Verdict
tmu.ac.ke appears legitimate.
Our checks found nothing pointing to fraud. Ordinary care still applies when you pay or sign in.
| What this site appears to be | Official-style homepage for Tom Mboya University in Kenya, presenting admissions, academic programmes, faculties, research, student services, news, events, institutional resources, and verifiable contact information. |
|---|
Evidence status and limitations
Evidence completeness: UNKNOWN
- Module-level completeness metadata is unavailable for this legacy report.
At a glance
The checks that decide most of this verdict.
| Malware engines | None flagged itVirusTotal | Clear |
|---|---|---|
| Google Safe Browsing | Not listedGoogle | Clear |
| Abuse reports on the host | 0 reportsAbuseIPDB; shared hosting inflates this count | Noted |
| Domain age | 4.0 years oldRegistered history | Clear |
| Web archive | Never archivedNo public history of this site | Watch |
| Certificate | Encrypted connectionIssued by GoGetSSL RSA DV CA | Noted |
The page as captured
No screenshot is retained for this report.
Key findings
- Automated classification: Not Scam.
- Domain age: 3 to 10 years (registration continuity).
- No flags from the reputation services TrustSniffer consulted at assessment time.
- The operator behind the site could not be independently connected to a real-world brand or person.
Full analysis
Overview
The website presents Tom Mboya University’s academic and institutional services, including admissions, degree and certificate programmes, research, student support, governance resources, short courses, tenders, careers, and campus news, serving as the university’s primary public-information and service-access portal.
Scam/Impersonation Risk
No identity contradictions, phishing indicators, impersonation evidence, or adverse reputation signals were observed. The institutional identity is consistently reinforced by the university name, education-focused content, and Kenya’s restricted academic namespace. Interactive testing identified no credential-harvesting forms, concealed forms, suspicious scripts, external data submissions, wallet-related activity, clipboard manipulation, or cloaking. These signals support the conclusion that this is a legitimate institutional website rather than a deceptive imitation.
- The homepage consistently identifies Tom Mboya University and presents coherent admissions, academic, research, healthcare, library, governance, and student-service content.
- The domain was registered in 2022 and is approximately 3.96 years old; its `ac.ke` suffix is reserved for Kenya’s academic namespace.
- External reputation checks recorded 0 malicious and 0 suspicious detections, no malicious safe-browsing classification, no external blacklist finding, and no abuse reports.
- Two successful behavioral runs observed 0 external XHR requests, 0 external POST requests, 0 suspicious inline scripts, and no hidden or password-collection forms.
Regulatory Verification Notes
The homepage provides dedicated routes for governance, accreditation, the service charter, strategic planning, contracts awarded, and tenders, reflecting an institutionally structured disclosure model. The supplied evidence does not establish the outcome of any independent accreditation or statutory-registry check; this is a scope limitation rather than an adverse finding. No broker-related third-party reputation record was matched, which is unsurprising for a higher-education institution and carries no regulatory implication.
- The homepage navigation specifically includes Governance, Accreditation, Service Charter, Strategic Plan, Tenders, and Contracts Awarded pages.
- The academic offering is organized into undergraduate, postgraduate, diploma, certificate, international-student, and short-course pathways on the homepage.
- The site is served from AS16276 (OVH SAS, France).
- Transport encryption uses a domain-validated certificate issued by GoGetSSL RSA DV CA, valid until 2026-09-07.
What to Verify Next
For formal institutional due diligence, the university’s current legal standing and programme accreditation should be confirmed directly with the relevant Kenyan education authorities. Prospective applicants should independently validate programme eligibility, admissions routes, fee instructions, and official contact channels before making binding enrolment or payment decisions. Procurement counterparties should also reconcile tender documents and contract notices with the responsible university office.
- The homepage directs applicants to KUCCPS information, international-student information, and an application function, making admissions-route validation relevant.
- The site advertises undergraduate, postgraduate, diploma, certificate, and short-course options whose current approval and intake status may vary by programme.
- Separate Tenders and Contracts Awarded resources indicate that procurement documents may support transaction-specific verification.
- The homepage publishes physical contact details and institutional contact information that can support independent confirmation.
Summary Verdict
The website is assessed as a legitimate, established, and trustworthy university portal. Its coherent institutional identity, clean security and reputation profile, and mature academic content support normal interaction, including account login and standard use.
Infrastructure Integrity
The site uses a trusted CDN/WAF arrangement, with the observed address operating as an edge server and the origin protected from direct exposure. This reduces direct infrastructure exposure and supports operational resilience, although protective infrastructure is a security control rather than independent proof of institutional legitimacy.
Closing Assessment
Normal use is appropriate; prospective applicants and commercial counterparties should apply routine institutional due diligence before completing enrolment, payment, or procurement commitments.
Written analysis generated 2026-08-03 by the TrustSniffer Analysis Engine from the evidence in this report.
What the analysis found
No rule findings contributed to this verdict.
Identity verification
| Status | UNVERIFIED |
|---|---|
| Identity score | 55/100 |
| Identity verification confidence | 60% |
- Identity verified on page
Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence.
What TrustSniffer observed
First-party facts recorded during the assessment of tmu.ac.ke.
- The request stayed on tmu.ac.ke. It was not redirected to another domain. Clear
- Registration is published under Truehost AI. Clear
- DNS for this domain is served by cloudoon.net, across 2 name servers. Noted
- The registration is paid up to 2026-08-17. Noted
- It is hosted on OVH, from a server in FR. Noted
Domain intelligence
| Registrar | Truehost AI |
|---|---|
| Hosting | OVH - OVH SAS, FR |
| Country | FR |
| Server IP | 54.36.110.109 |
| Name servers | ns301.cloudoon.net, ns301.cloudoon.com |
| SSL issuer | GoGetSSL RSA DV CA |
| SSL expiry | 2026-09-07 |
| Domain age | 4.0 years |
| Domain expiry | 2026-08-17 |
| Archive first seen | Not available |
| Archive snapshots | 0 |
| Reputation | VirusTotal: 0 flagged | AbuseIPDB: 0 reports | Google Safe Browsing: 0 matches |
About this assessment
A trust score summarises the evidence TrustSniffer could collect about tmu.ac.ke at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present.
TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed.