tribratanews-reslampungutara[.]lampung[.]polri[.]go[.]id

The subdomain tribratanews-reslampungutara.lampung.polri.go.id is listed as active on July 27, 2026. DNS resolution returns a single A record pointing to 120.29.231.79, while the nameserver query fails (NS_NOT_FOUND). A VirusTotal scan involving 91 antivirus engines returned no detections, but the lack of flags does not constitute evidence of safety. The domain appears on one security blocklist and is actively blocked by the PhishDestroy service, indicating that it has been identified as part of a credential‑harvesting campaign.

No SSL/TLS certificate information, HTTP status code, or page title has been disclosed, so the presence or nature of any web service cannot be confirmed. Registrar details, creation or expiration dates, and ASN or hosting provider data are absent from the available intelligence. The IP address 120.29.231.79 is associated with an Indonesian ISP according to public WHOIS records, but without ASN attribution the hosting environment remains unclear. Because the observable infrastructure is limited, the precise scope of the phishing operation is uncertain, yet the blocklist inclusion suggests malicious intent.

Defenders should add both the domain and its resolved IP to network deny lists, monitor DNS queries for similar lampung.polri.go.id subdomains, and consider sinkholing the IP if operationally feasible. Continuous rescanning with multi‑engine services is recommended to detect any future payloads that may be uploaded. Logging of outbound connections to the IP should be flagged for investigation, and users should be warned not to interact with communications referencing this domain.