regul[.]rw

PhishDestroy first observed regul.rw on Jun 13, 2026. The captured page title is “Account Suspended”. Stored page analysis classifies the content as generic phishing. Current evidence score: 100/100 (critical).

Positive findings are stored from 2 sources: VirusTotal and DNS security resolvers. VirusTotal recorded 17 detections among 91 engines: Criminal IP, alphaMountain.ai, BitDefender, Certego, Cluster25, CRDF, CyRadar, ESET, Forcepoint ThreatSeeker, Fortinet, G-Data, Gridinsoft, Lionic, MalwareURL, SOCRadar, Sophos, VIPRE on Jul 28, 2026 at 02:57 UTC. DNS security checks returned 4 blocking results across 14 tested policies: Control D Adblock, Control D Family, Control D Malware, Quad9 Secure; no observation timestamp was retained. Non-positive and contextual checks: Gridinsoft assigned a trust score of 1/100; no observation timestamp was retained. AlienVault OTX listed 1 community pulse reference (not vendor detections) on Jun 13, 2026 at 16:11 UTC. The external blocklist snapshot contained no matches on Aug 7, 2026 at 22:20 UTC. Google Safe Browsing returned no flag on Jun 25, 2026 at 19:26 UTC.

Cloaking was recorded with HTTP 302 on Aug 7, 2026 at 22:23 UTC. The cloaking probe recorded status split conditional delivery at 1/100 on Aug 7, 2026 at 22:23 UTC: redirect: raw=redirect_302; http=302; via=https_proxy; location=https://regul.rw/cgi-sys/suspendedpage.cgi; server=Apache. Registration records for the domain list HOSTAFRICA as the registrar. At collection time, the hostname resolved to 209.145.52.241 (AS40021 Contabo Inc.). The recorded endpoint location is St. Louis, US. The stored server header is Apache. The evidence archive retains 1 visual capture from PhishDestroy. TLS metadata lists Let's Encrypt as the certificate issuer with validity through Aug 13, 2026; checked Jul 9, 2026 at 01:00 UTC.

The content indicators and 2 positive source findings support the current generic phishing classification.