware engines | None flagged itVirusTotal | Clear |
|---|---|---|
| Google Safe Browsing | Not listedGoogle | Clear |
| Abuse reports on the host | 0 reportsAbuseIPDB; shared hosting inflates this count | Noted |
| Domain age | 12 years oldRegistered history | Clear |
| Web archive | Archived since 2014474 snapshots | Clear |
| Certificate | Encrypted connectionIssued by RapidSSL TLS RSA CA G1 | Noted |
The page as captured
No screenshot is retained for this report.
Key findings
- Automated classification: Not Scam.
- Domain age: more than 10 years (registration continuity).
- Public web-archive history exists since 2014.
- No flags from the reputation services TrustSniffer consulted at assessment time.
Full analysis
Overview
The website is Kilimall, a Kenya-focused online retail marketplace presenting consumer goods, promotional offers, app access, payment options, and customer-support services for shoppers and marketplace sellers.
Scam/Impersonation Risk
No phishing, impersonation, blacklist, malicious-content, or conflicting-identity indicators were observed. The homepage presents a conventional retail model with product categories, flash-sale listings, app-download prompts, buyer-protection claims, and customer-support links; the displayed examples are ordinary consumer goods rather than inherently suspicious financial or investment products. Runtime testing did observe substantial external network activity, but it also found no cloaking, hidden forms, wallet connections, credential-exfiltration forms, clipboard activity, or wallet-drainer behavior. The available evidence therefore supports an apparently legitimate, low-risk retail site, while independently verifying the real-world operator remains appropriate before sensitive transactions.
- The homepage identifies the service as “Kilimall - Affordable Online Shopping in Kenya” and provides product categories, flash-sale content, account access, cart functionality, and customer-support navigation.
- Domain registration evidence records creation on 2014-05-12 and an age of 12.26 years; the registrar is Webhost Ultima Limited.
- Historical records contain 474 snapshots spanning 2014-08-10 to 2026-08-07 across 13 tracked years, with the historical and current content remaining within the ecommerce category.
- Browser testing recorded 39 external XHR requests and 27 external POST requests, including 15 non-whitelisted XHR requests and 4 non-whitelisted POST requests; no hidden forms, password forms submitted externally, wallet activity, cloaking, or clipboard hijacking was detected.
Regulatory Verification Notes
The site is presented as a consumer marketplace rather than a financial or other specifically regulated service. The supplied homepage content does not identify a licensing authority or registration number, so regulatory licensing is not the central legitimacy question here; the relevant gap is confirmation of the merchant entity, seller terms, returns process, and buyer-protection obligations. The site’s apparent legitimacy is supported by its long operating history, established page content, clean external reputation checks, and valid transport encryption, but the operator’s real-world identity is not independently verified.
- The captured marketplace page contains product-sale, payment, delivery, buyer-protection, and customer-support claims but no identified license authority or license number.
- The domain was registered in 2014 and expires on 2027-05-12; registration is through Webhost Ultima Limited.
- The site’s TLS certificate is Domain Validated, issued by RapidSSL TLS RSA CA G1, and valid through 2027-02-22.
- External reputation checks recorded zero malicious detections, zero suspicious detections, no Google Safe Browsing malicious result, and no blacklist result.
What to Verify Next
Before credential or payment interactions, the prospective user should independently confirm the legal merchant identity shown in the site’s terms, seller, or company information; review refund, delivery, dispute, and buyer-protection conditions; and confirm that the intended payment method provides an effective chargeback or dispute route. Support and contact channels should be confirmed through an independently sourced route rather than relying solely on page-provided details.
- The homepage links to a Help Center, customer-support functions, seller-facing access, and account registration or login.
- The page advertises payment and buyer-protection services, making the precise scope of those protections material to any purchase decision.
- The marketplace displays flash-sale pricing and a broad seller/product inventory, so item-level seller information, delivery terms, and return conditions should be checked for each transaction.
Summary Verdict
Available evidence is consistent with an established, apparently legitimate website and supports a high-trust, low-risk posture with no observed scam or impersonation contradictions. The classification is strong, but it does not independently prove the identity of the real-world operator.
Infrastructure Integrity
The site resolves to a single likely origin address hosted by Huawei Cloud in Singapore, with no CDN or WAF detected in the supplied infrastructure assessment. This provides identifiable hosting context but should be treated as a technical mitigating or contextual signal, not as proof of legitimacy.
- Hosted on AS136907, HWCLOUDS-AS-AP – HUAWEI CLOUDS, HK, with one resolved IP address and no detected CDN edge addresses.
Closing Assessment
Normal browsing and ordinary marketplace use are proportionate to the available evidence; independent merchant, transaction-protection, and seller-specific checks should be completed before entering credentials or making a material payment.
Written analysis generated 2026-08-11 by the TrustSniffer Analysis Engine from the evidence in this report.
What the analysis found
No rule findings contributed to this verdict.
Identity verification
| Status | UNVERIFIED |
|---|---|
| Identity score | 30/100 |
| Identity verification confidence | 50% |
- No on-site identity signals detected
Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence.
What TrustSniffer observed
First-party facts recorded during the assessment of kilimall.co.ke.
- The request stayed on kilimall.co.ke. It was not redirected to another domain. Clear
- Registration is published under Webhost Ultima Limited. Clear
- DNS for this domain is served by domaincontrol.com, across 2 name servers. Noted
- The registration is paid up to 2027-05-12. Noted
- The earliest public archive of this site is from 2014-08-10. Clear
- It is hosted on HWCLOUDS-AS-AP, from a server in SG. Noted
Domain intelligence
| Registrar | Webhost Ultima Limited |
|---|---|
| Hosting | HWCLOUDS-AS-AP - HUAWEI CLOUDS, HK |
| Country | SG |
| Server IP | 110.238.79.106 |
| Name servers | mns02.domaincontrol.com, mns01.domaincontrol.com |
| SSL issuer | RapidSSL TLS RSA CA G1 |
| SSL expiry | 2027-02-22 |
| Domain age | 12.26 years (continuous registration) |
| Domain expiry | 2027-05-12 |
| Archive first seen | 2014-08-10 |
| Archive snapshots | 474 |
| Reputation | VirusTotal: 0 flagged | AbuseIPDB: 0 reports | Google Safe Browsing: 0 matches |
About this assessment
A trust score summarises the evidence TrustSniffer could collect about kilimall.co.ke at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present.
TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed.