beltim[.]babel[.]polri[.]go[.]id

PhishDestroy identifies a live crypto-draining phishing campaign impersonating Polri’s official domain via beltim.babel.polri.go.id. The site is currently active and distributing malicious payloads that exfiltrate cryptocurrency wallet credentials and private keys. Users should treat this domain as hostile and avoid all interactions.

This domain was flagged by zero of ninety-five VirusTotal vendors at the time of analysis, indicating that most signature-based scanners have not yet blacklisted it. The site resolves to IP address 120.29.231.9 and holds a valid Let’s Encrypt SSL certificate to appear legitimate. Creation data, registrar identity, and historical blocklist counts remain under further investigation; however, the combination of a recently issued certificate and zero detections elevates its threat level to active exploitation.

The threat is deemed active and evolving; concrete recommendations include blocking the domain at the network perimeter, revoking the SSL certificate through the issuing authority, and updating endpoint rules to deny outbound connections to 120.29.231.9. All users should verify any Polri-related link via PhishDestroy before clicking and enable hardware wallet confirmation for all crypto transactions to mitigate drainer risks.