# PhishDestroy domain threat record: alexstewartinternationalltd.rw

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/alexstewartinternationalltd.rw/
Machine-readable companion: https://phishdestroy.io/domain/alexstewartinternationalltd.rw/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-07 00:53:54 UTC
- Last availability or vendor check: 2026-10-22 10:25:59 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 11/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: yahoo

## Stored infrastructure

- Observed IP address: 185.151.30.221
- Registrar in stored WHOIS data: SKYLINE DIGITAL
- Last stored HTTP status: 200
- Registration date (registry RDAP, alexstewartinternationalltd.rw): 2019-03-05 18:09:40 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a113d8-6d47-72ad-ad82-c0c82717c8eb/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/alexstewartinternationalltd.rw
- Certificate Transparency search: https://crt.sh/?q=%25.alexstewartinternationalltd.rw
- Web Archive lookup: https://web.archive.org/web/*/https://alexstewartinternationalltd.rw/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
alexstewartinternationalltd.rw is an impersonation phishing page that copies the identity of Alex Stewart International, a metal testing, inspection and analysis brand. Its page title claims coverage of Rwanda, DR Congo, Burundi, Ethiopia, Uganda, Tanzania and Zambia, which points at traders, buyers and intermediaries in that region's minerals and metals business. PhishDestroy first flagged it on 2026-10-07. As of 2026-10-19 the site was still online and redirecting visitors.

How the scam works
The page presents itself as the regional office of a recognised inspection laboratory. A copied lab identity lends false authority, and in commodity fraud a fake testing site is typically used to vouch for forged assay or inspection certificates. Victims are usually pushed toward an advance payment for metal that does not exist or is not what the paperwork claims. A site like this can also collect contact details, documents or logins from people who believe they are dealing with the genuine company. The loss is usually money sent on the strength of fake verification, plus any business data handed over.

Evidence
On 2026-10-07, 11 of 92 VirusTotal engines flagged the domain. Named detections came from alphaMountain.ai, BitDefender, Chong Lua Dao, ESET, G-Data, Gridinsoft, Kaspersky and Lionic. That is a minority of engines, but it includes several major antivirus vendors that reached the same conclusion independently. The domain also appears in four AlienVault OTX threat pulses, which shows other analysts are tracking it. Among blocklists, it is currently listed by PhishDestroy.

Infrastructure
The domain was registered on 2019-03-05 through SKYLINE DIGITAL, more than seven years before PhishDestroy detected it. An aged Rwandan country-code domain looks far more credible to a regional business partner than a fresh registration. Hosting sits on the 20i Limited network in Great Britain. The site carries a RapidSSL certificate from DigiCert, which encrypts the connection but says nothing about who runs the site.

What to do
Do not rely on any inspection report, assay certificate or contact details obtained through this domain. Confirm them directly with Alex Stewart International through contacts you already trust. If you paid money or are in a deal backed by its paperwork, stop further payments, contact your bank and report the matter to police. If you entered a password here, change it wherever you reuse it and turn on two-factor authentication. Defenders should block the domain at mail and web gateways, alert procurement and trade-finance teams to the brand being used, and flag messages that cite this domain as a verification source.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a113d8-6d47-72ad-ad82-c0c82717c8eb/
VirusTotal report: https://www.virustotal.com/gui/domain/alexstewartinternationalltd.rw
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=alexstewartinternationalltd.rw
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 11:04:08 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a113d8-6d47-72ad-ad82-c0c82717c8eb.png
  Captured: 2026-10-07 00:53:54 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a113d8-6d47-72ad-ad82-c0c82717c8eb.png
  Captured: 2026-10-07 00:53:54 UTC
  Source report: https://urlscan.io/result/01a113d8-6d47-72ad-ad82-c0c82717c8eb/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/3611edeb-2e2f-48ce-9925-a73bde6374db.png
  Captured: 2026-10-07 01:26:03 UTC
  Source report: https://radar.cloudflare.com/scan/3611edeb-2e2f-48ce-9925-a73bde6374db
  SHA-256: eec68dd7e6d0eef253273a98f97883061d4cd9ece629ca45aedb1be7c8b5e2c1
- URLQuery: https://screenshots.phishdestroy.io/uq/953e191d-c5e0-46c4-9857-e11b4dd622c5.png
  Source report: https://urlquery.net/report/953e191d-c5e0-46c4-9857-e11b4dd622c5
  SHA-256: c105347de5c42f4b6af0a2a27b5f4bac142fe04de97e04d2b25ba3e5e9df7f1b
- URLScan · 2026-10-07: https://screenshots.phishdestroy.io/us/01a113d4-ede3-70da-96f4-2d442a46dd31.png
  Captured: 2026-10-07 00:48:11 UTC
  Source report: https://urlscan.io/result/01a113d4-ede3-70da-96f4-2d442a46dd31/
  SHA-256: f9c7c49c00d259ca749973fa300dba9f0adfc22b4dc9f5635ade2cfb8563e1f8

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T19:29:00Z",
        "uuid": "01a113d8-6d47-72ad-ad82-c0c82717c8eb",
        "scanned_at": "2026-10-07T00:52:01Z",
        "final_url": "https://alexstewartinternationalltd.rw/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://alexstewartinternationalltd.rw/",
                "from": "http://alexstewartinternationalltd.rw/",
                "status": 307
            }
        ],
        "ip": "185.151.30.221",
        "ptr": "185-151-30-221.ptr4.stackcp.net",
        "domains": [
            "www.youtube.com",
            "jnn-pa.googleapis.com",
            "googleads.g.doubleclick.net",
            "www.google.com",
            "alexstewartinternationalltd-rw.stackstaging.com",
            "fonts.gstatic.com",
            "i.ytimg.com",
            "static.doubleclick.net",
            "ad.doubleclick.net",
            "region1.google-analytics.com",
            "geo.wpforms.com",
            "www.googletagmanager.com",
            "fonts.googleapis.com"
        ],
        "ips": [
            "172.217.113.4",
            "142.251.14.119",
            "142.251.127.149",
            "142.251.20.155",
            "142.251.156.4",
            "142.250.154.148",
            "142.251.157.119",
            "216.239.32.36",
            "142.251.155.4",
            "45.8.227.97",
            "172.66.159.250",
            "142.251.14.94",
            "192.178.183.97",
            "142.251.20.95",
            "185.151.30.221"
        ],
        "asns": [
            "15169",
            "48254",
            "13335"
        ],
        "countries": [
            "US",
            "GB"
        ],
        "link_domains": [
            "alexstewartinternationalltd-rw.stackstaging.com",
            "www.linkedin.com",
            "page1marketing.co.uk"
        ],
        "doc_hash": "43f523c92a09fcd47bd3cf26b064bf80213819276a32053e0fdb982cf37eaea7",
        "script_hashes": [
            "cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf",
            "5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89",
            "8fa22ff4bb580e0c99dcb11a1c19293ee30029ac6eba0b33e171cbe98260e490",
            "7239c4e87fc8fa3134b5fe1e779c667cc2bb8f75ff90f0f7d54f85b634174192",
            "b65b3de1bc923b9355248a0d941a0eaee15dfb9a6b8eadb51323a8df6189dcd1",
            "68918493fab5f333343716eae17cc90f989906c3021984e9ad5e95e36aef4a63",
            "244fc0d1bd29eae154fa9346040f14aad289c584856a7522e25ea1d3ba34780f",
            "ca63a56d305249eb4cddeec8a6501010e206e110445f46572be1f2d56a1785fd",
            "5a25fcee2abe666889666a26a4ee6b0eb4e2a1a7684e3a5f60be9b4e35d71c2b",
            "6678f5308a4fd9620f440c3e6433920f9a09a9d6465a13888d9638aa23d70191"
        ],
        "globals": [
            "jQuery",
            "gtag",
            "dataLayer",
            "localize",
            "isEditMode",
            "ea",
            "eael",
            "EvEmitter",
            "imagesLoaded",
            "jQueryBridget",
            "getSize",
            "matchesSelector",
            "fizzyUIUtils",
            "Outlayer",
            "Isotope",
            "Masonry",
            "oceanwpLocalize",
            "oceanwp",
            "Flickity",
            "Unipointer",
            "Unidragger",
            "mapplic_localization",
            "webpackChunkelementor",
            "elementorModules",
            "elementorFrontendConfig",
            "elementorFrontend",
            "_",
            "_wpUtilSettings",
            "wp",
            "wpformsElementorVars",
            "WPFormsElementorFrontend",
            "intlTelInputGlobals",
            "Inputmask",
            "default",
            "Mailcheck",
            "punycode",
            "wpforms",
            "WPForms",
            "wpforms_settings",
            "_wpemojiSettings"
        ],
        "cookies": [
            "_wpfuuid",
            "YSC",
            "VISITOR_INFO1_LIVE",
            "VISITOR_PRIVACY_METADATA",
            "_ga_N5EN4C3TDB",
            "_ga",
            "_gcl_au",
            "__Secure-YNID",
            "__Secure-ROLLOUT_TOKEN"
        ],
        "storage_keys": [
            "wpEmojiSettingsSupports",
            "_gcl_ls"
        ],
        "tls": {
            "san": [
                "www.alexstewartinternationalltd.rw",
                "alexstewartinternationalltd.rw"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "RapidSSL TLS RSA CA G1",
            "subject": "www.alexstewartinternationalltd.rw",
            "protocol": "TLS 1.3",
            "valid_to": "2026-11-27T23:59:59Z",
            "valid_from": "2025-11-05T00:00:00Z"
        },
        "domain_age_days": 2079,
        "apex_age_days": 2079,
        "tls_age_days": 336,
        "tls_valid_days": 387,
        "requests": 134,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 69,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "Apache",
            "content-type": "text/html; charset=UTF-8",
            "x-powered-by": "PHP/8.3.35"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T19:38:26Z",
        "uuid": "3611edeb-2e2f-48ce-9925-a73bde6374db",
        "scanned_at": "2026-10-07T01:26:03Z",
        "final_url": "https://alexstewartinternationalltd.rw/",
        "status": 200,
        "history": [
            {
                "url": "https://alexstewartinternationalltd.rw/",
                "status": 200
            }
        ],
        "dom_hash": "23bc369c7389c065ab5872d772a4504f7590257f3423e942f93a55a336aa4cac",
        "doc_hash": "43f523c92a09fcd47bd3cf26b064bf80213819276a32053e0fdb982cf37eaea7",
        "domain_risks": [
            "Malware",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "alexstewartinternationalltd.rw",
                "type": "A",
                "value": "185.151.30.221"
            }
        ],
        "dnssec_valid": false,
        "ip": "185.151.30.221",
        "verdict": {
            "tags": [
                "malware"
            ],
            "malicious": true,
            "categories": [
                "malware"
            ]
        },
        "whois": {
            "registrar": "SKYLINE DIGITAL",
            "created": "2019-03-05T18:09:40Z",
            "updated": "2026-03-22T16:00:17Z",
            "expires": "2027-03-05T18:09:40Z",
            "nameservers": [
                "dns2.namecheaphosting.com",
                "dns1.namecheaphosting.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T10:27:52Z",
        "analysis_at": "2026-10-13T23:20:52Z",
        "stats": {
            "timeout": 0,
            "harmless": 46,
            "malicious": 13,
            "suspicious": 0,
            "undetected": 33
        },
        "detections": {
            "ESET": "phishing",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "Webroot": "malicious",
            "SOCRadar": "phishing",
            "Kaspersky": "phishing",
            "Gridinsoft": "phishing",
            "BitDefender": "phishing",
            "Chong Lua Dao": "malicious",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "categories": {
            "Sophos": "phishing and fraud",
            "Webroot": "Phishing and Other Frauds",
            "BitDefender": "news",
            "alphaMountain.ai": "Business/Economy, Phishing (alphaMountain.ai)",
            "Xcitium Verdict Cloud": "marketing & merchandising",
            "Forcepoint ThreatSeeker": "phishing and other frauds. business and economy"
        },
        "popularity": {
            "Alexa": 720482,
            "Statvoo": 720482
        },
        "registrar": "SKYLINE DIGITAL",
        "created": "2019-03-05T18:09:40Z",
        "expires": "2027-03-05T18:09:40Z",
        "updated": "2026-03-22T16:00:17Z",
        "first_seen": "2023-10-04T02:19:05Z",
        "dns": [
            {
                "ttl": 1200,
                "type": "A",
                "value": "185.151.30.221"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "dns2.namecheaphosting.com"
            },
            {
                "ttl": 1200,
                "type": "MX",
                "value": "mail.alexstewartinternationalltd.rw",
                "priority": 0
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "dns1.namecheaphosting.com"
            },
            {
                "ttl": 21600,
                "type": "SOA",
                "rname": "cpanel.tech.namecheap.com",
                "value": "dns1.namecheaphosting.com"
            },
            {
                "ttl": 1200,
                "type": "TXT",
                "value": "v=spf1 ip4:198.187.29.15 ip4:10.10.10.12 include:spf.web-hosting.com ip4:198.187.29.17 +mx +a +ip4:198.54.114.239 ~all"
            }
        ],
        "dns_at": "2026-10-13T23:23:28Z",
        "jarm": "15d3fd16d29d29d00042d43d000000fbc10435df141b3459e26f69e76d5947",
        "cert": {
            "san": [
                "www.alexstewartinternationalltd.rw",
                "alexstewartinternationalltd.rw"
            ],
            "issuer": "DigiCert Inc / RapidSSL TLS RSA CA G1",
            "serial": "6bbba0f853574ff240811f37a70674",
            "sha256": "d7424ae5da08ae2fc6ec0c551498f86641a3fa9487a3fa99f388e37fe7511487",
            "subject": "www.alexstewartinternationalltd.rw",
            "valid_to": "2026-11-27T23:59:59Z",
            "valid_from": "2025-11-05T00:00:00Z"
        },
        "whois": {
            "registrar": "SKYLINE DIGITAL",
            "created": "2019-03-05T18:09:40Z",
            "updated": "2026-03-22T16:00:17Z",
            "expires": "2027-03-05T18:09:40Z",
            "status": [
                "active"
            ],
            "nameservers": [
                "dns1.namecheaphosting.com",
                "dns2.namecheaphosting.com"
            ]
        },
        "rdap": {
            "status": [
                "active",
                "DS automation disabled",
                "NS automation disabled"
            ],
            "events": {
                "expiration": "2027-03-05T18:09:40Z",
                "last changed": "2026-03-22T16:00:17Z",
                "registration": "2019-03-05T18:09:40Z",
                "reregistration": "2020-03-04T09:23:07Z",
                "reinstantiation": "2021-04-07T09:29:50Z",
                "registrar expiration": "2027-03-05T18:09:40Z",
                "last update of RDAP database": "2026-10-13T23:18:14Z"
            },
            "registrar_iana_id": "9999"
        }
    }
}
```