sspl[.]com[.]auauwww[.]live[.]sspl[.]com[.]au

This domain, sspl.com.auauwww.live.sspl.com.au, was observed serving an HTTP 200 response with the page title “Index of /”. The site is currently offline but historical data shows it was hosted on IP 185.184.154.169, an address allocated to Dreamscape Networks Limited (AS38719) in Australia. The hosting infrastructure used three Vodien nameservers (ns1.vodien.com, ns2.vodien.com, ns3.vodien.com) and the SSL certificate was issued by Let’s Encrypt (R12), indicating that TLS encryption was available at the time of capture. The registrar listed for the domain is Web Address Registration Pty Ltd. Threat intelligence flags the domain as a Google brand impersonation campaign. Google Safe Browsing classifies the site as “social engineering”, and PhishDestroy has added it to its blocklist.

In addition, the domain appears on one external security blocklist. VirusTotal analysis recorded detections from 14 of 95 scanning engines, reinforcing the malicious classification. The Gridinsoft trust score is 0 out of 100, the lowest possible rating. Because the site is no longer reachable, direct content analysis is not possible, leaving the exact phishing payload and credential‑stealing mechanisms unknown. However, the combination of a legitimate‑looking SSL certificate, a generic “Index of /” index page, and the presence of multiple independent detections strongly suggests a credential‑harvesting operation targeting Google users.

Defenders should immediately add the domain name and its associated IP address to deny‑list rules in firewalls, DNS filters, and email gateways. Continuous monitoring of the listed nameservers and the AS38719 prefix is advised, as the same infrastructure may be reused for future campaigns. Updating web‑gateway reputation feeds with the VirusTotal detection count and the Google Safe Browsing social‑engineering flag will improve early blocking of related attempts.