duplicate-disabled-189753.invalid

The domain www.barexpert.pl was observed on July 12, 2026 delivering a credential phishing page titled “NAGA99 Sewa Bar Mobile Terbaik untuk Pernikahan & Event”. The site returns HTTP 200, is listed on a single security blocklist and has been flagged by PhishDestroy. VirusTotal scans show three out of ninety‑five security vendors marking the domain as malicious. The page’s SSL certificate is issued by home.pl S.A., using a DV TLS G2 R35 CA, confirming the certificate chain is publicly trusted. Technical infrastructure indicates the domain resolves to IP address 188.128.210.31, which resolves to a hosting provider located in Poland (home.pl S.A.). The domain was registered on April 02, 2026 through home.pl sp. z o.o., and utilizes the DNS resolvers dns.home.pl, dns2.home.pl, and dns3.home.pl. A Gridinsoft trust score of 0 out of 100 further underscores the suspicious nature of the host. The content presented mimics a legitimate service for mobile bar rentals, targeting users seeking wedding or event supplies. By leveraging a familiar brand‑like name (“NAGA99”) the page attempts to harvest login credentials and personal data. While the exact phishing kit or exfiltration endpoint is not disclosed in the collected intelligence, the presence of a valid TLS certificate and a functional web server suggests a low‑cost, rapid‑deployment operation typical of credential‑phishing campaigns. Defenders should block resolution of www.barexpert.pl at network perimeter and add the associated IP 188.128.210.31 to deny lists. Email gateways should be tuned to detect messages containing the “NAGA99 Sewa Bar Mobile” phrase or similar Indonesian‑language promotional text. Continuous monitoring of the home.pl name‑server range is advised, as the same provider has hosted multiple malicious domains in recent months. Incident response teams should also review logs for any outbound connections to the identified IP and investigate potential credential compromises.