restabalong[.]kalsel[.]polri[.]go[.]id

Analysis of restabalong.kalsel.polri.go.id shows a confirmed brand‑impersonation campaign targeting the Manta brand. The site was registered on 22 March 2026 through the PANDI registrar and resolved to IP address 120.29.231.22, which geolocates to the Markas Besar Kepolisian Republik Indonesia in Indonesia. The server presents a Google Trust Services / WE1 SSL certificate, indicating a valid TLS handshake despite the malicious intent. HTTP responses return a 403 status code, suggesting the content is currently inaccessible, and the domain has been taken offline after detection. Infrastructure fingerprints reveal a WordPress stack backed by MySQL and PHP, operating on Apache HTTP Server.

Front‑end components include All in One SEO, Slick, jQuery Migrate, and jQuery, matching the technology profile of many compromised sites. The domain is listed on a single security blocklist and was flagged by PhishDestroy, confirming active remediation. VirusTotal records show that one out of ninety‑four security vendors flagged the domain, providing additional external corroboration of malicious behavior. Reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, reinforcing the high‑risk assessment. The DNS configuration uses four nameservers (b.dns.id, c.dns.id, d.dns.id, e.dns.id).

The page title returned from the server is "- Web Resmi Polres Tabalong Polda Kalimantan Selatan," a legitimate police website title that the impersonator likely leveraged to increase credibility. Defenders should block the domain at perimeter firewalls, update endpoint URL filtering lists, and monitor the associated IP for any future re‑hosting activity. Continuous observation of the nameserver records is advised, as changes could indicate attempts to resurrect the campaign. Incident response teams should also review any recent Manta‑related communications for potential phishing attempts linked to this infrastructure.