What Gridinsoft observed on Retrak.co.ke
A Gridinsoft threat analyst reviewed the site directly and documented the evidence behind this decision.
GMA-20260826203235-832972c2
- Reviewed
- by Gridinsoft Threat Analyst
- Analyst finding
- Safe
- Evidence basis
- First-party site analysis External vendor intelligence: Contradictory context — not used for this decision
The current independent first-party review supports a Safe classification for the reviewed public deployment of retrak.co.ke. A concrete LokiBot command-and-control URL genuinely existed on an older deployment in 2022, but that exact object and related historical paths now return HTTP 404, the site and hosting changed in August 2026, and fresh checks of the current root, representative pages, forms, redirects, request profiles, and scripts reproduced no harmful behavior. The conflicting broad warning was corrected; residual external blacklist and threat-intelligence records remain separately controlled historical context and did not determine this verdict.
Analyst findings
Review 6 documented observations View evidence
Fresh supported Gridinsoft checks reached the current HTTPS root with HTTP 200 and identified the RETRAK Home page. Direct review found no current positive behavior signal or exact malicious URL, redirect, file, payload, exploit, or hash. After the unsupported broad warning was corrected, the authoritative current report showed Safe.
-
HTTP status
200 -
Final URL
https://retrak.co.ke/ - Page element Title: RETRAK Home
- Analyst observation The current supported review reproduced no exact malicious object or harmful behavior on the reviewed deployment.
The root and twelve representative public pages returned HTTP 200 with coherent Retail Trade Association of Kenya content covering its mandate, committee, summit, advocacy, membership, news, publications, downloads, and FAQs. Two stale menu destinations returned HTTP 404. No unrelated redirect, meta refresh, automatic executable delivery, recovery-phrase request, or current phishing object was reproduced.
- Analyst observation The root and 12 representative public content pages returned HTTP 200; two stale menu destinations returned HTTP 404.
- Analyst observation The reviewed pages consistently presented RETRAK organization, membership, advocacy, publication, and current news content.
- Analyst observation No unrelated redirect, meta refresh, automatic executable delivery, recovery-phrase request, or current phishing object was identified on the reviewed public surface.
Desktop, crawler, command-line, apex, and www requests produced identical normalized visible root content. Public Joomla login, registration, and administrator forms posted to the same site and used ordinary username, password, name, and email fields. Four site JavaScript assets and page references showed standard same-origin Joomla and page-builder behavior; no hidden credential receiver, command-launch flow, or malware-delivery code was reproduced.
- File SHA-256 a6327cc355775da36396bfe7609d908989b9b23c5d7c5642e10d29279bacd00d
- Analyst observation The normalized visible root content was identical across desktop, crawler, command-line, apex, and www request profiles.
- Analyst observation The public account forms were same-origin Joomla forms; no unrelated credential destination or hidden frame was found.
- Analyst observation Targeted review of four current JavaScript assets reproduced standard same-origin site behavior and no command-launch, executable-delivery, or recovery-phrase logic.
AhnLab ASEC's October 2022 malware statistics identify the exact retrak.co.ke/psy/five/fre.php URL as LokiBot command-and-control infrastructure. This is a concrete historical malicious URL, not merely a domain blacklist label. The current exact URL, two related historical paths, and their language-prefixed variants now return HTTP 404. No current malware file, payload, automatic download, or payload hash was found.
- Public artifact URL https://asec.ahnlab.com/en/41139/
- Public artifact URL https://urlscan.io/domain/retrak.co.ke
-
HTTP status
404 - Analyst observation The historical record names an exact LokiBot command-and-control URL; the current server no longer serves that URL or the related reviewed paths.
- Analyst observation No current malware file, payload, automatic download, or payload hash was identified.
Public URL-scan records show the old 102.130.122.114 deployment presenting a Bot Verification page through 2026-08-02, a different 50.6.42.29 host presenting a Coming Soon page on 2026-08-16, and the current 162.0.209.21 host presenting RETRAK Home on 2026-08-24. A Wayback capture from 2026-08-15 also preserved the Coming Soon deployment. Current DNS and the newly issued certificate match the current host transition.
- Public artifact URL https://urlscan.io/domain/retrak.co.ke
- Public artifact URL https://web.archive.org/web/20260815132956id_/https://retrak.co.ke/
- DNS fact retrak.co.ke currently resolves to 162.0.209.21 and www.retrak.co.ke is an alias of the apex.
- Certificate fact The reviewed certificate covers retrak.co.ke and www.retrak.co.ke and is valid from 2026-08-22 through 2027-03-08.
- Analyst observation The public timeline independently supports a recent hosting and site transition after the historical malicious object.
Public OSINT separates object-level evidence from residual reputation. URLscan indexed 137 domain results and preserved the historical exact paths, while its latest record showed the current RETRAK Home deployment. OTX returned domain-level pulses tied mainly to historical LokiBot and bulk IOC collections, but zero pulses for the exact www host; its current root URL result returned HTTP 200 with no Safe Browsing match. Search-indexed public sandbox queries did not expose a current sample, and no completeness claim is made.
- Public artifact URL https://otx.alienvault.com/indicator/domain/retrak.co.ke
- Public artifact URL https://otx.alienvault.com/indicator/hostname/www.retrak.co.ke
- Public artifact URL https://urlscan.io/domain/retrak.co.ke
- Analyst observation The concrete historical LokiBot URL and the residual domain-level blacklist entries are different evidence types and were assessed separately.
- Analyst observation No current search-indexed sandbox sample was identified; restricted or unindexed systems were not treated as negative proof.
Scope and limitations
- The verdict applies to the publicly reachable retrak.co.ke deployment reviewed at the recorded time and does not guarantee future content.
- The review did not access the private hosting filesystem, database, administrator accounts, scheduled tasks, mail server, security-product console, or server logs.
- No public login or registration form was submitted, no account or credential was used, and no object was executed.
- The ticket referenced an attachment, but no attachment was present in the Portal record available for this review.
- Public evidence confirms an exact historical LokiBot URL but does not reconstruct every historical response or determine the complete compromise interval; restricted or unindexed sandboxes were not treated as negative proof.
Help protect others by sharing this page on social media! The more people who know about retrak.co.ke, the fewer chances they have to deceive someone else. Help others evaluate retrak.co.ke by sharing this page on social media!