restabengkulukota[.]bengkulu[.]polri[.]go[.]id

This domain is flagged as a credential harvesting phishing site targeting Indonesian law enforcement credentials. Analysis indicates an elevated risk level due to its impersonation of a legitimate regional police portal (Polsek Ratu Samban – Polresta Bengkulu) and its use of deceptive infrastructure to capture sensitive login data. Infrastructure analysis reveals the domain was registered on March 27, 2026, through PANDI Registrar and resolves to IP address 120.29.231.10. Detection metrics show 1/95 security vendors on VirusTotal flagged the domain, while Gridinsoft assigned a trust score of 0/100. The domain appears on one security blocklist and was actively blocked by PhishDestroy. Technical indicators include the use of WordPress, MySQL, PHP, Apache HTTP Server, and frontend libraries such as Swiper, jQuery Migrate, and jQuery. A Let's Encrypt SSL certificate was deployed, likely to enhance legitimacy. Mitigation requires immediate blacklisting of the domain and associated IP (120.29.231.10) across security gateways. Network administrators should inspect logs for connections to the domain or IP, particularly from systems accessing law enforcement portals. End-users should be alerted to verify domain authenticity before entering credentials, especially for subdomains of polri.go.id. Organizations are advised to implement multi-factor authentication (MFA) for all sensitive accounts to mitigate credential theft risks. Monitoring for similar impersonation domains (e.g., typosquatting or subdomain spoofing of polri.go.id) is recommended.