# restabalong.kalsel.polri.go.id — SUSPICIOUS

> PhishDestroy identifies restabalong.kalsel.polri.go.id as a credential theft site with only 1 out of 95 VirusTotal vendors flagging it.

## Summary
PhishDestroy has flagged restabalong.kalsel.polri.go.id as a credential theft site designed to trick users into revealing login details. This domain mimics official police resources in South Kalimantan, Indonesia, using a Let’s Encrypt SSL certificate to appear legitimate. The site was recently linked to a single IP address (120.29.231.22) and remains active despite minimal detection.  This domain was flagged after VirusTotal analysis revealed just 1 security vendor out of 95 detected the threat, while the domain itself remains unresolved to its claimed government context. The low detection rate suggests this credential theft operation may be newly active or deliberately evasive, exploiting trust in regional government domains. Registrar details and creation date were not disclosed in public records, but the site’s infrastructure points to a recent deployment.  If you visited this site, avoid entering any login credentials or personal information. Clear your browser cache and run a malware scan on your device. Report the domain to local cybersecurity agencies and avoid clicking links from unsolicited messages claiming to be from police authorities in South Kalimantan.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registrar: REGISTRAR_NOT_FOUND
- IP: 120.29.231.22

## Detection Status
- VirusTotal: 1 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/87f0fca3-e402-48b3-9b8c-6e9f723eaba7
- PhishDestroy: https://phishdestroy.io/domain/restabalong.kalsel.polri.go.id/
- LLM endpoint: https://phishdestroy.io/domain/restabalong.kalsel.polri.go.id/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/restabalong.kalsel.polri.go.id/
Last updated: 2026-03-21