mail7[.]sspl[.]com[.]auwww[.]aucom[.]aumail7[.]sspl[.]com[.]auwww[.]mail7[.]sspl[.]com[.]auwww[.]sspl[.]com[.]aumail7[.]sspl[.]com[.]auwww[.]mail7[.]sspl[.]com[.]au

This domain is flagged as a high-risk credential harvesting phishing site targeting users through deceptive email and web infrastructure. Analysis indicates the domain is designed to mimic legitimate login portals, tricking victims into submitting sensitive credentials such as usernames, passwords, and multi-factor authentication codes. The threat type is classified as generic_phishing with a focus on broad-scale credential theft, likely targeting corporate or financial sector users given the domain structure and hosting patterns. Infrastructure analysis reveals the domain resolves to IP address 185.184.154.169, hosted on AS38719 (Dreamscape Networks Limited) in Australia. The domain is registered through Web Address Registration Pty Ltd and uses a Let's Encrypt SSL certificate (R12). It appears on two security blocklists (PhishDestroy, PhishingDB) and is flagged by Google Safe Browsing as phishing. VirusTotal reports 15 out of 95 security vendors detecting the domain as malicious, with a page title of 'Index of /' indicating an exposed directory listing, a common trait in hastily deployed phishing infrastructure. The domain is currently offline, but historical activity suggests it was operational long enough to pose a significant threat. Mitigation steps for organizations include immediate blocking of the domain and its associated IP (185.184.154.169) at the firewall, email gateway, and DNS levels. Security teams should conduct a retrospective analysis of logs to identify any prior interactions with the domain or IP, particularly focusing on credential submission events. End-users who may have visited the site should be instructed to reset passwords for any accounts accessed during the exposure window, enable multi-factor authentication where available, and monitor for unauthorized activity. Given the domain's registration details, additional scrutiny should be applied to similar domains registered through the same provider or hosted on the same ASN.