auwww[.]mail7[.]sspl[.]com[.]auwww[.]aucom[.]aumail7[.]sspl[.]com[.]auwww[.]mail7[.]sspl[.]com[.]auwww[.]sspl[.]com[.]aumail7[.]sspl[.]com[.]auwww[.]mail7[.]sspl[.]com[.]au

The domain mail7.sspl.com.au and its associated subdomains, including auwww.mail7.sspl.com.au and sspl.com.auwww.mail7.sspl.com.au, have been identified as part of a credential theft phishing campaign. Analysis indicates the infrastructure was actively targeting users to harvest login credentials, financial details, or other sensitive information. As of the latest assessment, the domain has been taken offline, though residual risks may persist due to prior exposure. Infrastructure analysis reveals the domain was flagged by 12 of 95 security vendors on VirusTotal, indicating a high-confidence detection of malicious activity. The domain was registered through Web Address Registration Pty Ltd and resolved to the IP address 185.184.154.169, hosted under AS38719 (Dreamscape Networks Limited) in Australia. It appeared on two security blocklists, including PhishDestroy and PhishingDB, and was explicitly flagged by Google Safe Browsing for phishing. The SSL certificate, issued by Let's Encrypt (R12), was likely exploited to lend a false sense of legitimacy to the phishing pages. The page title, 'Index of /', suggests an exposed directory listing, a common indicator of misconfigured or intentionally compromised servers used for malicious hosting. Current status confirms the domain is offline, reducing immediate exposure risks. However, organizations and users should remain vigilant for residual threats, such as cached pages, redirects, or secondary domains leveraging similar infrastructure. Recommended actions include blocking the IP address 185.184.154.169 at the network perimeter, monitoring for related subdomains or SSL certificates issued to the same registrar, and conducting retrospective log analysis for connections to the domain or IP. Users who may have interacted with the domain should reset credentials, enable multi-factor authentication, and review accounts for unauthorized activity. Proactive threat hunting for indicators of compromise associated with this campaign is advised for enterprise security teams.